/*
Exploit Title: Skype = 4.2.0.169 DLL Hijacking Exploit (wab32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafk...@]astalavista[dot]com)
Version: Latest Skype v4.2.0.169
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .skype
Greetz: Astalavista, OffSEC, Exploit-DB
Notes:
Hi,
I'm curious if anybody is aware of the details of the IPv6 DoS
vulnerabilities listed in the aforementioned advisory (available at:
http://www.cisco.com/warp/public/707/cisco-sa-20081022-asa.shtml).
Thanks!
Kind regards,
Fernando
On Wed, 25 Aug 2010, Tim wrote:
It's unfortunate that STARTTLS is currently a disaster to configure
securely, particularly because it is just a point-to-point encryption
mechanism and all of this complexity has to be addressed at every hop.
I think as a security community we'd be a lot better
On Wed, 25 Aug 2010, Tim Brown wrote:
the key point is that an empty directory specification statement in
LD_LIBRARY_PATH, PATH (and probably others) is equivalent to $CWD.
And there is also the infamous DT_RPATH (and DT_RUNPATH) that makes it
possible to hardwire unsafe paths into executable
Dear List,
I'm writing on behalf of the Check Point Vulnerability Discovery Team to
publish the following vulnerability.
Check Point Software Technologies - Vulnerability Discovery Team (VDT)
http://www.checkpoint.com/defense/
Apple CoreGraphics (Preview) Memory Corruption when parsing PDF
Vulnerability ID: HTB22584
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_compucms.html
Product: CompuCMS
Vendor: CompuSoft A/S ( http://www.compusoft.dk/ )
Vulnerable Version: Current at 06.08.2010 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability
Vulnerability ID: HTB22564
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_auto_cms.html
Product: Auto CMS
Vendor: Roberto Aleman ( http://ventics.com/autocms/ )
Vulnerable Version: 1.6 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability Type: XSS (Cross
Vulnerability ID: HTB22568
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_webmatic.html
Product: Webmatic
Vendor: Valarsoft ( http://www.valarsoft.com/ )
Vulnerable Version: 3.0.5 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability Type: Stored XSS
Vulnerability ID: HTB22575
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_tcms_1.html
Product: TCMS
Vendor: Target CMS ( http://targetcms.com/ )
Vulnerable Version: 100728 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability Type: Stored XSS (Cross Site
Vulnerability ID: HTB22572
Reference:
http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_tcms_1.html
Product: TCMS
Vendor: Target CMS ( http://targetcms.com/ )
Vulnerable Version: 100728 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability Type: SQL
Vulnerability ID: HTB22586
Reference:
http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_compucms_3.html
Product: CompuCMS
Vendor: CompuSoft A/S ( http://www.compusoft.dk/ )
Vulnerable Version: Current at 06.08.2010 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability ID: HTB22573
Reference: http://www.htbridge.ch/advisory/local_file_inclusion_in_tcms.html
Product: TCMS
Vendor: Target CMS ( http://targetcms.com/ )
Vulnerable Version: 100728 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability Type: Local File Inclusion
Hello Bugtraq!
I want to warn you about multiple vulnerabilities in eSitesBuilder. After
previous vulnerabilities in eSitesBuilder (SecurityVulns ID:10940), which I
wrote earlier in June, there are Insufficient Anti-automation, Cross-Site
Scripting, SQL Injection and Full path disclosure
Vulnerability ID: HTB22581
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_compucms_1.html
Product: CompuCMS
Vendor: CompuSoft A/S ( http://www.compusoft.dk/ )
Vulnerable Version: Current at 06.08.2010 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability ID: HTB22583
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_compucms_2.html
Product: CompuCMS
Vendor: CompuSoft A/S ( http://www.compusoft.dk/ )
Vulnerable Version: Current at 06.08.2010 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability ID: HTB22570
Reference: http://www.htbridge.ch/advisory/xsrf_csrf_in_webmatic.html
Product: Webmatic
Vendor: Valarsoft ( http://www.valarsoft.com/ )
Vulnerable Version: 3.0.5 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability Type: CSRF (Cross-Site
Vulnerability ID: HTB22576
Reference:
http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_tcms_2.html
Product: TCMS
Vendor: Target CMS ( http://targetcms.com/ )
Vulnerable Version: 100728 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability Type: SQL
Vulnerability ID: HTB22577
Reference:
http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_tcms_3.html
Product: TCMS
Vendor: Target CMS ( http://targetcms.com/ )
Vulnerable Version: 100728 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability Type: SQL
Vulnerability ID: HTB22578
Reference:
http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_tcms_4.html
Product: TCMS
Vendor: Target CMS ( http://targetcms.com/ )
Vulnerable Version: 100728 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability Type: SQL
Vulnerability ID: HTB22579
Reference: http://www.htbridge.ch/advisory/file_content_disclosure_in_tcms.html
Product: TCMS
Vendor: Target CMS ( http://targetcms.com/ )
Vulnerable Version: 100728 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability Type: File Content
Vulnerability ID: HTB22582
Reference:
http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_compucms.html
Product: CompuCMS
Vendor: CompuSoft A/S ( http://www.compusoft.dk/ )
Vulnerable Version: Current at 06.08.2010 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability ID: HTB22574
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_tcms.html
Product: TCMS
Vendor: Target CMS ( http://targetcms.com/ )
Vulnerable Version: 100728 and Probably Prior Versions
Vendor Notification: 09 August 2010
Vulnerability Type: XSS (Cross Site
Vulnerability ID: HTB22585
Reference:
http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_compucms_2.html
Product: CompuCMS
Vendor: CompuSoft A/S ( http://www.compusoft.dk/ )
Vulnerable Version: Current at 06.08.2010 and Probably Prior Versions
Vendor Notification: 09 August 2010
Hack In The Box is proud to announce, a brand new lightning session
called HITB SIGINT (Signal Intelligence/Interrupt)! HITB SIGINT
sessions are designed to provide a quick 15 minute overview for
material and research that's up and coming - stuff that isn't quite
ready for the mainstream tracks
=
Joomla! Component com_bc Cross Script Scripting (XSS) Vulnerability
=
1. OVERVIEW
The Joomla! Component com_bc was vulnerable to Cross Script Scripting
==
BlastChat Chat Client Component version 3.3 = Cross Script Scripting
(XSS) Vulnerability
==
1. OVERVIEW
The
ZDI-10-167: RealNetworks RealPlayer FLV Parsing Multiple Integer Overflow
Vulnerabilities
http://www.zerodayinitiative.com/advisories/ZDI-10-167
August 26, 2010
-- CVE ID:
CVE-2010-3000
-- CVSS:
10, (AV:N/AC:L/Au:N/C:C/I:C/A:C)
-- Affected Vendors:
RealNetworks
-- Affected Products:
ZDI-10-166: RealNetworks RealPlayer Malformed IVR Object Index Code Execution
Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-166
August 26, 2010
-- CVE ID:
CVE-2010-2996
-- CVSS:
10, (AV:N/AC:L/Au:N/C:C/I:C/A:C)
-- Affected Vendors:
RealNetworks
-- Affected Products:
BugTracker.net 3.4.3 SQL Injection
Name BugTracker.NET
Vendorhttp://www.ifdefined.com/www/
Versions Affected 3.4.4 (when custom fields are used)
AuthorMark van Tilburg
Website http://markvt.info
Contact markvantilburg [at] gmail
29 matches
Mail list logo