A statically allocated buffer is overwritter in the case that a very long Object Identifier is specified in stringified dotted notation to the smiGetNode function of libsmi[1]. This may result in arbitraty code execution by cleverly overwriting key pointers in memory.
This exploit allows an attacker to decrypt data using an auto decryptor bundled in the aspx framework and encrypt data using Rizzo-Duong CBC-R technique.
Security-Assessment.com discovered that is possible to successfully perform an HTTP Response Splitting attack against applications served by Sun Java System Web Server. The vulnerability can be exploited if user supplied input is used to generate the value of an HTTP header, as shown in the test.jsp page below. In this advisory, we will cover description of a Cross Site Scripting attack. The following HTTP GET contains a Cross Site Scripting payload which is included in the HTTP Header injection. By inserting CR and LF characters in the “ref” HTTP parameter, it is possible to split the HTTP response from the server as shown in the following table.
Security-Assessment.com discovered that a Java Applet making use of java.net.URLConnection class can be used to bypass same-of-origin (SOP) policy and domain based security controls in modern browsers when communication occurs between two domains that resolve to the same IP address. This advisory includes a Proof-of-Concept (PoC) demo and Java Applet source code. This demonstrates how the security vulnerability can be exploited to leak cookie information to an unauthorised domain, which resides on the same host IP address.
The handling functions for sending and receiving RDS messages use unchecked __copy_*_user_inatomic functions without any access checks on user-provided pointers. As a result, by passing a kernel address as an iovec base address in recvmsg-style calls, a local user can overwrite arbitrary kernel memory, which can easily be used to escalate privileges to root. Alternatively, an arbitrary kernel read can be performed via sendmsg calls.
A parameter is not properly sanitised before being used in a SQL query. Successful exploitation requires that 'magic_quotes_gpc' is disabled.
Hanso Converter is prone to a buffer overflow vulnerability when handling .ogg files. This can be exploited to cause a stack-based buffer overflow via an overly long, specially-crafted .ogg file.
The Event Ticket PORTAL web application is vulnerable to a CSRF attack which allows an attacker to change the admin password. The exploit is achieved by sending a malicious HTML form to the victim which contains the new password. The form is sent to the /admin/admin.php page of the application.
FatPlayer 0.6b is vulnerable to a buffer overflow vulnerability when a malicious WAV file is opened. The vulnerability is caused by a lack of bounds checking when processing the WAV file, which allows an attacker to overwrite the SEH (Structured Exception Handler) and execute arbitrary code. The exploit code creates a malicious WAV file with a payload of 144 bytes that executes calc.exe when opened in FatPlayer 0.6b.
CubeCart 2.0.1 is vulnerable to a SQL injection attack. An attacker can exploit this vulnerability by sending malicious SQL queries to the application. This can be done by appending a single quote (') to the end of the URL. For example, http://www.example.com/cart/index.php?cat_id=19' {SQL Injection}. An attacker can also use the UNION operator to retrieve data from the database. For example, http://www.example.com/cart/index.php?cat_id=19+union+select+group_concat%28username,0x3a,password%29,2,3,4,5,6,7,8+from+cube305_CubeCart_admin_users--
Services By CQR