HP Security Bulletin - A potential vulnerability has been identified with HP OpenView Event Correlation Services (OV ECS). This vulnerability could be exploited remotely by an unauthorized user to gain privileged access.
0c3b278dbe00961ed19657d343f63bf4e1a9235d41754880eb43e2a5e7d164b3Gentoo Linux Security Advisory GLSA 200510-03 - Masanari Yamamoto discovered that Uim uses environment variables incorrectly. This bug causes a privilege escalation if setuid/setgid applications are linked to libuim. This bug only affects immodule-enabled Qt (if you build Qt 3.3.2 or later versions with USE=immqt or USE=immqt-bc). Versions less than 0.4.9.1 are affected.
ea4acc71ec08b5ce0d6f8f319ba77aca9e581d4007fa08745e75d7264c2f8fc4CALL FOR PAPERS - DIMVA 2006. The special interest group Security - Intrusion Detection and Response (SIDAR) of the German Informatics Society (GI) organizes DIMVA as an annual conference that brings together experts from throughout and outside of Europe to discuss the state of the art in the areas of intrusion detection, malware detection, and vulnerability assessment.
131929771f0e66b9ffb551a9119d151dc02dec2bab80e5ac33d36bd4fccea7a5THC-Scan is a wardialer that works under DOS, Win95/98/NT/2K/XP, and all DOS emulators (UNiX) on all 80x86 processors. It has ODBC databank support, completely automated tone, carrier, vmb scanning, and a large palette of tools included. Comes with full source code and has an interface for usage with Scavenger Dialer and THC-Login Hacker.
ee3a45ee608dbaca82695a4af5481928c304cf3ba9b98fb67e72f4cfd9f555e9THC-Hydra is a high quality parallelized login hacker for Samba, Smbnt, Cisco AAA, FTP, POP3, IMAP, Telnet, HTTP Auth, LDAP, NNTP, MySQL, VNC, ICQ, Socks5, PCNFS, Cisco and more. Includes SSL support, parallel scans, and is part of Nessus.
baec613ba084bd795a12343572664aa980735a780e840159830a14761dfb21f0Debian Security Advisory DSA 842-1 - Stefan Esser discovered a vulnerability in the XML-RPC libraries which are also present in egroupware, a web-based groupware suite, that allows injection of arbitrary PHP code into eval() statements.
de954d71c9d226cbf7f9bce5488f5252c12b1c9a91c9c401b46a1df9d5abdfb4Ubuntu Security Notice USN-193-1 - Joxean Koret discovered that the SVG import plugin did not properly sanitize data read from an SVG file. By tricking an user into opening a specially crafted SVG file, an attacker could exploit this to execute arbitrary code with the privileges of the user.
63be081fa84dc469efc35576b5fce8117607be20e1acecaacb7731eb45618c31x86-64 buffer overflow exploits and the borrowed code chunk exploitation technique. Whitepaper describing NX technology and its limitations. It contains in depth discussion and sample code for the Hammer/Linux platform, analyzes the weaknesses and discusses countermeasures.
b0c251d6ab0e7d35b001203d842192143611eb73e2e95273a80273ed88afccbaApplication Mapper is a next-generation scanning tool that allows you to identify the applications that are running on a specific port. It does this by connecting to the port(s) and sending trigger packets. These trigger packets will typically be an application protocol handshake (i.e. SSL). Amap then looks up the response in a list and prints out any match it finds. Adding new response identifications can be done just by adding them to an easy-to-read text file. With amap, you will be able to identify that SSL server running on port 3445 and some oracle listener on port 233!
0ca1d5e9feab7d44af39dc058a688a0636f8e798315ee742847c4057e4467fb6CIRT Advisory - The Windows XP tftp.exe software is vulnerable to a local heap-based overflow that can allow for arbitrary command execution.
a8b7da25ca4b7658dd50dc3b1893ee3edc740f50149d2a1c34212bde7393a12bThe Kaspersky Antivirus Library provides file format support for virus analysis. During analysis of cab files, Kaspersky is vulnerable to a heap overflow allowing attackers complete control of the system(s) being protected. This vulnerability can be exploited remotely without user interaction in default configurations through common protocols such as SMTP, SMB, HTTP, and FTP.
af434396cefd4db1acc36d0c3508f05a3a6511670795823b7bdb6f62ac153685SInAR Solaris rootkit version 0.3. Invisible kernel based rootkit for Solaris 8, 9, and 10. Special TAX release.
d19a7369d535bfb1d5a9c52d35003d81004f06539310402f8bee2e3b37e4db14Gentoo Linux Security Advisory GLSA 200510-02 - Mike Frysinger of the Gentoo Security Team discovered that mpeg_encode and the conversion utilities were creating temporary files with predictable or fixed filenames. The 'test' make target of the MPEG Tools also relied on several temporary files created insecurely. Versions less than 1.5b-r2 are affected.
5033c5ef536d880f20ee8134ac8e1e0ae932bb849507425249ba3e943875b8bcGentoo Linux Security Advisory GLSA 200510-01 - Eric Romang discovered that gtkdiskfree insecurely creates a predictable temporary file to handle command output. Versions less than 1.9.3-r1 are affected.
0933616bc0e417b38dd973522d0b3bda2f7b447ddcf989ed7aad3a94e41d52efThe NetFORCE 800 version 4.02 M10 will happily send the NIS password map of any domain it is bound to when mailing off diagnostic e-mails.
b36910c0efc174c8e0574bb07eedd12da80312b064f9445817416c843fce68e0Bugzilla versions below 2.20 are susceptible to multiple information leaks.
57cd438a2820f029676c4439a217c2b29e6b506f7b887a2dd556c7fb869285dbiDEFENSE Security Advisory 09.30.05 - Remote exploitation of a format string vulnerability in RealPix (.rp) file format parser within various versions of RealNetworks Inc.'s RealPlayer could allow attackers to execute arbitrary code. The vendor has indicated that the following versions are vulnerable: Linux RealPlayer 10 (10.0.0 - 10.0.5), Helix Player (10.0.0 - 10.0.5).
9bdd1cc76bdebd29318308f31dd055e8176a0677b12b4f7c5c6445220254b127A vulnerability in Citrix Metaframe Presentation Server versions 3.0 and 4.0 allows for users to bypass policy restrictions.
6b9a55689bfeff034be1de217d8057adaeb0238030aeb793f03081eea1819363FileZilla PWDump is a utility that dumps all FileZilla (client) credentials from the Windows Registry and decrypts the passwords. It also extracts the passwords from the XML config file as well. It should work on FileZilla client versions 2.2.15 and below.
68e8f489f7f32b667c3a2160064c5724df981af935198408fb31107faf4afe52The FileZilla client versions 2.2.15 and below suffer from a local credential compromise vulnerability due to improper storage.
b25fd57dbac01135b458f4ef6c6bb6f19a6c44cfc31b81c5109a0ffe085b399eGuppy versions less than 4.5.6a suffer from a directory traversal flaw.
0c4d9e03b254b7559762e6468588ce209b31b09e1710113e432ea53258356eb2Merak Mail Server 8.2.4r with Icewarp Web Mail 5.5.1 is susceptible to cross site scripting and directory traversal attacks.
a0a49a496636848c11c3e27df73bf5ffba8ac7698a0b882fac40d3b214bcb41eSecunia Security Advisory - Avaya has acknowledged a vulnerability in cpio included in some products, which can be exploited by malicious, local users to disclose and manipulate information.
54e8fc258854844e0aea9b3628f054dea4d7d4704cb60899143fa96fa6453349Secunia Security Advisory - Debian has issued an update for arc. This fixes a security issue and a vulnerability, which can be exploited by malicious, local users to gain access to sensitive information and perform certain actions on a vulnerable system with escalated privileges.
078e629baec609e1667fbb7bf4ef0a26cce894c750666f14e7d64a3a5a2ef65fSecunia Security Advisory - Avaya has acknowledged some vulnerabilities in the ls program included in some products, which can be exploited by malicious users to cause a DoS (Denial of Service).
1a4fd0c8c528cd0e8e88ebc47d522f9175289be167815bea0c6a9cbb2a4c0d75
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed