Twenty Year Anniversary
Showing 1 - 25 of 33 RSS Feed

Files Date: 2012-06-06

Drupal Node Embed 6.x / 7.x Access Bypass
Posted Jun 6, 2012
Authored by Paul Aumer-Ryan | Site drupal.org

Drupal Node Embed third party module versions 6.x and 7.x suffer from an access bypass vulnerability.

tags | advisory, bypass
MD5 | 5167e02470373c2038ce3363fe9aff3e
Drupal Organic Groups 6.x Cross Site Scripting / Access Bypass
Posted Jun 6, 2012
Authored by Ezra Barnett Gildesgame, Fox | Site drupal.org

Drupal Organic Groups third party module version 6.x suffers from access bypass and cross site scripting vulnerabilities.

tags | advisory, vulnerability, xss
MD5 | b6d7a8a1c164d3b14ca54e875d07b030
Zero Day Initiative Advisory 12-084
Posted Jun 6, 2012
Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-084 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required in that a target must visit a malicious page or open a malicious file. The flaw exists within the RV10 encoded data in the rv10.dll component. When encountering an invalid encoded height or width field the process miscalculates an offset while preparing to decode the data packets which constitute the stream. The process attempts to store data at this location. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the process.

tags | advisory, remote, arbitrary
advisories | CVE-2012-0926
MD5 | a82362c40a2c4e4e22423d383f838394
Zero Day Initiative Advisory 12-083
Posted Jun 6, 2012
Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-083 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists in the Java OpenAL (JOAL) library. This library is not installed by default with Java, but it is available as a signed .jar package. The affected jar files are signed with a certificate that is trusted by default JRE installs and as such are downloaded and run without user interaction. Crafted Java applets can reach a call to 'dispatch_alDeleteBuffers1' that takes a user controllable int and uses it as a function pointer. This can lead to remote code execution under the context of the current process.

tags | advisory, java, remote, arbitrary, code execution
MD5 | ab4d66e91f4da5039612be13f9915803
Zero Day Initiative Advisory 12-082
Posted Jun 6, 2012
Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-082 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists in the Java OpenGL (JOGL) library. This library is not installed by default with Java, but it is available as a signed .jar package. The affected jar files are signed with a certificate that is trusted by default JRE install and as such is downloaded and run without user interaction. Crafted Java applets can reach a call to 'LoadLibraryA' in the JOGL library that allow remote .dll files to be loaded into the JRE process. This can lead to remote code execution under the context of the current process.

tags | advisory, java, remote, arbitrary, code execution
MD5 | 24c0c99350fd75e4ea5341bde8e3b0b7
WordPress Gallery 3.06 Shell Upload
Posted Jun 6, 2012
Authored by Sammy FORGIT

WordPress Gallery version 3.06 suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell
MD5 | b164c5cc16ef6a030e720a52aa960eea
WordPress Font Uploader 1.2.4 Shell Upload
Posted Jun 6, 2012
Authored by Sammy FORGIT

WordPress Font Uploader plugin version 1.2.4 suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell
MD5 | d6eed4954435bbff0204602322224347
WordPress FCChat Widget 2.x Shell Upload
Posted Jun 6, 2012
Authored by Sammy FORGIT

WordPress FCChat Widget plugin versions 2.2.12.2 through 2.2.13.1 suffer from a remote shell upload vulnerability.

tags | exploit, remote, shell
MD5 | 36987a6330276ed2db5b98faa2ba6480
WordPress Email Newsletter 8.0 Information Disclosure
Posted Jun 6, 2012
Authored by Sammy FORGIT

WordPress Email Newsletter plugin version 8.0 suffers from multiple information disclosure vulnerabilities.

tags | exploit, vulnerability, info disclosure
MD5 | 80e24e8c1d07845b2938f79f67735446
Zero Day Initiative Advisory 12-081
Posted Jun 6, 2012
Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-081 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists in the Java GlueGen library. This library is not installed by default with Java, but it is available as a signed .jar package. The affected jar files are signed with a certificate that is trusted by default JRE installs and as such are downloaded and run without user interaction. Crafted Java applets can reach a call to 'openLibraryGlobal' in the GlueGen library that allow remote .dll files to be loaded into the JRE process. This can lead to remote code execution under the context of the current process.

tags | advisory, java, remote, arbitrary, code execution
MD5 | 0d344f8cbd825fc95e5abec348e76408
Zero Day Initiative Advisory 12-080
Posted Jun 6, 2012
Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-080 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files. A size value is read from MP4 files and used for size calculation without proper validation. The arithmetic performed on the size value can cause integer overflows, resulting in undersized allocations. This undersized memory allocation can be subsequently overpopulated with data supplied by the input file which can be used to gain remote code execution under the context of the current process.

tags | advisory, remote, overflow, arbitrary, code execution
advisories | CVE-2012-0754
MD5 | 23b62bc1467d097ae9488d03bc70c6ae
Zero Day Initiative Advisory 12-078
Posted Jun 6, 2012
Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-078 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way Apple QuickTime handles file with the Sorenson v3 Codec. When parsing the data inside the svq3 stream QuickTime does not verify the value for the mb_skip_run value it reads from the data. This value is used later as a loop counter to write data to a heap allocation without boundary checking. This can result in a heap based buffer overflow that can result in remote code execution under the context of the user running the application.

tags | advisory, remote, overflow, arbitrary, code execution
systems | apple
advisories | CVE-2012-0669
MD5 | 39e9db03951b048937fe33fc24c0942c
Zero Day Initiative Advisory 12-077
Posted Jun 6, 2012
Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-077 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the QuickTimeVR.qtx component. A signedness error exists when processing a QTVRStringAtom having an overly large "stringLength" parameter. This can be exploited to cause a stack-based buffer overflow and execute arbitrary code under the context of the user running the application.

tags | advisory, remote, overflow, arbitrary
systems | apple
advisories | CVE-2012-0667
MD5 | 5324798ac1f458c02268691bf0b9ecee
Zero Day Initiative Advisory 12-076
Posted Jun 6, 2012
Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-076 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple's QuickTime Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within how the application calculates the padding for an MPEG sample. When calculating the padding, the MPEG library will subtract this from another length without checking for underflow. This resulting length will then be used in a memcpy operation into a statically sized buffer allocated on the heap. This can lead to code execution under the context of the application.

tags | advisory, remote, arbitrary, code execution
systems | apple
advisories | CVE-2012-0659
MD5 | abafea58d023c88a3dc309617ec7c42f
Zero Day Initiative Advisory 12-075
Posted Jun 6, 2012
Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-075 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within how the application decodes video samples encoded with the RLE codec. When decompressing the sample, the application will fail to accommodate for the canvas the sample is rendered into. This can cause a buffer overflow and thus can be taken advantage of in order to gain code execution under the context of the application.

tags | advisory, remote, overflow, arbitrary, code execution
systems | apple
advisories | CVE-2012-0668
MD5 | e56d5ff2b2fdb50359810d4cc109ccd1
Ubuntu Security Notice USN-1466-1
Posted Jun 6, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1466-1 - It was discovered that, when defining security groups in Nova using the EC2 or OS APIs, specifying the network protocol (e.g. 'TCP') in the incorrect case would cause the security group to not be applied correctly. An attacker could use this to bypass Nova security group restrictions.

tags | advisory, tcp, protocol
systems | linux, ubuntu
advisories | CVE-2012-2654
MD5 | fcd100abd0b1b06c4c09b829b1809d95
Ubuntu Security Notice USN-1465-3
Posted Jun 6, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1465-3 - USN-1465-1 fixed vulnerabilities in Ubuntu One Client. The update failed to install on certain Ubuntu 10.04 LTS systems that had a legacy Python 2.5 package installed. This update fixes the problem. It was discovered that the Ubuntu One Client incorrectly validated server certificates when using HTTPS connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to alter or compromise confidential information. Various other issues were also addressed.

tags | advisory, remote, web, vulnerability, python
systems | linux, ubuntu
advisories | CVE-2011-4409
MD5 | 8bababe020b48367b02ec26f621fa263
Ubuntu Security Notice USN-1463-1
Posted Jun 6, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1463-1 - Jesse Ruderman, Igor Bukanov, Bill McCloskey, Christian Holler, Andrew McCreight, Olli Pettay, Boris Zbarsky, and Brian Bondy discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. It was discovered that Mozilla's WebGL implementation exposed a bug in certain NVIDIA graphics drivers. The impact of this issue has not been disclosed at this time. Various other issues were also addressed.

tags | advisory, denial of service
systems | linux, ubuntu
advisories | CVE-2011-3101, CVE-2012-1944, CVE-2012-1945, CVE-2012-1946, CVE-2012-0441, CVE-2011-3101, CVE-2012-0441, CVE-2012-1937, CVE-2012-1938, CVE-2012-1940, CVE-2012-1941, CVE-2012-1944, CVE-2012-1945, CVE-2012-1946, CVE-2012-1947
MD5 | 1311949c7eef4a0f68c3f027698b34e3
Ubuntu Security Notice USN-1464-1
Posted Jun 6, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1464-1 - It was discovered that the Ubuntu Single Sign On Client incorrectly validated server certificates when using HTTPS connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to alter or compromise confidential information.

tags | advisory, remote, web
systems | linux, ubuntu
advisories | CVE-2011-4408
MD5 | 63d488a76a7acf3c2c5518c1cd7ae49d
Ubuntu Security Notice USN-1465-1
Posted Jun 6, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1465-1 - It was discovered that the Ubuntu One Client incorrectly validated server certificates when using HTTPS connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to alter or compromise confidential information.

tags | advisory, remote, web
systems | linux, ubuntu
advisories | CVE-2011-4409
MD5 | fb09a87a9792ff4926b6f58d15ee6604
Ubuntu Security Notice USN-1465-2
Posted Jun 6, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1465-2 - USN-1465-1 fixed a vulnerability in the Ubuntu One Client. This update adds a required fix to the Ubuntu One storage protocol library. It was discovered that the Ubuntu One Client incorrectly validated server certificates when using HTTPS connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to alter or compromise confidential information. Various other issues were also addressed.

tags | advisory, remote, web, protocol
systems | linux, ubuntu
advisories | CVE-2011-4409
MD5 | 5aa8d0eb1f4fad47a160c77de1b8f990
Vanilla kPoll 1.2 Stored Cross Site Scripting
Posted Jun 6, 2012
Authored by Henry Hoggard

Vanilla kPoll plugin version 1.2 suffers from a stored cross site scripting vulnerability.

tags | exploit, xss
MD5 | 7a50ba147b35d100358674b8f929a683
Audio Editor Master 5.4.1.217 Denial Of Service
Posted Jun 6, 2012
Authored by Onying

Audio Editor Master version 5.4.1.217 suffers from a denial of service vulnerability.

tags | exploit, denial of service
MD5 | bbd998b90afa45d4f79caad08a195b34
Evolutia Design SQL Injection
Posted Jun 6, 2012
Authored by D0m12

Evolutia Design suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | bb925d50340aa097e26bf51cab912af8
Secunia Security Advisory 49395
Posted Jun 6, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - m1k3 has discovered a vulnerability in Winlog, which can be exploited by malicious people to compromise a vulnerable system.

tags | advisory
MD5 | 38c0ffce024721efffb8a3aac09dec13
Page 1 of 2
Back12Next

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

August 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    19 Files
  • 2
    Aug 2nd
    17 Files
  • 3
    Aug 3rd
    16 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    1 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    15 Files
  • 8
    Aug 8th
    9 Files
  • 9
    Aug 9th
    7 Files
  • 10
    Aug 10th
    10 Files
  • 11
    Aug 11th
    1 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    14 Files
  • 14
    Aug 14th
    18 Files
  • 15
    Aug 15th
    38 Files
  • 16
    Aug 16th
    16 Files
  • 17
    Aug 17th
    22 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close