exploit the possibilities
Showing 1 - 25 of 54 RSS Feed

Files Date: 2011-10-25

Joomla YJ Contact Local File Inclusion
Posted Oct 25, 2011
Authored by MeGo

The Joomla YJ Contact component suffers from a local file inclusion vulnerability.

tags | exploit, local, file inclusion
SHA-256 | 14b63d4cd8536eb5a40ccc49a0ccbff854ddb4ce8b606664beda0c785752f6f3
Packet Fence 3.0.2
Posted Oct 25, 2011
Site packetfence.org

PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.

Changes: This minor release focused on small improvements and fixes, including some security fixes. Enhancements included Trapeze hardware support, support for wireless devices in bridge mode, and guest management options put behind configurable values. There were several inline enforcement and guest management fixes, changes to default firewall rules, fixes for long-standing issues with the pie charts in the Web admin, and several other minor bugfixes.
tags | tool, remote
systems | unix
SHA-256 | af3d1d15aee34cb94384d7f4243732ec621858e184034b9f9d47e3d472356071
Haveged 1.3
Posted Oct 25, 2011
Site issihosts.com

haveged is a daemon that feeds the /dev/random pool on Linux using an adaptation of the HArdware Volatile Entropy Gathering and Expansion algorithm invented at IRISA. The algorithm is self-tuning on machines with cpuid support, and has been tested in both 32-bit and 64-bit environments. The tarball uses the GNU build mechanism, and includes self test targets and a spec file for those who want to build an RPM.

Changes: haveged has been reorganized to allow its collection mechanism to be better accessed directly through the file system. This reorganization includes the option to suppress the daemon interface in the build for circumstances where /dev/random is unavailable or its use is inappropriate. This also means that haveged can now be built and used on non-Linux systems.
tags | tool
systems | linux, unix
SHA-256 | 3c37f73250f76fc61da6936d0f5bff2ec4239282a879eda4a8fa56c380ee6436
Red Hat Security Advisory 2011-1402-01
Posted Oct 25, 2011
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2011-1402-01 - FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. The freetype packages for Red Hat Enterprise Linux 4 provide both the FreeType 1 and FreeType 2 font engines. The freetype packages for Red Hat Enterprise Linux 5 and 6 provide only the FreeType 2 font engine. Multiple input validation flaws were found in the way FreeType processed bitmap font files. If a specially-crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

tags | advisory, arbitrary
systems | linux, redhat
advisories | CVE-2011-3256
SHA-256 | c7f037ddbca66c8170d8598d388997627e573c9e761a50b0b2ee169405cc1500
Ubuntu Security Notice USN-1248-1
Posted Oct 25, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1248-1 - Tim Brown discovered that KSSL in KDE-Libs did not properly perform input validation when displaying the common name (CN) for an SSL certificate. An attacker could exploit this to spoof the common name which could be used in an attack to trick the user into accepting a fraudulent certificate. This issue only affected Ubuntu 10.04 LTS and Ubuntu 10.10. It was discovered that KIO in KDE-Libs did not properly perform input validation during proxy authentication. An attacker could exploit this to modify displaying of the realm and proxy URL. Various other issues were also addressed.

tags | advisory, spoof
systems | linux, ubuntu
advisories | CVE-2011-3365
SHA-256 | b72f099c8d8ac3650765e3fd99be619d5711842026d8fc594ef9d2cacd4f30d8
Ubuntu Security Notice USN-1238-2
Posted Oct 25, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1238-2 - USN-1238-1 fixed vulnerabilities in Puppet. The upstream patch introduced a regression in Ubuntu 11.04 when executing certain commands. This update fixes the problem. It was discovered that Puppet incorrectly handled the non-default "certdnsnames" option when generating certificates. If this setting was added to puppet.conf, the puppet master's DNS alt names were added to the X.509 Subject Alternative Name field of all certificates, not just the puppet master's certificate. An attacker that has an incorrect agent certificate in his possession can use it to impersonate the puppet master in a man-in-the-middle attack.

tags | advisory, vulnerability
systems | linux, ubuntu
advisories | CVE-2011-3872
SHA-256 | 24f1ff0a4bf1e3e276009e4999f192df87a00a2098234c3807f2ffc5f471cff2
Ubuntu Security Notice USN-1247-1
Posted Oct 25, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1247-1 - An information leak was discovered in Nova. An attacker with access to a valid EC2_ACCESS_KEY could obtain the corresponding EC2_SECRET_KEY for that user.

tags | advisory
systems | linux, ubuntu
SHA-256 | 9b707c8e51ca0ee5dee39844216701abe7fbf2311aaacbfa1dc3af5e0da96320
Jara 1.6 Cross Site Scripting
Posted Oct 25, 2011
Authored by Expl0its

Jara version 1.6 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 08036c096ed9ba555d987f0a515c9421a8e0f73c23a18cc498818681fbd8d29c
HP Security Bulletin HPSBUX02700 SSRT100506 2
Posted Oct 25, 2011
Authored by HP | Site hp.com

HP Security Bulletin HPSBUX02700 SSRT100506 2 - Potential security vulnerabilities have been identified in HP-UX running the Veritas Enterprise Administrator (VEA), which comes bundled with VxVM. The vulnerabilities could be exploited remotely to create a Denial of Service (DoS) or execute arbitrary code. Revision 2 of this advisory.

tags | advisory, denial of service, arbitrary, vulnerability
systems | hpux
advisories | CVE-2011-0547
SHA-256 | a3e0b0569f4cb0ca3cea2b7e8d6e6f4bd6aac78d3f8413c2a137ce0d3ef48f4e
Gentoo Linux Security Advisory 201110-23
Posted Oct 25, 2011
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201110-23 - An input sanitation flaw in mod_authnz_external allows remote attacker to conduct SQL injection. Versions prior to 3.2.6 are affected.

tags | advisory, remote, sql injection
systems | linux, gentoo
advisories | CVE-2011-2688
SHA-256 | 199e8bf204b111a8bf85a0a7eabb27f27de06cfc4f46386df48331400a29dd26
Ubuntu Security Notice USN-1246-1
Posted Oct 25, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1246-1 - Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service. Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. Various other issues were also addressed.

tags | advisory, remote, denial of service, local, root
systems | linux, ubuntu
advisories | CVE-2011-2213, CVE-2011-2497, CVE-2011-2695, CVE-2011-2700, CVE-2011-2723, CVE-2011-2928, CVE-2011-3188, CVE-2011-3191
SHA-256 | cf11a06c88404689f3315bfbc23864bb0580bd1f90eb5d3cfcb5f38c2c2438a0
Ubuntu Security Notice USN-1245-1
Posted Oct 25, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1245-1 - Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. Vasiliy Kulikov and Dan Rosenberg discovered that ecryptfs did not correctly check the origin of mount points. A local attacker could exploit this to trick the system into unmounting arbitrary mount points, leading to a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary, kernel, local
systems | linux, ubuntu
advisories | CVE-2011-1576, CVE-2011-1833, CVE-2011-2494, CVE-2011-2495, CVE-2011-2497, CVE-2011-2695, CVE-2011-2699, CVE-2011-2905, CVE-2011-2928, CVE-2011-3188, CVE-2011-3191
SHA-256 | 6c2fdc6fb88de2201319a3a2c820b9ee501477683f43a26fc633346bfd7e0794
Ubuntu Security Notice USN-1244-1
Posted Oct 25, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1244-1 - Dan Rosenberg discovered that the Linux kernel X.25 implementation incorrectly parsed facilities. A remote attacker could exploit this to crash the kernel, leading to a denial of service. Andrea Righi discovered a race condition in the KSM memory merging support. If KSM was being used, a local attacker could exploit this to crash the system, leading to a denial of service. Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly handled unlock requests. A local attacker could exploit this to cause a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service, kernel, local
systems | linux, ubuntu
advisories | CVE-2010-3873, CVE-2011-2183, CVE-2011-2491, CVE-2011-2494, CVE-2011-2495, CVE-2011-2517, CVE-2011-2695, CVE-2011-2905, CVE-2011-2909, CVE-2011-3363
SHA-256 | e4754fa6724234d333d49b5c5ae6f7479b66f52067e7648702db16544a280bcd
Ubuntu Security Notice USN-1243-1
Posted Oct 25, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1243-1 - It was discovered that the security fix for CVE-2010-4250 introduced a regression. A remote attacker could exploit this to crash the system, leading to a denial of service. Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. Vasiliy Kulikov discovered that /proc/PID/io did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. Various other issues were also addressed.

tags | advisory, remote, denial of service, local
systems | linux, ubuntu
advisories | CVE-2011-1479, CVE-2011-2494, CVE-2011-2495, CVE-2011-2695, CVE-2011-2905, CVE-2011-2909, CVE-2011-3188, CVE-2011-3363
SHA-256 | 17f248b3931a988aad14812534c1789db9fb19d3669e1520b000fb81fd5b0df9
Ubuntu Security Notice USN-1242-1
Posted Oct 25, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1242-1 - It was discovered that the security fix for CVE-2010-4250 introduced a regression. A remote attacker could exploit this to crash the system, leading to a denial of service. Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. Vasiliy Kulikov discovered that /proc/PID/io did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. Various other issues were also addressed.

tags | advisory, remote, denial of service, local
systems | linux, ubuntu
advisories | CVE-2011-1479, CVE-2011-2494, CVE-2011-2495, CVE-2011-2695, CVE-2011-2905, CVE-2011-2909, CVE-2011-3188, CVE-2011-3363, CVE-2010-4250
SHA-256 | 544731c1bb12667fa7a9b5b5b16ac0871a169440d284556042daf2acc1e9a8f4
Ubuntu Security Notice USN-1241-1
Posted Oct 25, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1241-1 - It was discovered that the Stream Control Transmission Protocol (SCTP) implementation incorrectly calculated lengths. If the net.sctp.addip_enable variable was turned on, a remote attacker could send specially crafted traffic to crash the system. Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service, kernel, protocol
systems | linux, ubuntu
advisories | CVE-2011-1573, CVE-2011-1576, CVE-2011-1776, CVE-2011-2213, CVE-2011-2494, CVE-2011-2495, CVE-2011-2496, CVE-2011-2497, CVE-2011-2517, CVE-2011-2525, CVE-2011-2695, CVE-2011-2723, CVE-2011-2905, CVE-2011-2909, CVE-2011-2928, CVE-2011-3188, CVE-2011-3191, CVE-2011-3363
SHA-256 | 34637add57bb1c47bb725041cb1273223d64aa46133511754d889d306943b525
Ubuntu Security Notice USN-1240-1
Posted Oct 25, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1240-1 - Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. Vasiliy Kulikov and Dan Rosenberg discovered that ecryptfs did not correctly check the origin of mount points. A local attacker could exploit this to trick the system into unmounting arbitrary mount points, leading to a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary, kernel, local
systems | linux, ubuntu
advisories | CVE-2011-1576, CVE-2011-1833, CVE-2011-2494, CVE-2011-2495, CVE-2011-2497, CVE-2011-2695, CVE-2011-2699, CVE-2011-2905, CVE-2011-2928, CVE-2011-3188, CVE-2011-3191
SHA-256 | 7bb5696fdf28788ddf1a181d26c0746a318f35d21e90975dc7a17a6248fbbf34
Ubuntu Security Notice USN-1239-1
Posted Oct 25, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1239-1 - Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. Vasiliy Kulikov and Dan Rosenberg discovered that ecryptfs did not correctly check the origin of mount points. A local attacker could exploit this to trick the system into unmounting arbitrary mount points, leading to a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary, kernel, local
systems | linux, ubuntu
advisories | CVE-2011-1576, CVE-2011-1833, CVE-2011-2494, CVE-2011-2495, CVE-2011-2497, CVE-2011-2695, CVE-2011-2699, CVE-2011-2905, CVE-2011-2928, CVE-2011-3188, CVE-2011-3191
SHA-256 | a8d44e1d2d7d40338fc3f73c81b91d2690ae35010e30a9837bab689992f33bd1
phpLDAPadmin <= 1.2.1.1 (query_engine) Remote PHP Code Injection
Posted Oct 25, 2011
Authored by EgiX, mr_me, TecR0c | Site metasploit.com

This Metasploit module exploits a vulnerability in the lib/functions.php that allows attackers input parsed directly to the create_function() php function. A patch was issued that uses a whitelist regex expression to check the user supplied input before being parsed to the create_function() call.

tags | exploit, php
SHA-256 | e1b54786a4e2d61486487555756f54e0b3b67f845210590ec4291fbcedf138f3
Gentoo Linux Security Advisory 201110-22
Posted Oct 25, 2011
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201110-22 - Multiple vulnerabilities in the PostgreSQL server and client allow remote attackers to conduct several attacks, including the execution of arbitrary code and denial of service. Versions less than or equal to 9 are affected.

tags | advisory, remote, denial of service, arbitrary, vulnerability
systems | linux, gentoo
advisories | CVE-2009-0922, CVE-2009-3229, CVE-2009-3230, CVE-2009-3231, CVE-2009-4034, CVE-2009-4136, CVE-2010-0442, CVE-2010-0733, CVE-2010-1169, CVE-2010-1170, CVE-2010-1447, CVE-2010-1975, CVE-2010-3433, CVE-2010-4015, CVE-2011-2483
SHA-256 | 82243da3aec06c210e0496833735c49ccf39afb961407ead00319a66417c0cd7
Debian Security Advisory 2327-1
Posted Oct 25, 2011
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2327-1 - Ferdinand Smit discovered that libfcgi-perl, a Perl module for writing FastCGI applications, is incorrectly restoring environment variables of a prior request in subsequent requests. In some cases this may lead to authentication bypasses or worse.

tags | advisory, perl
systems | linux, debian
advisories | CVE-2011-2766
SHA-256 | db9444e23843ed2215138be06267ed7a6f1fc2b748d7e7c337b65e76da520d66
zFTP Server Remote Denial Of Service
Posted Oct 25, 2011
Authored by Myo Soe

The zFTP server suffers from a remote denial of service condition when handling multiple STAT and CWD command requests.

tags | exploit, remote, denial of service
systems | linux
SHA-256 | 8407a8948f7a9148808d25756720686181651afab0fbe2eb264d023cb76c64bb
Secunia Security Advisory 46562
Posted Oct 25, 2011
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Tele-Consulting has reported multiple vulnerabilities in Alcatel-Lucent OmniTouch 8400 Instant Communication Suite, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting and cross-site request forgery attacks.

tags | advisory, vulnerability, xss, csrf
SHA-256 | 35204efb933da6896b642b83b448218aa79eb180a35cde25d6feecc2f6815320
Secunia Security Advisory 46565
Posted Oct 25, 2011
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Alcatel-Lucent has acknowledged multiple vulnerabilities in Alcatel-Lucent Business integrated Communication Solution, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting and cross-site request forgery attacks.

tags | advisory, vulnerability, xss, csrf
SHA-256 | 8820f1f5815c0d5f0a89513a26f89261ced75459c29a113bdea873831ffb6ba4
Secunia Security Advisory 46568
Posted Oct 25, 2011
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Gentoo has issued an update for postgresql. This fixes multiple vulnerabilities, which can be exploited by malicious users to disclose potentially sensitive information, bypass certain security restrictions, cause a DoS (Denial of Service), gain escalated privileges, and compromise a vulnerable system and by malicious people to conduct spoofing attacks and bypass certain security restrictions.

tags | advisory, denial of service, spoof, vulnerability
systems | linux, gentoo
SHA-256 | 5dc9ccefad891e1cb95cce20ba6d7ba16e1de567f8843dbabafec1c1d05eb06f
Page 1 of 3
Back123Next

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    17 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    6 Files
  • 24
    May 24th
    19 Files
  • 25
    May 25th
    5 Files
  • 26
    May 26th
    12 Files
  • 27
    May 27th
    12 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close