what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 76 - 100 of 100 RSS Feed

Files

myreview-disclose.txt
Posted Jul 21, 2008
Authored by Julien Thomas

The MyReview web application versions 1.9.9 and below and 2.0 Beta suffer from a mishandling of submissions allowing for unintended downloads of said data.

tags | exploit, web, info disclosure
advisories | CVE-2008-3671
SHA-256 | ffac269563255108a5c20a3679275754ac2fb6dfa1ba5fd7676e275428565cc4

Related Files

Secunia Security Advisory 49883
Posted Jul 17, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A vulnerability has been reported in libjpeg-turbo, which can be exploited by malicious people to compromise an application using the library.

tags | advisory
SHA-256 | 6746167e7bd0765f9827c14af5794eb298aaf72032eed86d9f89f72f8ce8183d
Secunia Security Advisory 49914
Posted Jul 17, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - SUSE has issued an update for libxslt and libxslt-python. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service) of an application using the library.

tags | advisory, denial of service, python
systems | linux, suse
SHA-256 | 1cd3cc628c050c7ba4b71fcca7a23ed1f9c15cbf02b657cb22940760d27712e3
Cura 1.5
Posted Jul 16, 2012
Site github.com

Cura is a mobile phone application bundle of remote systems administration tools. It provides a personalized terminal emulator, a syslog module that allows for reading logs directly from a server, a SysMonitor module that visually graphs CPU and RAM usage percentages, access to Nmap, and Server Stats will offer general server information like its Vitals, Hardware information, Memory information, processes, and so on. A security feature will be implemented that allows users to have Cura's database completely wiped upon them sending the compromised phone a secret pattern of their choosing (e.g. send an SMS message containing "phone has been stolen!" to your Android phone to wipe Cura's database, and receive the location of the compromised phone as an SMS to your emergency phone number or as an email to your emergency email address).

Changes: The modules screen is now Tabular, providing a much better user experience in which all of Cura's modules are provided as tabs on the top of the screen.
tags | exploit, remote
SHA-256 | 1701fc58dc21a0ecb6c45f4836abb5e380f5e8214af1f3d389ec0e35ee46a019
Mandriva Linux Security Advisory 2012-107
Posted Jul 13, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-107 - An integer overflow in the function jpeg_data_load_data in the exif program could cause a data read beyond the end of a buffer, causing an application crash or leakage of potentially sensitive information when parsing a crafted JPEG file. The updated packages have been upgraded to the 0.6.21 version which is not vulnerable to this issue.

tags | advisory, overflow
systems | linux, mandriva
advisories | CVE-2012-2845
SHA-256 | b2dc97f87485b52e2552d28d3ed742ece7d392a5a8d9f71352f4c71ba1e77497
Mandriva Linux Security Advisory 2012-104
Posted Jul 13, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-104 - OpenJPEG allocated insufficient memory when encoding JPEG 2000 files from input images that have certain color depths. A remote attacker could provide a specially-crafted image file that, when opened in an application linked against OpenJPEG , would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. An input validation flaw, leading to a heap-based buffer overflow, was found in the way OpenJPEG handled the tile number and size in an image tile header. A remote attacker could provide a specially-crafted image file that, when decoded using an application linked against OpenJPEG, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. The updated packages have been patched to correct these issues.

tags | advisory, remote, overflow, arbitrary
systems | linux, mandriva
advisories | CVE-2009-5030, CVE-2012-3358
SHA-256 | 9f38f2c466a44dab2094051c875f326f59d70477de49fef91e359f752d0711a2
Magento eCommerce Platform XXE Injection
Posted Jul 13, 2012
Authored by Kestutis Gudinavicius | Site sec-consult.com

Magento eCommerce platform uses a vulnerable version of Zend framework which is prone to XML eXternal Entity Injection attacks. The SimpleXMLElement class of Zend framework (SimpleXML PHP extension) is used in an insecure way to parse XML data. External entities can be specified by adding a specific DOCTYPE element to XML-RPC requests. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.

tags | exploit, arbitrary, php, tcp, xxe
SHA-256 | 89d448f5823f6c330e5a4b53e23014a5b1fe003dd4087081ff3c078b9e4d3271
Cura 1.4
Posted Jul 13, 2012
Site github.com

Cura is a mobile phone application bundle of remote systems administration tools. It provides a personalized terminal emulator, a syslog module that allows for reading logs directly from a server, a SysMonitor module that visually graphs CPU and RAM usage percentages, access to Nmap, and Server Stats will offer general server information like its Vitals, Hardware information, Memory information, processes, and so on. A security feature will be implemented that allows users to have Cura's database completely wiped upon them sending the compromised phone a secret pattern of their choosing (e.g. send an SMS message containing "phone has been stolen!" to your Android phone to wipe Cura's database, and receive the location of the compromised phone as an SMS to your emergency phone number or as an email to your emergency email address).

Changes: This release features a completely new UI for the Home (Login) screen where you are dropped upon launch. This is where you access/create/update/delete your server accounts, and it's had a complete do-over.
tags | tool, remote, wireless
SHA-256 | 79fd0da76674b5e455a947a43496357a83abbd086c7bf141c80764ec54afd32c
Ubuntu Security Notice USN-1505-1
Posted Jul 13, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1505-1 - It was discovered that multiple flaws existed in the CORBA (Common Object Request Broker Architecture) implementation in OpenJDK. An attacker could create a Java application or applet that used these flaws to bypass Java sandbox restrictions or modify immutable object data. It was discovered that multiple flaws existed in the OpenJDK font manager's layout lookup implementation. A attacker could specially craft a font file that could cause a denial of service through crashing the JVM (Java Virtual Machine) or possibly execute arbitrary code. Various other issues were also addressed.

tags | advisory, java, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1724, CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1723, CVE-2012-1724, CVE-2012-1725
SHA-256 | d9174e9a4ed57d8cbb518a50151cad98d40855786e4a1d98cef9256e2cf24668
Secunia Security Advisory 49857
Posted Jul 13, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Multiple vulnerabilities have been reported in libexif, which can be exploited by malicious people to disclose certain sensitive information, cause a DoS (Denial of Service), and compromise an application using the library.

tags | advisory, denial of service, vulnerability
SHA-256 | 6b2c585576127f1db10d1047e74dd85a38e763764dc85ee0e7a8d3e2767e02a1
Secunia Security Advisory 49913
Posted Jul 12, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Red Hat has issued an update for openjpeg. This fixes two vulnerabilities, which can be exploited by malicious people to compromise an application using the library.

tags | advisory, vulnerability
systems | linux, redhat
SHA-256 | abe441c12a6e0697b175310f403697419d783b43d6d110ea69f704f22a046c7f
Secunia Security Advisory 49895
Posted Jul 12, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Ubuntu has issued an update for qt. This fixes multiple vulnerabilities, which can be exploited by malicious people to conduct spoofing attacks, cause a DoS (Denial of Service), and compromise an application using the library.

tags | advisory, denial of service, spoof, vulnerability
systems | linux, ubuntu
SHA-256 | f9225415382a49f7d6cac65f5d41a036a5862987f6b49027a2f950eb400efc0f
Ubuntu Security Notice USN-1504-1
Posted Jul 12, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1504-1 - It was discovered that Qt did not properly handle wildcard domain names or IP addresses in the Common Name field of X.509 certificates. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. This issue only affected Ubuntu 10.04 LTS. A heap-based buffer overflow was discovered in the HarfBuzz module. If a user were tricked into opening a crafted font file in a Qt application, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.

tags | advisory, denial of service, overflow, arbitrary
systems | linux, ubuntu
advisories | CVE-2010-5076, CVE-2011-3193, CVE-2011-3194, CVE-2010-5076, CVE-2011-3193, CVE-2011-3194
SHA-256 | 38f8026f04706275efcfb7cc11205b775caa2dd43f788cbc9c811568afc13863
Red Hat Security Advisory 2012-1068-01
Posted Jul 12, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1068-01 - OpenJPEG is an open source library for reading and writing image files in JPEG 2000 format. An input validation flaw, leading to a heap-based buffer overflow, was found in the way OpenJPEG handled the tile number and size in an image tile header. A remote attacker could provide a specially-crafted image file that, when decoded using an application linked against OpenJPEG, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. OpenJPEG allocated insufficient memory when encoding JPEG 2000 files from input images that have certain color depths. A remote attacker could provide a specially-crafted image file that, when opened in an application linked against OpenJPEG, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

tags | advisory, remote, overflow, arbitrary
systems | linux, redhat
advisories | CVE-2009-5030, CVE-2012-3358
SHA-256 | 9b8cc3d6b38e2111d60fdfee4ec23c909e47ef0065bfe35afe96de8f3a189f19
Weevely PHP Backdoor 0.7
Posted Jul 11, 2012
Authored by Emilio Pinna | Site epinna.github.com

Weevely is a stealth PHP web shell that simulates a telnet-like connection. It is an essential tool for web application testing post exploitation, and can be used as a stealth backdoor web shell to manage legit web accounts, even free hosted ones. Is currently included in Backtrack and Backbox and other Linux distributions for penetration testing.

Changes: Portscan modules added. Proxies modules added. File system browsing and remote command execution even if PHP security restrictions are in place. Various other additions.
tags | tool, web, shell, php, rootkit
systems | linux, unix
SHA-256 | 9ca1b6b62a4fcc57851e48e31b456e9ea711e0ef46b10cf39d3277547b450333
Samhain File Integrity Checker 3.0.5
Posted Jul 11, 2012
Authored by Rainer Wichmann | Site samhain.sourceforge.net

Samhain is a file system integrity checker that can be used as a client/server application for centralized monitoring of networked hosts. Databases and configuration files can be stored on the server. Databases, logs, and config files can be signed for tamper resistance. In addition to forwarding reports to the log server via authenticated TCP/IP connections, several other logging facilities (e-mail, console, and syslog) are available. Tested on Linux, AIX, HP-UX, Unixware, Sun and Solaris.

Changes: This release fixes some issues with the Windows registry check.
tags | tool, tcp, intrusion detection
systems | linux, unix, solaris, aix, hpux, unixware
SHA-256 | 9e3d29cc126a1609f93c89cc4b178fb01f091d989e2b8cec117b79eadf7b611c
IOSEC HTTP Anti Flood/DoS Security Gateway Module 1.7
Posted Jul 11, 2012
Authored by Gokhan Muharremoglu | Site sourceforge.net

This module provides security enhancements against (HTTP) Flood and Brute Force Attacks for native PHP or .NET scripts at the web application level. Scanning, crawling, and floor tools can be detected and blocked by this module via htaccess or iptables, etc.

Changes: Improved Implicit Deny Mode. Admin GUI Removed. Various other additions.
tags | web, php
SHA-256 | 12678f9ec1be90549e9ec56df43ef737708150240ad1ffb39db4ea94844cf7d1
Secunia Security Advisory 49859
Posted Jul 11, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Gentoo has issued an update for libxml2. This fixes a vulnerability, which can be exploited by malicious people to compromise an application using the library.

tags | advisory
systems | linux, gentoo
SHA-256 | 3fce85b6d9bebc0b7368804df76b5865b47f809e607fa360e1686d5d94d4a152
Secunia Security Advisory 49800
Posted Jul 10, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A vulnerability has been reported in Microsoft Visual Basic for Applications and Microsoft Office, which can be exploited by malicious people to compromise a user's system.

tags | advisory
SHA-256 | f66a12bc7c479b8166468fd3ca01fcfd7cd2b635a26e9279aefdd7e5bf77efe7
Secunia Security Advisory 49833
Posted Jul 8, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Ubuntu has issued an update for tiff. This fixes two vulnerabilities, which can be exploited by malicious people to compromise an application using the library.

tags | advisory, vulnerability
systems | linux, ubuntu
SHA-256 | 13c04665dc1aaa4ab2b06a966f2537388c530c74c276048d800e893315aa1f97
Red Hat Security Advisory 2012-1057-01
Posted Jul 6, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1057-01 - RESTEasy provides various frameworks to help you build RESTful web services and RESTful Java applications. It was found that RESTEasy was vulnerable to XML External Entity attacks. If a remote attacker submitted a request containing an external XML entity to a RESTEasy endpoint, the entity would be resolved, allowing the attacker to read files accessible to the user running the application server. This flaw affected DOM Document and JAXB input.

tags | advisory, java, remote, web, xxe
systems | linux, redhat
advisories | CVE-2012-0818
SHA-256 | 5cfe82490f9e0d9ea42e665a6f4f6f6991026f15dc3ddf2d39550a062b1c56c5
Red Hat Security Advisory 2012-1059-01
Posted Jul 6, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1059-01 - RESTEasy provides various frameworks to help you build RESTful web services and RESTful Java applications. It was found that RESTEasy was vulnerable to XML External Entity attacks. If a remote attacker submitted a request containing an external XML entity to a RESTEasy endpoint, the entity would be resolved, allowing the attacker to read files accessible to the user running the application server. This flaw affected DOM Document and JAXB input.

tags | advisory, java, remote, web, xxe
systems | linux, redhat
advisories | CVE-2012-0818
SHA-256 | e3a2bf9a1dc1efec91da14d3163b81d65b43040761d051feb37bae44cdf25454
Red Hat Security Advisory 2012-1056-01
Posted Jul 6, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1056-01 - RESTEasy provides various frameworks to help you build RESTful web services and RESTful Java applications. It was found that RESTEasy was vulnerable to XML External Entity attacks. If a remote attacker submitted a request containing an external XML entity to a RESTEasy endpoint, the entity would be resolved, allowing the attacker to read files accessible to the user running the application server. This flaw affected DOM Document and JAXB input.

tags | advisory, java, remote, web, xxe
systems | linux, redhat
advisories | CVE-2012-0818
SHA-256 | 6557059760455431acac8d483403f3918f56868f81fd392dee90b7d5ddc1473c
Red Hat Security Advisory 2012-1058-01
Posted Jul 6, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1058-01 - RESTEasy provides various frameworks to help you build RESTful web services and RESTful Java applications. It was found that RESTEasy was vulnerable to XML External Entity attacks. If a remote attacker submitted a request containing an external XML entity to a RESTEasy endpoint, the entity would be resolved, allowing the attacker to read files accessible to the user running the application server. This flaw affected DOM Document and JAXB input.

tags | advisory, java, remote, web, xxe
systems | linux, redhat
advisories | CVE-2012-0818
SHA-256 | 05f9c0682e27949bf1f2becff450f31daba1cdb97b54e04910f8671124a8f236
Mandriva Linux Security Advisory 2012-101
Posted Jul 5, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-101 - libtiff did not properly convert between signed and unsigned integer values, leading to a buffer overflow. An attacker could use this flaw to create a specially-crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code. Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the tiff2pdf tool. An attacker could use these flaws to create a specially-crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code. The updated packages have been patched to correct these issues.

tags | advisory, overflow, arbitrary
systems | linux, mandriva
advisories | CVE-2012-2088, CVE-2012-2113
SHA-256 | e81bc3fded716546e6bd858f7b6520b39a17eed684d0ca55ad4f000fcdc900f2
Ubuntu Security Notice USN-1498-1
Posted Jul 5, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1498-1 - It was discovered that the TIFF library incorrectly handled certain malformed TIFF images. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. It was discovered that the tiff2pdf utility incorrectly handled certain malformed TIFF images. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2012-2088, CVE-2012-2113, CVE-2012-2088, CVE-2012-2113
SHA-256 | 3b79f4af0c1548cb1ed223db3afc67082ff8290dc8746f691a68cb86abbbd616
Page 4 of 4
Back1234Next

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close