DDIVRT-2010-29 ALPHA Ethernet Adapter II Web-Manager 3.40.2 Authentication Bypass

2010-07-02 Thread ddivulnalert
Title - DDIVRT-2010-29 ALPHA Ethernet Adapter II Web-Manager 3.40.2 Authentication Bypass Severity High Date Discovered --- April 30th, 2010 Discovered By - Digital Defense, Inc. Vulnerability Research Team Credit: Edward Bullard, James Robertson and

[USN-956-1] sudo vulnerability

2010-07-02 Thread Jamie Strandboge
=== Ubuntu Security Notice USN-956-1 June 30, 2010 sudo vulnerability CVE-2010-1646 === A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 8.04

[SECURITY] [DSA 2066-1] New wireshark packages fix several vulnerabilities

2010-07-02 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-2066-1 secur...@debian.org http://www.debian.org/security/ Moritz Muehlenhoff July 01, 2010

[Bkis-03-2010] Vulnerability in Flash Slideshow Maker Vulnerability

2010-07-02 Thread Bkis
[Bkis-03-2010] Vulnerability in Flash Slideshow Maker Vulnerability 1. General Information Flash Slideshow Maker is a Flash album creator to make animated photo slide show with SWF file as the output format. Bkis has just detected a vulnerability in the software related to the processing of

Re: SAP's web module OLK SQL Injection vulnerability

2010-07-02 Thread yuval . lerner
This field is validated through JavaScript but now I blocked the field so you it only accepts numeric values throu OnKeyDown event, aditionally I added a CDbl() function on the requests of this field in case you have a way to go over the javascript functionality, this should be available in the

Vulnerabilities in WP-UserOnline for WordPress

2010-07-02 Thread MustLive
Hello Bugtraq! I want to warn you about security vulnerabilities in plugin WP-UserOnline for WordPress. - Advisory: Vulnerabilities in WP-UserOnline for WordPress - URL: http://websecurity.com.ua/4177/ -

Re: [Full-disclosure] Remote Command Execution in dotDefender Site Management

2010-07-02 Thread Henri Salo
On Mon, 30 Nov 2009 16:48:49 +0100 John Dos dotdefea...@googlemail.com wrote: Problem Description === A remote command execution vulnerability exists in the dotDefender (3.8-5) Site Management. dotDefender [1] is a web appliaction firewall (WAF) which 'prevents hackers

REVISION: iScripts EasySnaps 2.0 Multiple SQL Injection Vulnerabilities

2010-07-02 Thread Salvatore Fresta aka Drosophila
iScripts EasySnaps 2.0 Multiple SQL Injection Vulnerabilities Name iScripts EasySnaps Vendorhttp://www.iscripts.com Versions Affected 2.0 AuthorSalvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact

iScripts ReserveLogic 1.0 SQL Injection Vulnerability

2010-07-02 Thread Salvatore Fresta aka Drosophila
iScripts ReserveLogic 1.0 SQL Injection Vulnerability Name iScripts ReserveLogic Vendorhttp://www.iscripts.com Versions Affected 1.0 AuthorSalvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact

iScripts CyberMatch 1.0 Blind SQL Injection Vulnerability

2010-07-02 Thread Salvatore Fresta aka Drosophila
-- Salvatore Fresta aka Drosophila http://www.salvatorefresta.net CWNP444351 iScripts CyberMatch 1.0 Blind SQL Injection Vulnerability Name iScripts CyberMatch Vendorhttp://www.iscripts.com Versions Affected 1.0 AuthorSalvatore Fresta aka Drosophila

Re: Cherokee Web Server 0.5.3 Multiple Vulnerabilities

2010-07-02 Thread security curmudgeon
On Sat, 12 Jun 2010, i...@securitylab.ir wrote: : # : # Securitylab.ir : # : # Application Info: : # Name: Cherokee Web Server : # Version: 0.5.3 : # Download:

VSR Advisory: Multiple Cisco CSS / ACE Client Certificate and HTTP Header Manipulation Vulnerabilities

2010-07-02 Thread VSR Advisories
-2010-1576 - HTTP Request Parsing Flaw Reference: http://www.vsecurity.com/resources/advisory/20100702-1/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Product Description --- From [1]: The Cisco CSS 11500 Series Content Services Switch

IIS5.1 Directory Authentication Bypass by using �:$I30:$Index_Allocation�

2010-07-02 Thread bugreport
Description: Although IIS5 is very old, finding one is not impossible! Therefore, I want to introduce a technique to bypass the IIS authentication methods on a directory. This vulnerability is because of using Alternate Data Stream to open a protected folder. All of IIS authentication methods

Zoph Multiple Parameter Cross Site Scripting Vulnerabilities

2010-07-02 Thread VUPEN Web Security
Zoph Multiple Parameter Cross Site Scripting Vulnerabilities I. BACKGROUND - Zoph (Zoph Organizes Photos) is a web based digital image presentation and management system. In other words, a photo album. It is built with PHP, MySQL and Perl. II. VULNERABILITIES