what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 100 RSS Feed

Files

Joomla CCNewsLetter 1.0.7 SQL Injection
Posted Apr 23, 2012
Authored by E1nzte1N

The Joomla CCNewsLetter module version 1.0.7 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | d2c897d67407427434081f218fb0089ff1365eac5a2eba24124029029063349c

Related Files

Secunia Security Advisory 50277
Posted Aug 20, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - SUSE has issued an update for perl-YAML-LibYAML. This fixes multiple vulnerabilities, which can be exploited by malicious people to compromise an application using the module.

tags | advisory, perl, vulnerability
systems | linux, suse
SHA-256 | c2591fd4454e96e7eccbd78fb20fae7cb9cd4ac857ef225bf7920faeb3c9f059
Adobe Flash Player 11.3 Font Parsing Code Execution
Posted Aug 17, 2012
Authored by sinn3r, Alexander Gavrun, juan vazquez | Site metasploit.com

This Metasploit module exploits a vulnerability found in the ActiveX component of Adobe Flash Player before 11.3.300.271. By supplying a corrupt Font file used by the SWF, it is possible to gain arbitrary remote code execution under the context of the user, as exploited in the wild.

tags | exploit, remote, arbitrary, code execution, activex
advisories | CVE-2012-1535, OSVDB-84607
SHA-256 | b495613b72210817067894eb7ff5c08f46dcd44c9088ea935d0a7be729049d9a
Secunia Security Advisory 50274
Posted Aug 16, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Justin C. Klein Keane has reported two vulnerabilities in the HotBlocks module for Drupal, which can be exploited by malicious users to conduct script insertion attacks and cause a DoS (Denial of Service).

tags | advisory, denial of service, vulnerability
SHA-256 | fd66d289c29962cfb58bf6dff524d5a580cb93c94046532983e4247cd4e04963
Secunia Security Advisory 50256
Posted Aug 16, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Justin C. Klein Keane has reported a vulnerability in the Custom Publishing Options module for Drupal, which can be exploited by malicious users to conduct script insertion attacks.

tags | advisory
SHA-256 | cc35b5266f1d0b8ceb2030857739c796b62542e3b08fdf9ae6beacedabc27687
Drupal Elegant Theme 7.x Cross Site Scripting
Posted Aug 15, 2012
Authored by Greg Knaddison | Site drupal.org

Drupal Elegant Theme third party module version 7.x suffers from a cross site scripting vulnerability.

tags | advisory, xss
SHA-256 | 5cd009a2b5bb39d8473e502fc09119a2302b0d2363ca9167442d0a9f58ad5ea2
Drupal Custom Publishing Options 6.x Cross Site Scripting
Posted Aug 15, 2012
Site drupal.org

Drupal Custom Publishing Options third party module version 6.x suffers from a cross site scripting vulnerability.

tags | advisory, xss
SHA-256 | 5c0dec500b232cd3c340e97fe90d0022a5f7a7cae9406845e963e1c4492c9de0
Drupal HotBlocks 6.x XSS / Denial Of Service
Posted Aug 15, 2012
Authored by Justin C. Klein Keane | Site drupal.org

Drupal Hotblocks third party module version 6.x suffers from cross site scripting and denial of service vulnerabilities.

tags | advisory, denial of service, vulnerability, xss
SHA-256 | 3a4741a9e059e7fcb96a3197a8a6b543be251afe504d362ea481cb4229600a6b
Windows Service Trusted Path Privilege Escalation
Posted Aug 15, 2012
Authored by sinn3r | Site metasploit.com

This Metasploit module exploits a logic flaw due to how the lpApplicationName parameter is handled. When the lpApplicationName contains a space, the file name is ambiguous. Take this file path as example: C:\program files\hello.exe; The Windows API will try to interpret this as two possible paths: C:\program.exe, and C:\program files\hello.exe, and then execute all of them. To some software developers, this is an unexpected behavior, which becomes a security problem if an attacker is able to place a malicious executable in one of these unexpected paths, sometimes escalate privileges if run as SYSTEM. Some softwares such as OpenVPN 2.1.1, or OpenSSH Server 5, etc... all have the same problem.

tags | exploit
systems | windows
SHA-256 | 13ee2928c651d3a5639e180e5f2cafa4d077977aeeeb2da9a34de919ec969a8e
globalSCAPE CuteZIP Stack Buffer Overflow
Posted Aug 15, 2012
Authored by C4SS!0 G0M3S, juan vazquez | Site metasploit.com

This Metasploit module exploits a stack-based buffer overflow vulnerability in version 2.1 of CuteZIP. In order for the command to be executed, an attacker must convince the target user to open a specially crafted zip file with CuteZIP. By doing so, an attacker can execute arbitrary code as the target user.

tags | exploit, overflow, arbitrary
SHA-256 | 0eb1f8858ec5246ac33385d821777542b928e2d0bb98e4789b086a62b732d909
Gentoo Linux Security Advisory 201208-05
Posted Aug 15, 2012
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201208-5 - An insecure temporary file usage has been reported in the Perl Config-IniFiles module, possibly allowing symlink attacks. Versions below 2.710.0 are affected.

tags | advisory, perl
systems | linux, gentoo
advisories | CVE-2012-2451
SHA-256 | 3bcd9906a91e0e60116a8e74a6871bf2c3d7a8bbd8baaef329447255da0a07b9
Novell ZENworks Asset Management Remote Execution
Posted Aug 14, 2012
Authored by juan vazquez | Site metasploit.com

This Metasploit module exploits a path traversal flaw in Novell ZENworks Asset Management 7.5. By exploiting the CatchFileServlet, an attacker can upload a malicious file outside of the MalibuUploadDirectory and then make a secondary request that allows for arbitrary code execution.

tags | exploit, arbitrary, code execution
advisories | CVE-2011-2653, OSVDB-77583
SHA-256 | 0b8fb5d16df4fc969d43e3061660de06ffdf0cfc0581883a9f80e8a04b40a600
Cyclope Employee Surveillance Solution 6 SQL Injection
Posted Aug 14, 2012
Authored by loneferret, sinn3r | Site metasploit.com

This Metasploit module exploits a SQL injection found in Cyclope Employee Surveillance Solution. Because the login script does not properly handle the user-supplied username parameter, a malicious user can manipulate the SQL query, and allows arbitrary code execution under the context of 'SYSTEM'.

tags | exploit, arbitrary, code execution, sql injection
advisories | OSVDB-84517
SHA-256 | 943d1370d3c4c203bec054c6328adda12b9aa04b01b7010bb71dea9ec2bef8a7
TestLink 1.9.3 Arbitrary File Upload
Posted Aug 14, 2012
Authored by Brendan Coles | Site metasploit.com

This Metasploit module exploits a vulnerability in TestLink versions 1.9.3 and prior. This application has an upload feature that allows any authenticated user to upload arbitrary files to the '/upload_area/nodes_hierarchy/' directory with a randomized file name. The file name can be retrieved from the database using SQL injection.

tags | exploit, arbitrary, sql injection
SHA-256 | d7801d84f2c0b381a4eab2c495d1007bc1e69f64d876b88ff24732a4755a2f71
Ubuntu Security Notice USN-1529-1
Posted Aug 13, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1529-1 - A flaw was discovered in the Linux kernel's macvtap device driver, which is used in KVM (Kernel-based Virtual Machine) to create a network bridge between host and guest. A privileged user in a guest could exploit this flaw to crash the host, if the vhost_net module is loaded with the experimental_zcopytx option enabled. An error was discovered in the Linux kernel's network TUN/TAP device implementation. A local user with access to the TUN/TAP interface (which is not available to unprivileged users until granted by a root user) could exploit this flaw to crash the system or potential gain administrative privileges. Various other issues were also addressed.

tags | advisory, kernel, local, root
systems | linux, ubuntu
advisories | CVE-2012-2119, CVE-2012-2136, CVE-2012-2137, CVE-2012-2372, CVE-2012-2373, CVE-2012-3364, CVE-2012-3375, CVE-2012-3400, CVE-2012-2119, CVE-2012-2136, CVE-2012-2137, CVE-2012-2372, CVE-2012-2373, CVE-2012-3364, CVE-2012-3375, CVE-2012-3400
SHA-256 | e952789bbefd461e15d40316c4fbdd6eac86480773556aab5265687085c3d735
Ubuntu Security Notice USN-1514-1
Posted Aug 13, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1514-1 - A flaw was discovered in the Linux kernel's macvtap device driver, which is used in KVM (Kernel-based Virtual Machine) to create a network bridge between host and guest. A privileged user in a guest could exploit this flaw to crash the host, if the vhost_net module is loaded with the experimental_zcopytx option enabled. An error was discovered in the Linux kernel's network TUN/TAP device implementation. A local user with access to the TUN/TAP interface (which is not available to unprivileged users until granted by a root user) could exploit this flaw to crash the system or potential gain administrative privileges. Various other issues were also addressed.

tags | advisory, kernel, local, root
systems | linux, ubuntu
advisories | CVE-2012-2119, CVE-2012-2136, CVE-2012-2137, CVE-2012-2372, CVE-2012-2373, CVE-2012-3364, CVE-2012-3375, CVE-2012-3400, CVE-2012-2119, CVE-2012-2136, CVE-2012-2137, CVE-2012-2372, CVE-2012-2373, CVE-2012-3364, CVE-2012-3375, CVE-2012-3400
SHA-256 | e1c10bba69a8a49308a988c308242a9abe24b1f355d1cf1a0609f14097f65f5c
Secunia Security Advisory 50179
Posted Aug 13, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A vulnerability has been reported in the Better Revisions module for Drupal, which can be exploited by malicious users to conduct script insertion attacks.

tags | advisory
SHA-256 | f62062aede512bc747cdd5d29b74e01315eac8fffe61038b2bbc21406cf8c3c7
Secunia Security Advisory 50182
Posted Aug 13, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A vulnerability has been reported in the Shorten URLs module for Drupal, which can be exploited by malicious users to conduct script insertion attacks.

tags | advisory
SHA-256 | 76acf0912fd1bef511287486226dc7a54eae854d0dfaacb2cde4ba270633690f
Secunia Security Advisory 50170
Posted Aug 13, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A security issue has been reported in the Mime Mail module for Drupal, which can be exploited by malicious users to bypass certain security restrictions.

tags | advisory
SHA-256 | 7dffba5850295137080314ec6ac3e23bd96a2335cdae30f3320024c3e23aecd4
NetDecision 4.2 TFTP Writable Directory Traversal Execution
Posted Aug 9, 2012
Authored by Rob Kraus, juan vazquez | Site metasploit.com

This Metasploit module exploits a vulnerability found in NetDecision 4.2 TFTP server. The software contains a directory traversal vulnerability that allows a remote attacker to write arbitrary file to the file system, which results in code execution under the context of user executing the TFTP Server.

tags | exploit, remote, arbitrary, code execution
advisories | CVE-2009-1730, OSVDB-54607
SHA-256 | 0d13cee7943b511e1894639ec337c177f0900b866756b484b6bf6fa8eab38bed
Drupal Mime Mail 6.x Access Bypass
Posted Aug 9, 2012
Authored by Greg Knaddison, Gabor Seljan | Site drupal.org

Drupal Mime Mail third party module version 6.x suffers from an access bypass vulnerability.

tags | advisory, bypass
SHA-256 | b0a039f3f8e50612edc18654e3f08fa0768e7cce033393312917b22dddb2ce6f
Drupal Shibboleth Authentication 6.x Access Bypass
Posted Aug 9, 2012
Authored by Brian Swaney | Site drupal.org

Drupal Shibboleth Authentication third party module version 6.x suffers from an access bypass vulnerability.

tags | advisory, bypass
SHA-256 | e56e802811cdc559b6dff8457f24a6cff5246f7478e4aea1adf2290a3508efec
Drupal Better Revisions 7.x Cross Site Scripting
Posted Aug 9, 2012
Authored by Klaus Purer | Site drupal.org

Drupal Better Revisions third party module version 7.x suffers from a cross site scripting vulnerability.

tags | advisory, xss
SHA-256 | 706f0cf2a00a465418ab1fd8ca4abfcb890a16db89f027f30d26c3c20d1b13ac
Secunia Security Advisory 50168
Posted Aug 9, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A vulnerability has been reported in the Chaos tool suite module for Drupal, which can be exploited by malicious users to disclose potentially sensitive information.

tags | advisory
SHA-256 | a8db0f30b9271f122f48329f760cb003e0fa1324a73e9ab0ac9e0d5b7ffcb8a1
Drupal Shorten URLs 6.x / 7.x Cross Site Scripting
Posted Aug 9, 2012
Authored by Justin C. Klein Keane, Isaac Sukin, Zach Alexander | Site drupal.org

Drupal Short URLs third party module versions 6.x and 7.x suffer from a cross site scripting vulnerability.

tags | advisory, xss
SHA-256 | 2338b653ebbdca2d0e36655118d648626d3e1f46b55c30aef10e28f14326d139
Drupal Chaos Tool Suite 6.x / 7.x LFI / XSS
Posted Aug 9, 2012
Authored by Casey | Site drupal.org

Drupal Chaos Tool Suite (ctools) third party module versions 6.x and 7.x suffer from cross site scripting and local file inclusion vulnerabilities.

tags | advisory, local, vulnerability, xss, file inclusion
SHA-256 | 12064a3019b369f44e0d7a14cf85b3ca9fa4586cade8f60da291fa6cfddc03ae
Page 1 of 4
Back1234Next

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    19 Files
  • 23
    Jul 23rd
    17 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close