SecuriTeam

LedgerSMB Multiple Vulnerabilities

Tue, 26 Jan 2010 01:24 GMT

It has been brought to our attention that a number of security vulnerabilities have been noted in SQL-Ledger. Several of these affect earlier versions of LedgerSMB, and three hotfixes have been released for problems that continue to affect the LedgerSMB codebase.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Kaspersky Lab Multiple Products Local Privilege Escalation Vulnerability

Mon, 04 Jan 2010 19:26 GMT

Insecure permissions have been detected in the multiple Kaspersky Lab antivirus products.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Piwik Cookie Unserialize Vulnerability

Fri, 11 Dec 2009 19:42 GMT

Piwik unserializes() user input which allows an attacker to send a carefully crafted cookie that when unserialized utilizes Piwik's classes to upload arbitrary files or execute arbitrary PHP code.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Invision Power Board SQL PHP File Inclusion and SQL Injection

Tue, 08 Dec 2009 23:49 GMT

Invision Power Board has a PHP file inclusion vulnerability that is trivial to exploit with a web browser and a known location of a php file residing on the target system. Authorisation is not required. The SQL injection vulnerability is somewhat tricky to exploit as there are quite a few restrictions that make creating a successful sql attack vector difficult. Nevertheless a crafty attacker might issue a series of requests that might allow him to gain some information about the target system or even read files from the disk depending on permissions granted to the db account that is used by the forum.

Make your website safer. Use external penetration testing service. First report ready in one hour!

U.S. Defense Information Systems Agency (DISA) Unix Security Readiness Review (SRR) Vulnerability

Mon, 07 Dec 2009 23:22 GMT

The U.S. Defense Information Systems Agency (DISA) publishes Security Readiness Review scripts (SRRs) to ensure systems and software meet security baselines required by the Department of Defense. Unprivileged local users can obtain root access on Unix systems where the DISA SRR scripts are run.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Netifera - Modular Open Source Platform for Security Tools

Sun, 12 Apr 2009 14:01 GMT

Make your website safer. Use external penetration testing service. First report ready in one hour!

WarVOX - Tools for Exploring, Classifying, and Auditing Telephone Systems

Mon, 09 Mar 2009 08:59 GMT

Make your website safer. Use external penetration testing service. First report ready in one hour!

Webshag - Web Server Audit Tool

Mon, 23 Feb 2009 17:28 GMT

Make your website safer. Use external penetration testing service. First report ready in one hour!

Browser Fuzzer

Tue, 20 Jan 2009 14:01 GMT

Make your website safer. Use external penetration testing service. First report ready in one hour!

FSpy - Linux Filesystem Activity Monitoring

Wed, 31 Dec 2008 12:04 GMT

Make your website safer. Use external penetration testing service. First report ready in one hour!

Publique! CMS and SQL Injection Vulnerabilities

Tue, 26 Jan 2010 01:44 GMT

A remotely exploitable vulnerability was found in the framework core component. Exploitation of this bug does not require authentication and will lead to remotely exposed potentially sensitive information from the Publique! database. Particularly, an attacker can extract usernames and passwords needed to authenticate to the administrative interface and gain full control of the web site and (depending on certain conditions) the server itself.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Files2Links F2L-3000 SQL Injection Vulnerability

Tue, 26 Jan 2010 00:27 GMT

The login page of the F2L-3000 version 4.0.0 is vulnerable to SQL Injection. Exploitation of the vulnerability may allow attackers to bypass authentication and access sensitive information stored on the device.

Make your website safer. Use external penetration testing service. First report ready in one hour!

HP-UX Running Apache Data Injection and DoS Vulnerability

Mon, 04 Jan 2010 19:20 GMT

A potential security vulnerability has been identified with HP-UX running Apache v2.0.59.12 and earlier. The vulnerability could be exploited remotely to inject unauthorized data or to create a Denial of Service (DoS).

Make your website safer. Use external penetration testing service. First report ready in one hour!

MIT krb5 KDC denial of service in cross-realm referral processing

Sat, 02 Jan 2010 18:51 GMT

An unauthenticated remote attacker could cause the KDC to crash due to a null pointer dereference. Legitimate requests can also cause this crash to occur.

Make your website safer. Use external penetration testing service. First report ready in one hour!

AproxEngine Multiple Vulnerabilities

Fri, 01 Jan 2010 23:38 GMT

Vulnerabilities have been discovered in AproxEngine, which can be exploited by malicious users to manipulate certain data, conduct spoofing, SQL injection, and script insertion attacks and by malicious people to conduct SQL injection and script insertion attacks.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Microsoft Indeo Codec Memory Corruption Vulnerability

Thu, 10 Dec 2009 03:07 GMT

The Indeo codec on systems running Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow code to run on users systems when opening specially crafted content.

Make your website safer. Use external penetration testing service. First report ready in one hour!

HP DDMI Execution of Arbitrary Code

Wed, 18 Nov 2009 19:18 GMT

A potential security vulnerability has been identified with HP Discovery & Dependency Mapping Inventory (DDMI) running on Windows. The vulnerability could be exploited remotely by an authorized user to execute arbitrary code.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Microsoft Windows License Logging Service Heap Corruption Vulnerability

Fri, 13 Nov 2009 20:16 GMT

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. Authentication is not required on certain configurations to exploit this vulnerability.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Microsoft Office Excel Code Execution Vulnerabilities

Fri, 13 Nov 2009 19:41 GMT

Attackers using specially crafted XLS files can execute arbitrary code via memory corruptions, invalid index, and invalid pointer errors.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Microsoft SharePoint 2007 ASP.NET Source Code Disclosure

Tue, 03 Nov 2009 01:51 GMT

It was found that the download facility of Microsoft SharePoint Team Services can be abused to reveal the source code of ASP.NET files.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Trango Broadband Wireless Rogue SU Authentication Bug

Sat, 02 Jan 2010 18:40 GMT

Currently there is a flaw in the authentication mechanism of these radios which, if an attacker knows some details, can allow interception of ethernet packets broadcast from the Access Point to the Subscriber Unit and potentially allows injection into the communication from the Subscriber Unit to the Access Point.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Exposing HMS HICP Protocol and Intellicom NetBiterConfig.exe Remote Buffer Overflow

Fri, 01 Jan 2010 23:52 GMT

SCADA weaknesses created by HICP Protocol and NetBiter WebSCADA.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Family Connections Multiple Remote Vulnerabilities

Thu, 17 Dec 2009 23:16 GMT

Many fields are not properly sanitised and some checks can be bypassed.

Make your website safer. Use external penetration testing service. First report ready in one hour!

VideoCache vccleaner Root Vulnerability

Thu, 17 Dec 2009 23:07 GMT

VideoCache is a Squid URL rewriter plugin written in Python for bandwidth optimization while browsing video sharing websites. Version 1.9.2 allows a user with the privileges of the Squid proxy server to append semi-arbitrary data to arbitrary files with root privileges, upon the administrator's execution of the 'vccleaner' utility.

Make your website safer. Use external penetration testing service. First report ready in one hour!

QuickHeal Antivirus 2010 Local Privilege Escalation

Thu, 17 Dec 2009 22:57 GMT

All files under the install folder have Full control for BUILTIN\users and can be replace with malicious files.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Why Silent Updates Boost Security

Sun, 10 May 2009 18:35 GMT

Thomas Duebendorfer Google Switzerland GmbH and Stefan Frei Communication Systems Group, ETH Zurich, Switzerland looked into the performance of Web browser update mechanisms. The analysis of anonymized Google Web server logs allowed us to compare and rank the update strategies deployed by Google Chrome, Mozilla Firefox, Apple Safari, and Opera.

Make your website safer. Use external penetration testing service. First report ready in one hour!

PDF Silent HTTP Form Repurposing Attacks

Sun, 10 May 2009 18:29 GMT

This paper sheds light on a modified approach to triggering web attacks through JavaScript protocol handler in the context of opening a PDF in a browser.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Frame Pointer Overwrite Demonstration (Linux)

Wed, 03 Dec 2008 16:24 GMT

This paper assumes you have read the proper background information and/or technical details about the above subject. If not, please do so, because this read does not include key concepts but instead technical exploitation examples. That being said, enjoy. Knowledge is power.

Make your website safer. Use external penetration testing service. First report ready in one hour!

Format String Exploitation Demonstration (Linux)

Tue, 02 Dec 2008 16:22 GMT

Make your website safer. Use external penetration testing service. First report ready in one hour!

Hacking SOHO Routers

Wed, 12 Nov 2008 17:54 GMT

The purpose of this paper is to outline the security measures being taken by vendors to prevent such attacks in their home routing products, what those security measures accomplish, and where they fall short. We will use existing network tools to examine common vulnerabilities in a range of popular devices and demonstrate weaknesses in the security of those devices; additionally, we will examine common trends in security measures that have been duplicated across vendors, and examine how those trends help and hinder the security of their devices. In particular, we will examine the following home routers, which are some of the latest offerings from their respective vendors at the time of this writing: * Linksys WRT160N

Make your website safer. Use external penetration testing service. First report ready in one hour!