Re: Directory traversal and DoS in WinIPDS G52-33-021

2008-03-13 Thread ph
The listed issues have been resolved in version G52-33-022. See release note here: http://www.intermate.com/winIPDS_support

Re: PHP-Nuke Module NukeC30 sql injection

2008-03-13 Thread my_msn_my_msn_my
dont copy http://www.secumania.org/exploits/web-applications/php~nukec30-sql-injection-vulnerability-2008030742897/

XSS in PHP-Nuke (eWeather module)

2008-03-13 Thread nima_501
//XSS in PHP-Nuke (eWeather module) PHP-Nuke (http://phpnuke.org): PHP-Nuke is a news automated system specially designed to be used in Intranets and Internet. The Administrator has total control of his web site, registered users, and he will have in the hand a powerful

Directory traversal in EdiorCMS V3.0

2008-03-13 Thread wsn1983
Directory traversal in EdiorCMS V3.0 Application: EdiorCMS V3.0 Vendor: http://www.edior.com Versions: 3.0 Platforms:ALL Bug: Directory traversal Exploitation: remote Date: 13 Mar 2008 Author: Shennan Wang e-mail: [EMAIL

Zabbix (zabbix_agentd) denial of service

2008-03-13 Thread Milen Rangelov
Hello, There is some DoS issue with zabbix which can be exploited by a malicious user from an authorized host. An attacker on the authorized host can cause the zabbix_agentd to hang, overconsuming CPU resources. This can be triggered by sending the agent a file

Rise of the spammers

2008-03-13 Thread vulns
Hi, According to the following press release of MessageLabs: http://www.messagelabs.com/resources/press/11351 the proportion of spam from Gmail increased two-fold from 1.3 percent in January to 2.6 percent in February Recently, researchers at Websense also spotted ITW

Re: Firewire Attack on Windows Vista

2008-03-13 Thread Stefan Kanthak
Steve Shockley wrote: Stefan Kanthak wrote: 2. The typical user authentication won't help, we're at hardware level here, and no OS needs to be involved. So, if I understand you correctly, if I boot my machine into DOS the memory can be read over Firewire? If DMA is enabled on the

Re: Re: VHCS = 2.4.7.1 (vhcs2_daemon) Remote Root Exploit

2008-03-13 Thread app
How we can fix this bug on VHCS Source Code ?

Rapid7 Advisory R7-0032: Microsoft Internet Explorer FTP Command Injection Vulnerability

2008-03-13 Thread kralor
Hello ml, I would like to point out that this vulnerability (Microsoft Internet Explorer FTP Command Injection Vulnerability) has been published long time ago, here is the advisory: http://www.securityfocus.com/archive/1/383722 Cheers, kralor

Update+Errata: Re: A paper by Amit Klein (Trusteer): OpenBSD DNS Cache Poisoning and Multiple O/S Predictable IP ID Vulnerability

2008-03-13 Thread Amit Klein
Update+Errata for OpenBSD DNS Cache Poisoning and Multiple O/S Predictable IP ID Vulnerability (http://www.trusteer.com/docs/OpenBSD_DNS_Cache_Poisoning_and_Multiple_OS_Predictable_IP_ID_Vulnerability.pdf) Update ** OpenBSD === Apparently the OpenBSD team changed their mind (again...)

Re: Re: Re: VHCS = 2.4.7.1 (vhcs2_daemon) Remote Root Exploit

2008-03-13 Thread sad_wabi_user
You cannot fix it without re-designing the VHCS security model. The exploit is a simple example of the many many attack vectors that exist in the flawed design. If you fix this particular exploit it would be simple to create additional ones. The properly fix the security model of vhcs the

PR08-02: Plone CMS Security Research - the Art of Plowning

2008-03-13 Thread ProCheckUp Research
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 PR08-02: Plone CMS Security Research: the Art of Plowning Product description: Plone is a ready-to-run content management system built on the powerful, and free, Zope application server. Plone is easy to set up, extremely flexible, and provides you

Office XP Remote SQL Injection

2008-03-13 Thread no-reply
Aria-Security Team (Persian Security Network) http://forum.Aria-Security.com (ENGLISH FORUM!) -- Shoutz: Aura, Null, Kinglet Office XP Remote SQL Injection Vendor: vso-xp.com Vulnerable File: MyIssuesView.asp Original Adivosry:

[ MDVSA-2008:066 ] - Updated gcc packages fix directory traversal vulnerability in fastjar

2008-03-13 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2008:066 http://www.mandriva.com/security/

ZDI-08-012: IBM Informix Dynamic Server Authentication Password Stack Overflow Vulnerability

2008-03-13 Thread zdi-disclosures
ZDI-08-012: IBM Informix Dynamic Server Authentication Password Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-012 March 13, 2008 -- CVE ID: CVE-2008-0727 -- Affected Vendors: IBM -- Affected Products: IBM Informix -- TippingPoint(TM) IPS Customer Protection: