Packet Storm's last 20 added files.
Last Updated: Wed Dec  3 21:51:00 EST 2008


[ USN-686-1.txt ] 75c145ec64f4430ab0be1e1967985fce Ubuntu Security Notice USN-686-1 - Morgan Todd discovered that AWStats did not correctly strip quotes from certain parameters, allowing for an XSS attack when running as a CGI. If a user was tricked by a remote attacker into following a specially crafted URL, the user's authentication information could be exposed for the domain where AWStats was hosted.  
[ USN-685-1.txt ] 160150a1aec9ec4fbae385d4790925ed Ubuntu Security Notice USN-685-1 - Wes Hardaker discovered that the SNMP service did not correctly validate HMAC authentication requests. An unauthenticated remote attacker could send specially crafted SNMPv3 traffic with a valid username and gain access to the user's views without a valid authentication passphrase. John Kortink discovered that the Net-SNMP Perl module did not correctly check the size of returned values. If a user or automated system were tricked into querying a malicious SNMP server, the application using the Perl module could be made to crash, leading to a denial of service. This did not affect Ubuntu 8.10. It was discovered that the SNMP service did not correctly handle large GETBULK requests. If an unauthenticated remote attacker sent a specially crafted request, the SNMP service could be made to crash, leading to a denial of service.  
[ clamav0941-overflow.txt ] 59918e80ac659a0e378d6b403e18912a Stack overflow proof of concept exploit for ClamAV versions below 0.94.2 that relates to JPG file handling.  
[ SSRT080141.txt ] afacac6c6871fe4d9d07e866a0958539 HP Security Bulletin - A potential security vulnerability has been identified in HP-UX. The vulnerability could be exploited locally to create a denial of service (DoS).  
[ cainabel-overflow.txt ] e43b6f151b55255022c69b51d53e3cec Cain and Abel version 4.9.23 RDP file buffer overflow exploit that adds an administrator user.  
[ SVRT-06-08.txt ] 6cabe3f47c31245ee257594b7872eca0 mvnForum versions 1.2 GA and below suffer from a cross site scripting vulnerability and multiple cross site request forgery vulnerabilities.  
[ radasm-hijack.txt ] a04887449d1781da46fdc4e3e3bcf59c RadAsm versions 2.2.1.4 and below WindowCallProcA pointer hijack exploit with calc.exe shellcode.  
[ joomlajmovies-sql.txt ] 7e5beb358a1b6d65f2f8bb4027efb9f0 Joomla Jmovies component version 1.1 remote SQL injection exploit.  
[ yappang-xss.txt ] 754681a11ad41177cdc7028cd3a16e26 yappa-ng suffers from a cross site scripting vulnerability.  
[ buzzywall-xss.txt ] aedefea7ba8abaa1001fa168c40640ca BuzzyWall suffers from a cross site scripting vulnerability.  
[ freekot-sql.txt ] 42a1a9482e05b861b8661c18b28e5890 FREEKOT suffers from a remote SQL injection vulnerability that allows for authentication bypass.  
[ revsense-sqlxss.txt ] 397f01564b9170d347621c98c58e56e7 RevSense version 1.0 suffers from cross site scripting and remote SQL injection vulnerabilities.  
[ sailplanner-sqlxsslfi.txt ] 5a3c34a58dbd41ea2548606aabc73eef SailPlanner suffers from cross site scripting, remote SQL injection, and local file inclusion vulnerabilities.  
[ securedownload-xsscm.txt ] 5438684e5be9427cb5d7574c897de4b3 Secure Download version Alpha 0.2.1 suffers from cross site scripting and cookie manipulation vulnerabilities.  
[ raemedia-sql.txt ] 7fbde75effdee616bbadd2f2d5b053a4 Rae Media Contact MS suffers from a SQL injection vulnerability that allows for authentication bypass.  
[ proclan-fixation.txt ] 5fe0e3950f6e545a7b6746edd8f8beca Pro Clan Manager CMS version 0.4.2 suffers from a session fixation vulnerability.  
[ checknew-sql.txt ] 35cd4306e6258d120a2723282399c07e Check New version 4.52 remote SQL injection exploit that makes use of findoffice.php.  
[ dsa-1679-1.txt ] 754fa172693331bf0ec70b06ef5713de Debian Security Advisory 1679-1 - Morgan Todd discovered a cross-site scripting vulnerability in awstats, a log file analyzer, involving the "config" request parameter (and possibly others; CVE-2008-3714).  
[ dsa-1678-1.txt ] 30869675c4b089500534b927d04f58c0 Debian Security Advisory 1678-1 - Paul Szabo rediscovered a vulnerability in the File::Path::rmtree function of Perl. It was possible to exploit a race condition to create setuid binaries in a directory tree or remove arbitrary files when a process is deleting this tree. This issue was originally known as CVE-2005-0448 and CVE-2004-0452, which were addressed by DSA-696-1 and DSA-620-1. Unfortunately, they were reintroduced later.  
[ aspuserengine-disclose.txt ] beb86616d262ac0c344fb4f1266a5ec4 ASP User Engine .NET suffers from a remote database disclosure vulnerability.