Re: PHPCentral Poll Script Remote Command Execution Vulnerability

On Monday 20 August 2007 23:10:22 [EMAIL PROTECTED] wrote: > HI: > > I am the creator of this poll script, and would like to do whatever > possible to make this NOT vulnerable.  Thanks for finding this, and hope I > can help. I guess, if "register_globals" option is off (it's off by default since

Re: Re: Safari for windows remote arbitry file upload

[EMAIL PROTECTED] wrote in response to me: >"I don't see that this is a bug. Could you explain a little more fully?" > >well configured like this by default,it's a security hole . it's a perfect >hole for a virus, trojan, etc. you can send any malicous files to a remote >desktop via a malicious we

RE: Skype Network Remote DoS Exploit

Apologies if someone already posted the obvious question but: How come this Patch Tuesday was different for Skype? Why didn't the last Patch Tuesday, which had the same rebooting requirements as any other Patch Tuesday, cause the same problem with Skype? What was different about this Patch Tuesd

ZDI-07-049: EMC Legato Networker Remote Exec Service Stack Overflow Vulnerabilities

ZDI-07-049: EMC Legato Networker Remote Exec Service Stack Overflow Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-07-049.html August 20, 2007 -- CVE ID: CVE-2007-3618 -- Affected Vendor: EMC Software -- Affected Products: Networker 7.x.x -- TippingPoint(TM) IPS Cus

Mambo Component SimpleFAQ V2.11 - Remote SQL Injection

# Mambo Component SimpleFAQ V2.11 - Remote SQL Injection # Vendor: http://www.parkviewconsultants.com/ # Found By : k1tk4t - k1tk4t[4t]newhack.org # Location : Indonesia -- #newhack[dot]org @irc.dal.net #

Re: PHPCentral Poll Script Remote Command Execution Vulnerability

HI: I am the creator of this poll script, and would like to do whatever possible to make this NOT vulnerable. Thanks for finding this, and hope I can help.

[HISPASEC] Fileinfo 2.0.9 plugin for Total Commander multiple vulnerabilities

HISPASEC Security Advisory http://blog.hispasec.com/lab/ Name : Fileinfo multiple vulnerabilities Class: Local DoS, Information Spoofing Threat level : Low Discovered : 2007-08-05 Published: 2007-08-20 Credit : Gynvael Coldwind Vulnerable : 2.0.9, prior versions also

Re: SYMSA-2007-007: Palm OS Treo Smartphone Denial of Service

Hi. Is this fundamentally different than the previously reported PalmOS ICMP denial of service bug (CVE-2003-0293)? Thanks, Stuart

Re: TS-2007-003-0: BlueCat Networks Adonis CLI root privilege escalation

BlueCat Networks is aware of this situation involving the CLI (known as the Adonis Administration Console) that can give an admin user unauthorized root privileges on the system. This situation may only arise if an administrator has admin login capabilities to the CLI whether through SSH access

[ MDKSA-2007:167-1 ] - Updated libvorbis packages fix vulnerabilities

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDKSA-2007:167-1 http://www.mandriva.com/security/ ___

SYMSA-2007-007: Palm OS Treo Smartphone Denial of Service

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Symantec Vulnerability Research http://www.symantec.com/research Security Advisory Advisory ID: SYMSA-2007-007 Advisory Title: Palm OS Treo Smartphone Denial of Service Authors:

Re: COSEINC Linux Advisory #1: Linux Kernel Parent Process Death Signal Vulnerability

On Fri, 17 Aug 2007, Glynn Clements wrote: > There definitely appears to be potential for DoS against system-wide > resources. > Only the potential. In most cases that potential will remain unimplemented since there are only a few setuid binaries in the system, so the real DoS attack may be eithe

Re: Skype Network Remote DoS Exploit

The outage being experienced by Skype was apparently due to massive simultaneous reboots and reconnects after systems installed their Windows patches. from http://heartbeat.skype.com/2007/08/what_happened_on_august_16.html: The disruption was triggered by a massive restart of our users' co

[Reversemode Advisory] CheckPoint ZoneLabs Vsdatant.sys multiple local privilege escalation vulnerabilities

CHECK POINT ZONE LABS PRODUCTS MULTIPLE LOCAL PRIVILEGE ESCALATION VULNERABILITIES Ruben Santamarta < ruben(at)reversemode(dot)com > 08.20.2007 Affected Products: < ZoneAlarm 7.0.362 Vsdatant.sys is exposed via “\\.\vsdatant”. The permissive ACL allows everyone to invoke privileged IOCTLs impl

[ MDKSA-2007:167 ] - Updated libvorbis packages fix vulnerabilities

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDKSA-2007:167 http://www.mandriva.com/security/ ___

Re: Joomla J! Reactions Component Remote File include Bug

The entire langset.php file should be changed to: The spam expolit occurs because the original file does not test VALID_MOS. This vulnerability exists in build 1.8.1 and earlier.

[ MDKSA-2007:166 ] - Updated rsync packages fix off-by-one buffer overflow

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDKSA-2007:166 http://www.mandriva.com/security/ ___

[ GLSA 200708-14 ] NVIDIA drivers: Denial of Service

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200708-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

Re: COSEINC Linux Advisory #1: Linux Kernel Parent Process Death Signal Vulnerability

Dan Yefimov wrote: > > > Really? An what if we fork right after startup and perform operations as > > > a > > > child? > > > > That would work, but might have undesirable consequences of its own. > > > > In particular, it prevents a non-malicious caller from using PDEATHSIG > > to send e.g.

IMF 2007 - Call for Participation

Dear all, registration to IMF 2007 is open now. CALL FOR PARTICIPATION IMF 2007 3rd International Conference on IT-Inci

iDefense Security Advisory 08.20.07: Check Point Zone Labs VSDATANT Multiple IOCTL Privilege Escalation Vulnerabilities

Check Point Zone Labs VSDATANT Multiple IOCTL Privilege Escalation Vulnerabilities iDefense Security Advisory 08.20.07 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 20, 2007 I. BACKGROUND Zone Alarm products provide security solutions such as anti-virus, firewall, spy-ware, and ad-w

iDefense Security Advisory 08.20.07: Check Point Zone Labs Multiple Products Privilege Escalation Vulnerability

Check Point Zone Labs Multiple Products Privilege Escalation Vulnerability iDefense Security Advisory 08.20.07 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 20, 2007 I. BACKGROUND Zone Alarm products provide security solutions such as anti-virus, firewall, spy-ware, and ad-ware prot

OWASP Mumbai Meeting : 6th Sep 2007

Mumbai Celebrates OWASP Day : OWASP Live 0 OWASP Day - Day of Worldwide OWASP One Day Conferences Date: 6th September ,2007 Timing: 2:30 PM to 6:00 PM Venue: HOTEL HEAVENS INDIA Plot No A-1, Opposite SDF 4, SEEPZ, SEZ, ANDHERI (E)- MUMBAI Registrations - LIMITED SEATS !!! The event is FREE

[SECURITY] [DSA 1357-1] New koffice packages fix arbitrary code execution

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1357-1[EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff August 19th, 2007

[ GLSA 200708-15 ] Apache mod_jk: Directory traversal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200708-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

Gurur Haber v2.0

#Gurur Portal (tr) uyeler2.php Remote Sql injection download:http://php.arsivimiz.com/ara.php?Arama=Gurur+haber+v1.3&Kategori= #exploit usage example : site.com/path/uyeler2.php?id=-1%20union+select+0,kadi,2,id,sifre,5,6,7,8,9,10,11+from+uyeler #dumenci # eyw MEFISTO

Astaro DOS and POP3 bypass issues partially resolved

http://www.hescominsoon.com/archives/773 I mentioned earlier about a DOS issue and a pop3 bypass issue. There is a fix now. Make a backup of your configuration and have the system e-mail it to you. Reload the box with the latest 7.006 ISO and then restore the backup. That resolves the pfil

report a bug !

### [ Aria-Security Team ] ### Hosting & Design by Emcon.be - Web Login Bypass (SQL Injection) ## ### Credits: Sc0rpion From Aria Security Team ### Just For fun ! ### Site : www.emcon.be ### Google-D0rk: "Hosting & Design by Emcon.be " #