CVE-2012-0769, the case of the perfect info leak

2012-04-09 Thread Fermín J . Serna
Hi, During the last few months I have been researching Adobe's Flash vulnerabilities ranging from type confusion vulnerabilities, AS3 API vulnerabilities (CVE-2012-0769), sandbox escapes (CVE-2012-0724 & CVE-2012-0725), etc. I am pleased to announce the release of part of this research. In this c

Secunia Research: Helix Server SNMP Master Agent Service Two Denial of Service Vulnerabilities

2012-04-09 Thread Secunia Research
== Secunia Research 09/04/2012 - RealNetworks Helix Server SNMP Master Agent - - Two Denial of Service Vulnerabilities - ==

Secunia Research: RealNetworks Helix Server Credentials Disclosure Security Issue

2012-04-09 Thread Secunia Research
== Secunia Research 09/04/2012 - RealNetworks Helix Server Credentials Disclosure Security Issue - == Table of Contents Affected Softwa

OWASP ZAP 1.4.0 released

2012-04-09 Thread psiinon
Hi folks, I'm very pleased to announce that version 1.4.0 of the OWASP Zed Attack Proxy (ZAP) has now been released. This release adds the following main features: * Syntax highlighting * fuzzdb integration * Parameter analysis * Enhanced XSS scanner * A port of some of the Watcher checks * Pluga

[Suspected Spam] Astaro Security Gateway v7.504 - Multiple Web Vulnerabilities

2012-04-09 Thread Research
Title: == Astaro Security Gateway v7.504 - Multiple Web Vulnerabilities Date: = 2012-04-08 References: === http://www.vulnerability-lab.com/get_content.php?id=8 VL-ID: = 8 Introduction: = Das Astaro Security Gateway 625 wurde speziell für den Schutz großer U

[Suspected Spam] Astaro Command Center v2.x - Multiple Web Vulnerabilities

2012-04-09 Thread Research
Title: == Astaro Command Center v2.x - Multiple Web Vulnerabilities Date: = 2012-04-03 References: === http://www.vulnerability-lab.com/get_content.php?id=4 VL-ID: = 4 Introduction: = We are pleased to announce the General Availability of the Astaro Command

CsForum v0.8 - Cross Site Scripting Vulnerability

2012-04-09 Thread Research
Title: == CsForum v0.8 - Cross Site Scripting Vulnerability Date: = 2012-04-05 References: === http://www.vulnerability-lab.com/get_content.php?id=496 VL-ID: = 496 Introduction: = Forum very simple installation, this script is very light and yet it has sever

osCmax Shop CMS v2.5.1 - Multiple Web Vulnerabilities

2012-04-09 Thread Research
Title: == osCmax Shop CMS v2.5.1 - Multiple Web Vulnerabilities Date: = 2012-04-08 References: === http://www.vulnerability-lab.com/get_content.php?id=497 VL-ID: = 497 Introduction: = osCMax is a powerful e-commerce/shopping cart web application. There are ma

idev Game Site CMS v1.0 - Multiple Web Vulnerabilites

2012-04-09 Thread Research
Title: == idev Game Site CMS v1.0 - Multiple Web Vulnerabilites Date: = 2012-04-08 References: === http://www.vulnerability-lab.com/get_content.php?id=494 VL-ID: = 494 Introduction: = Start your own Flash web game website. Search engine optimized. Embed your

[Suspected Spam] AnvSoft Any Video Converter 4.3.6 - Multiple Buffer Overflow Vulnerabilities

2012-04-09 Thread Research
Title: == AnvSoft Any Video Converter 4.3.6 - Multiple Buffer Overflow Vulnerabilities Date: = 2012-04-08 References: === http://www.vulnerability-lab.com/get_content.php?id=492 VL-ID: = 492 Introduction: = An all-in-one user-friendly DVD ripper, Video Record

CitrusDB 2.4.1 - LFI/SQLi Vulnerability

2012-04-09 Thread blaszczakm
CitrusDB 2.4.1 - LFI/SQLi Vulnerability Author: Michal `wacky` Blaszczak WWW: blaszczakm.blogspot.com CitrusDB is an open source customer service and billing database. It can be used by customer service personnel to provide sales and support to customers, and by billing staff to bill customers

[waraxe-2012-SA#085] - Reflected XSS in Uploadify Integration Wordpress plugin

2012-04-09 Thread come2waraxe
[waraxe-2012-SA#085] - Reflected XSS in Uploadify Integration Wordpress plugin === Author: Janek Vind "waraxe" Date: 06. April 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-85.html Description of vuln

[waraxe-2012-SA#084] - Multiple Vulnerabilities in OpenCart 1.5.2.1

2012-04-09 Thread come2waraxe
[waraxe-2012-SA#084] - Multiple Vulnerabilities in OpenCart 1.5.2.1 === Author: Janek Vind "waraxe" Date: 06. April 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-84.html Description of vulnerable soft

[CVE-2012-1574] Apache Hadoop user impersonation vulnerability

2012-04-09 Thread Aaron T. Myers
Hello, Users of Apache Hadoop should be aware of a security vulnerability recently discovered, as described by the following CVE. In particular, please note the "Users affected", "Versions affected", and "Mitigation" sections. Best, Aaron -- Aaron T. Myers Software Engineer, Cloudera CVE-2012-1

PHPNuke Module's Name Download SQL Injection Vulnerabilities

2012-04-09 Thread CrAzY_CrAcKeR
## ## # # _ _ _ # .-" "-. # /\ # | | # |, .-. .-