|
|
Colapse all |
Post message
Client buffer-overflow in Quake 3 engine (1.32c / rev 795) 2006-06-02 Luigi Auriemma (aluigi autistici org) Multiple Vendor NTFS Data Stream Malware Stealth Technique 2006-06-04 Joxean Koret (joxeankoret yahoo es) Hi to all! Because it isn't a new problem and is well known by virus and spyware writters I decide to release to the public now. Full disclosure. Attached goes a simple paper that describes this "very-advanced" technique that was applicable at 1993 and is currently applicable. Regards, Joxean K [ more ] [ reply ] New <<BackTrack release announcement 2006-06-02 Max Moser (max moser gmail com) Muts & I like to announce a new and stable release of "<< BackTrack". This project i a merger out of two well known security penetration testing focused linux live distributions (Whax and Auditor). After hundreds of combined man hours, we can provide you with the finest linux and windows tools on on [ more ] [ reply ] Timberland Search XSS Vulnerability 2006-06-01 try_og hotmail com There's a vulnerability in Timberland's search engine. The variable 'keywords' in searchHandler/index.jsp is not correctly sanitized. URL: hxxp://www.timberland.com/searchHandler/index.jsp?keywords=[XSS Code] Example: hxxp://www.timberland.com/searchHandler/index.jsp?keywords=<script>aler [ more ] [ reply ] VMSA-2006-0001 - VMware ESX Server Cross Site Scripting issue 2006-06-01 VMware Security Team (security vmware com) LifeType <=1.0.4 'articleId' SQL injection 2006-06-03 rgod autistici org #!/usr/bin/php -q -d short_open_tag=on <? echo "LifeType <= 1.0.4_r3270 SQL injection / admin credentials disclosure\r\n"; echo "by rgod rgod (at) autistici (dot) org [email concealed]\r\n"; echo "site: http://retrogod.altervista.org\r\n"; echo "dork: \"Powered by LifeType\" \"RSS 0.90\" \"RSS 1.0\" \"RSS 2.0\" \"Valid XHT [ more ] [ reply ] DotClear <= 1.2.4 'blog_dc_path' (php5) arbitrary remote inclusion 2006-06-03 rgod autistici org #!/usr/bin/php -q -d short_open_tag=on <? echo "DotClear <= 1.2.4 prepend.php/'blog_dc_path' arbitrary remote inclusion\r\n"; echo "by rgod rgod (at) autistici (dot) org [email concealed]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "dork: \"propulsé par DotClear\" \"fil atom\" \"fil rss\" +commentaires\ [ more ] [ reply ] [SECURITY] [DSA 1089-1] New freeradius packages fix arbitrary code execution 2006-06-03 joey infodrom org (Martin Schulze) [MajorSecurity #7]dotWidget CMS <= 1.0.6 - Remote File Include Vulnerability 2006-06-03 admin majorsecurity de [MajorSecurity #7]dotWidget CMS <= 1.0.6 - Remote File Include Vulnerability ------------------------------------------------------------------------ ------------- Software: dotWidget CMS Version: <=1.0.6 Type: Remote File Include Vulnerability Date: June, 2nd 2006 Vendor: dotWidget [ more ] [ reply ] phpBB2 (template.php) Remote File Inclusion 2006-06-03 canberx linuxmail org ******************************************************************** *Title: *phpBB2 Remote File Include * * *Credit: *Canberx * * *Thanx: *Forewer-Partizan * * *Mail: *canberx (at) linuxmail (dot) org [email concealed] www.canberx.tk * * *Google Dork: *Powered by phpBB © 2001, 2002 phpBB Group * * *Expl [ more ] [ reply ] LocazoList Classifieds <= v1.05e(viewmsg.asp) Remote SQL Injection Vulnerability 2006-06-03 ajannhwt hotmail com # Title : LocazoList Classifieds <= v1.05e(viewmsg.asp) Remote SQL Injection Vulnerability # Author : ajann #Vulnerability; $$$ http://[target]/[path]/viewmsg.asp?msgid= SQL TEXT $$$ Example: http://[target]/[path]/viewmsg.asp?msgid=-1%20union%20select%20epass,0,0 ,0,email,0,0,0,0,0 [ more ] [ reply ] Re: # MHG Security Team --- MyBloggie 2.1.1 version Remote File Include Vulnerabilit 2006-06-03 nukedx nukedx com This is not vulnerable,PHP-Nuke having a special in their files and when includes mainfile.php it overwrites the global variables and it caused to make an arbitrary file inclusion. But in MyBloggie there is no common vulnerability like it.I checked all files and all versions did not see any vulnera [ more ] [ reply ] Blackhat USA 2006 - Review , remarks and proposal agenda 2006-06-03 newslist (at) security-briefings (dot) com [email concealed] (newslist security-briefings com) the Blackhat agenda for USA 2006 session had just been published : URL <http://www.blackhat.com/html/bh-usa-06/bh-usa-06-schedule.html> The first remark is that this year, Blackhat USA, will be an incredible briefing ! There will be several Zero day announcements. For example: Brendan O'Connor [ more ] [ reply ] [SECURITY] [DSA 1088-1] New centericq packages fix arbitrary code execution 2006-06-03 joey infodrom org (Martin Schulze) Critical SQL Injection in CoolForum 2006-06-03 gmdarkfig gmail com Type: SQL Injection Risk: Critical Product: CoolForum <= 0.8.3 beta ******************************** Vulnerability ************* // File: editpost.php // Line 38 // if(isset($_REQUEST['post'])) $post = intval($_REQUEST['post']); else $post = 0; -- // Line 77 // $canedit = getrighte [ more ] [ reply ] |
|
Privacy Statement |
#######################################################################
Luigi Auriemma
Application: Quake 3 engine
http://www.idsoftware.com
http://www.icculus.org/quake3/
Versions: Quake 3 <= 1.32c
Icculus.
[ more ] [ reply ]