----------------------------------------
Download a FREE trial of HP WebInspect
Application attacks are growing more prevalent. New attacks are in the news each day. Now it's time for you to assess your applications and start detecting and removing vulnerabilities.
HP can help, with a full suite of application security solutions. Get started today with a complimentary trial download that uses an HP test application. Thoroughly analyze today's complex web applications in a runtime environment with fast scanning capabilities, broad assessment coverage and accurate web application scanning results.
Download WebInspect now: https://h10078.www1.hp.com/cda/hpdc/navigation.do?action=downloadBinStart&zn=bto&cp=54_4012_100__&caid=14563&jumpid=ex_r11374_us/en/large/tsg/WebInspect_Eval_Security_Focus/3-1QN6MIF_3-UTM2ZJ/20080920&origin_id=3-1QN6MIF
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as conveying topics of interest for our community. We are proud to offer content from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1.The Boston Trio and the MBTA
2.From Physics to Security
II. BUGTRAQ SUMMARY
1. Wireshark 1.0.2 Multiple Vulnerabilities
2. Git Pathname Multiple Buffer Overflow Vulnerabilities
3. Barcode Generator 'image.php' Local File Include Vulnerability
4. Linux Kernel 'tmpfs' filesystem Local Security Vulnerability
5. Symantec Backup Exec Scheduler ActiveX Control Multiple Stack Based Buffer Overflow Vulnerabilities
6. Cisco Unified Communications Manager SIP Service Multiple Denial of Service Vulnerabilities
7. Cisco IOS MPLS VPN Information Disclosure Vulnerability
8. Linux Kernel 'do_change_type()' Local Security Bypass Vulnerability
9. Cisco IOS Protocol Independent Multicast (PIM) Multiple Denial of Service Vulnerablities
10. Cisco IOS Remote IPC Denial of Service Vulnerability
11. Cisco IOS SIP Multiple Denial of Service Vulnerabilities
12. Cisco IOS MPLS Forwarding Infrastructure Remote Denial of Service Vulnerability
13. Cisco IOS Layer 2 Tunneling Protocol Denial Of Service Vulnerability
14. Cisco IOS SSL Session Termination Remote Denial of Service Vulnerability
15. Cisco IOS IPS 'SERVICE.DNS' Remote Denial of Service Vulnerability
16. Cisco IOS AIC HTTP Transit Packet Remote Denial of Service Vulnerability
17. Cisco IOS NAT Skinny Call Control Protocol Multiple Remote Denial of Service Vulnerabilities
18. Cisco uBR10012 Router Default SNMP Community Vulnerability
19. iGaming CMS Multiple SQL Injection Vulnerabilities
20. OpenRat 'insert.inc.php' Remote File Include Vulnerability
21. Omnicom Content Platform 'browser.asp' Parameter Directory Traversal Vulnerability
22. Datalife Engine CMS 'admin.php' Cross Site Scripting Vulnerability
23. pfSense DHCPREQUEST Hostname HTML Injection Vulnerability
24. CJ Ultra Plus 'SID' Cookie Parameter SQL Injection Vulnerability
25. Chilkat XML ActiveX Control Multiple Vulnerabilities
26. Multiple SAGEM F@st Routers DHCP Hostname HTML Injection Vulnerability
27. Multiple Vendors IMAP Servers Denial of Service Vulnerability
28. HP OpenVMS 'SMGSHR.EXE' Local Buffer Overflow Vulnerability
29. Sun Ray Device Manager Daemon Multiple Vulnerabilities
30. MailWatch 'docs.php' Local File Include Vulnerability
31. phpMyAdmin 'server_databases.php' Remote Command Execution Vulnerability
32. Drupal Simplenews 'Newsletter Categories' HTML Injection Vulnerability
33. Jadu CMS for Government 'recruit_details.php' SQL Injection Vulnerability
34. Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerabilities
35. NMS DVD Burning SDK 'NMSDVDX.dll' ActiveX Control Arbitrary File Overwrite Vulnerability
36. TYPO3 freeCap CAPTCHA Unspecified Cross Site Scripting Vulnerability
37. web-cp 'sendfile.php' Information Disclosure Vulnerability
38. Google Chrome Carriage Return Remote Denial of Service Vulnerability
39. Connectra NGX 'index.php' Cross-Site Scripting Vulnerability
40. PHPcounter 'defs.php' Local File Include Vulnerability
41. ABB PCU400 'x87' Remote Buffer Overflow Vulnerability
42. emergecolab 'index.php' Local File Include Vulnerability
43. Linux Kernel 'truncate()' Local Privilege Escalation Vulnerability
44. AJ Auction Pro Platinum Skin #2 'detail.php' SQL Injection Vulnerability
45. WebPortal CMS 'index.php' Remote Code Execution Vulnerability
46. Jetik.net ESA 'KayitNo' Parameter Multiple SQL Injection Vulnerabilities
47. osCMax 'test.html' Arbitrary File Upload Vulnerability
48. InterTech WCMS 'etemplate.php' SQL Injection Vulnerability
49. Microsoft Office OneNote URL Handler Remote Code Execution Vulnerability
50. Microsoft Windows Media Player SSPL File Sample Rate Remote Code-Execution Vulnerability
51. Microsoft GDI+ BMP Integer Overflow Vulnerability
52. Microsoft GDI+ WMF Image File Buffer Overflow Vulnerability
53. Microsoft GDI+ GIF File Parsing Remote Code Execution Vulnerability
54. Microsoft GDI+ EMF Image Processing Memory Corruption Vulnerability
55. Microsoft Windows Media Encoder 9 'wmex.dll' ActiveX Control Remote Buffer Overflow Vulnerability
56. Microsoft GDI+ VML Heap-Based Buffer Overflow Vulnerability
57. Ol' Bookmarks Multiple Input Validation Vulnerabilities
58. X.Org X Server MIT-SHM Extension Information Disclosure Vulnerability
59. X.Org X server RENDER Extension Multiple Integer Overflow Vulnerabilities
60. X.Org X Server RENDER Extension 'ProcRenderCreateCursor()' Denial of Service Vulnerability
61. RETIRED: Microsoft September 2008 Advance Notification Multiple Vulnerabilities
62. Greatclone Hotscripts Clone 'showcategory.php' SQL Injection Vulnerability
63. Mantis Insecure Cookie Disclosure Weakness
64. JETIK-WEB 'sayfa.php' SQL Injection Vulnerability
65. BitlBee Unspecified Security Bypass Variant Vulnerability
66. Symantec Veritas NetBackup Java Administration GUI Remote Privilege Escalation Vulnerability
67. Sofi WebGUI 'modstart.php' Remote File Include Vulnerability
68. Apple Mac OS X Java Applet HMAC Provider Handling Remote Code Execution Vulnerability
69. Apple Mac OS X Java Plug-in 'file://' URL Handling Remote Code Execution Vulnerability
70. Sun Java Runtime Environment XML Data Processing Multiple Vulnerabilities
71. Sun Java Runtime Environment Font Processing Buffer Overflow Vulnerability
72. Sun Java SE Secure Static Versioning Applet Execution Weakness
73. Sun Java Runtime Environment Virtual Machine Privilege Escalation Vulnerability
74. Sun Java SE Java Management Extensions (JMX) Unspecified Unauthorized Access Vulnerability
75. Sun Java Runtime Environment Multiple Security Vulnerabilities
76. Sun Java Web Start Multiple Vulnerabilities
77. Sun Java Runtime Environment Image Parsing Heap Buffer Overflow Vulnerability
78. Sun Java Runtime Environment Multiple Unspecified Same Origin Policy Violation Vulnerabilities
79. Sun Java SE Multiple Security Vulnerabilities
80. Linux Kernel 'snd_seq_oss_synth_make_info()' Information Disclosure Vulnerability
81. Blender Unspecified Insecure Temporary File Creation Vulnerability
82. Blender 'radiance_hdr.c' Remote Buffer Overflow Vulnerability
83. Peachtree Accounting 'PAWWeb11.ocx' ActiveX Control Insecure Method Vulnerability
84. Symantec Backup Exec Scheduler ActiveX Control Multiple Arbitrary File Overwrite Vulnerabilities
85. Linux Kernel UBIFS Orphan Inode Local Denial of Service Vulnerability
86. Mass Downloader Malformed Executable Denial Of Service Vulnerability
87. PHP infoBoard 'idcat' Parameter SQL Injection and HTML Injection Vulnerabilities
88. PHP infoBoard Cookie Authentication Bypass Vulnerability
89. Libra File Manager 'fileadmin.php' Local File Include Vulnerability
90. Lansuite 'design' Parameter Local File Include Vulnerability
91. EasyRealtorPRO 'site_search.php' Multiple SQL Injection Vulnerabilities
92. K-Lite Mega Codec Pack 'vsfilter.dll' Denial Of Service Vulnerability
93. Microsoft WordPad '.doc' File Remote Denial of Service Vulnerability
94. PHP 'create_function()' Code Injection Weakness
95. Mozilla Firefox/SeaMonkey UTF-8 Stack-Based Buffer Overflow Vulnerability
96. Bitweaver Multiple Cross-Site Scripting Vulnerabilities
97. Vikingboard 'upload/index.php' Local File Include Vulnerability
98. phpOCS 'index.php' Local File Include Vulnerability
99. AJ Auction Pro SQL Injection and Cross Site Scripting Vulnerabilities
100. Drupal Stock 'stock quote' Page Authentication Bypass Vulnerability
III. SECURITYFOCUS NEWS
1. Security of Google's browser gets mixed marks
2. Online intruders hit Red Hat, Fedora Project
3. Researchers race to zero in record time
4. Gov't charges alleged TJX credit-card thieves
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Account Manager, Ottawa
2. [SJ-JOB] Security Engineer, Waukegan
3. [SJ-JOB] Penetration Engineer, London
4. [SJ-JOB] Sales Engineer, Minneapolis
5. [SJ-JOB] Customer Service, St Paul
6. [SJ-JOB] Account Manager, Nashville
7. [SJ-JOB] Sales Engineer, New York
8. [SJ-JOB] Sales Engineer, New York
9. [SJ-JOB] Senior Software Engineer, Suitland
10. [SJ-JOB] Security System Administrator, Madison, NY or New Jersey
11. [SJ-JOB] Information Assurance Engineer, San Diego
12. [SJ-JOB] Application Security Architect, Portsmouth
13. [SJ-JOB] Sales Engineer, Boston
14. [SJ-JOB] Security Auditor, Cheltenham
15. [SJ-JOB] Security Researcher, Beaverton
16. [SJ-JOB] Sales Engineer, Atlanta
17. [SJ-JOB] Incident Handler, Washington
18. [SJ-JOB] Application Security Architect, Columbia
19. [SJ-JOB] Application Security Engineer, Ft.Lauderdale
20. [SJ-JOB] Security Engineer, New york
21. [SJ-JOB] Security Consultant, Reading
22. [SJ-JOB] VP, Information Security, Baltimore
23. [SJ-JOB] Director, Information Security, Portsmouth
24. [SJ-JOB] Management, San Jose
25. [SJ-JOB] Sales Engineer, Raleigh
26. [SJ-JOB] Manager, Information Security, Pune
27. [SJ-JOB] Sales Engineer, Atlanta
28. [SJ-JOB] Sr. Security Analyst, Aurora
V. INCIDENTS LIST SUMMARY
VI. VULN-DEV RESEARCH LIST SUMMARY
1. Is the memory map of a process different when executed in GDB?
VII. MICROSOFT FOCUS LIST SUMMARY
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1.The Boston Trio and the MBTA
By Mark Rasch
The annual DEFCON conference in Las Vegas in early August got a bit more interesting than usual when three graduate students from the Massachusetts Institute of Technology were enjoined from giving a presentation by a Court in Boston.
http://www.securityfocus.com/columnists/480
2.From Physics to Security
By Federico Biancuzzi
Wietse Venema started out as a physicist, but became interested in the security of the programs he wrote to control his physics experiments. He went on to create several well-known network and security tools, including the Security Administrator's Tool for Analyzing Networks (SATAN) and The Coroner's Toolkit with Dan Farmer. He is also the creator of the popular MTA Postfix and TCP Wrapper.
http://www.securityfocus.com/columnists/479
II. BUGTRAQ SUMMARY
--------------------
1. Wireshark 1.0.2 Multiple Vulnerabilities
BugTraq ID: 31009
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31009
Summary:
Wireshark is prone to multiple vulnerabilities, including buffer-overflow and denial-of-service issues.
Exploiting these issues may allow attackers to crash the application and deny service to legitimate users. Attackers may be able to leverage some of these vulnerabilities to execute arbitrary code, but this has not been confirmed.
These issues affect Wireshark 0.9.7 up to and including 1.0.2.
2. Git Pathname Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 30549
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30549
Summary:
Git is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.
Successfully exploiting these issues may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions.
Git 1.5.6.3 is vulnerable; prior versions may also be affected.
3. Barcode Generator 'image.php' Local File Include Vulnerability
BugTraq ID: 31382
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31382
Summary:
Barcode Generator is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal strings to view local files and execute local scripts within the context of the webserver process.
Barcode Generator 2.0.0 and prior versions are affected.
4. Linux Kernel 'tmpfs' filesystem Local Security Vulnerability
BugTraq ID: 27694
Remote: No
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/27694
Summary:
Linux Kernel is prone to a vulnerability that allows attackers to obtain sensitive information or to cause a denial-of-service condition.
5. Symantec Backup Exec Scheduler ActiveX Control Multiple Stack Based Buffer Overflow Vulnerabilities
BugTraq ID: 26904
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/26904
Summary:
An ActiveX control in the scheduler component of Symantec Backup Exec is prone to multiple stack-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.
6. Cisco Unified Communications Manager SIP Service Multiple Denial of Service Vulnerabilities
BugTraq ID: 31367
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31367
Summary:
Cisco Unified Communications Manager is prone to multiple denial-of-service vulnerabilities.
These issues affect the Session Initiation Protocol (SIP) service.
These issues are documented by Cisco bug IDs CSCsu38644 and CSCsm46064.
An attacker can exploit these issues to cause denial-of-service conditions in the affected application.
7. Cisco IOS MPLS VPN Information Disclosure Vulnerability
BugTraq ID: 31366
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31366
Summary:
Cisco IOS (Internetwork Operating System) is an operating system commonly used on Cisco routers and network switches.
Cisco ISO Multiprotocol Label Switching (MPLS) Virtual Private Networks (VPNs) and VPN Routing and Forwarding Lite (VRF Lite) are prone to an information-disclosure vulnerability.
This vulnerability is tracked by Cisco Bug ID CSCee83237 and CVE-2008-3803.
8. Linux Kernel 'do_change_type()' Local Security Bypass Vulnerability
BugTraq ID: 30126
Remote: No
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/30126
Summary:
The Linux kernel is prone to a local security-bypass vulnerability because the 'do_change_type()' routine fails to adequately verify user permissions before performing mountpoint type changes.
Attackers can exploit this issue to bypass security restrictions and change mountpoint types. Attackers could mark private mounts as sharable to gain access to potentially sensitive information. Other attacks are also possible.
Linux kernel 2.6.15-rc1 to 2.6.21 are vulnerable.
9. Cisco IOS Protocol Independent Multicast (PIM) Multiple Denial of Service Vulnerablities
BugTraq ID: 31356
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31356
Summary:
Cisco IOS is prone to multiple remote denial-of-service vulnerabilities because the software fails to properly handle malformed network datagrams.
Successfully exploiting these issues allows remote attackers to cause targeted devices to reload. Multiple exploits can lead to a sustained denial-of-service.
These issues are tracked by Cisco Bug IDs CSCsd95616 and CSCsl34355.
10. Cisco IOS Remote IPC Denial of Service Vulnerability
BugTraq ID: 31363
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31363
Summary:
Multiple Cisco products running Cisco IOS (Internetwork Operating System) are prone to a denial-of-service vulnerability when handling maliciously crafted UDP-based IPC traffic.
An attacker can exploit this issue to trigger device or linecard reloads, causing denial-of-service conditions.
The following device series are affected:
Cisco 10000
Cisco uBR10012
Cisco uBR7200
11. Cisco IOS SIP Multiple Denial of Service Vulnerabilities
BugTraq ID: 31361
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31361
Summary:
Devices running Cisco IOS with SIP enabled are prone to multiple denial-of-service vulnerabilities.
These issues are tracked by the following Cisco bug IDs and CVEs:
CSCse56800 (CVE-2008-3799)
CSCsg91306 (CVE-2008-3800)
CSCsl62609 (CVE-2008-3801)
CSCsk42759 (CVE-2008-3802)
An attacker can exploit these issues to deny service to legitimate users.
12. Cisco IOS MPLS Forwarding Infrastructure Remote Denial of Service Vulnerability
BugTraq ID: 31360
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31360
Summary:
Cisco IOS is prone to a denial-of-service vulnerability related to the Multi Protocol Label Switching (MPLS) Forwarding Infrastructure (MFI) feature.
A successful exploit may cause an affected device to reload, denying service to legitimate users.
13. Cisco IOS Layer 2 Tunneling Protocol Denial Of Service Vulnerability
BugTraq ID: 31358
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31358
Summary:
Cisco IOS is prone to a denial-of-service vulnerability.
A remote attacker can exploit this issue to cause an affected device to reload.
This vulnerability is tracked by Cisco bug ID CSCsh48879 and by CVE-2008-3813.
14. Cisco IOS SSL Session Termination Remote Denial of Service Vulnerability
BugTraq ID: 31365
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31365
Summary:
Cisco IOS is prone to a denial-of-service vulnerability related to the termination of SSL sessions via TCP connections.
A successful exploit may cause an affected device to crash, denying service to legitimate users.
This issue is being tracked by Cisco Bug ID CSCsj85065.
15. Cisco IOS IPS 'SERVICE.DNS' Remote Denial of Service Vulnerability
BugTraq ID: 31364
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31364
Summary:
Cisco IOS Intrusion Prevention System is prone to a denial-of-service vulnerability when processing certain IPS signatures.
A successful exploit will cause an affected device to crash, denying service to legitimate users.
16. Cisco IOS AIC HTTP Transit Packet Remote Denial of Service Vulnerability
BugTraq ID: 31354
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31354
Summary:
Cisco IOS when configured for IOS firewall AIC (Application Inspection Control) with an HTTP application-specific policy is prone to a denial-of-service vulnerability.
A successful exploit may cause affected devices to reload, denying service to legitimate users.
17. Cisco IOS NAT Skinny Call Control Protocol Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 31359
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31359
Summary:
Cisco IOS is prone to multiple remote denial-of-service vulnerabilities that occur in the Skinny Call Control Protocol (SCCP).
A successful exploit may cause affected devices to reload, denying service to legitimate users.
18. Cisco uBR10012 Router Default SNMP Community Vulnerability
BugTraq ID: 31355
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31355
Summary:
Cisco uBR10012 routers are high-performance network devices.
The routers are prone to a weak default configuration issue. A remote attacker may exploit this issue to gain complete access to the vulnerable device.
Cisco uBR10012 routers are vulnerable.
This issue is being tracked by Cisco bug ID CSCek57932.
19. iGaming CMS Multiple SQL Injection Vulnerabilities
BugTraq ID: 31340
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31340
Summary:
iGaming CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
iGaming CMS 1.5 is vulnerable; other versions may also be affected.
20. OpenRat 'insert.inc.php' Remote File Include Vulnerability
BugTraq ID: 31339
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31339
Summary:
OpenRat is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
OpenRat 0.8-beta4 is vulnerable; other versions may also be affected.
21. Omnicom Content Platform 'browser.asp' Parameter Directory Traversal Vulnerability
BugTraq ID: 31338
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31338
Summary:
Omnicom Content Platform is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.
To exploit this issue an attacker may need administrative privileges to the affected application.
Exploiting the issue may allow the attacker to obtain sensitive information that could aid in further attacks.
Omnicom Content Platform 2.0 is vulnerable; other versions may also be affected.
22. Datalife Engine CMS 'admin.php' Cross Site Scripting Vulnerability
BugTraq ID: 31335
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31335
Summary:
Datalife Engine CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Datalife Engine CMS 7.2 is vulnerable; other versions may also be affected.
23. pfSense DHCPREQUEST Hostname HTML Injection Vulnerability
BugTraq ID: 31334
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31334
Summary:
pfSense is prone to an HTML-injection vulnerability because its administrative web interface fails to sufficiently sanitize user-supplied input data.
Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
The issue affects pfSense 1.0.1.
24. CJ Ultra Plus 'SID' Cookie Parameter SQL Injection Vulnerability
BugTraq ID: 31333
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31333
Summary:
CJ Ultra Plus is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CJ Ultra Plus 1.0.4 and prior versions are vulnerable.
25. Chilkat XML ActiveX Control Multiple Vulnerabilities
BugTraq ID: 31332
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31332
Summary:
The Chilkat XML ActiveX control is prone to multiple vulnerabilities.
An attacker can exploit these issues by enticing an unsuspecting victim to view a malicious HTML page.
Successfully exploiting these issues will allow the attacker to create or overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).
The Chilkat XML ActiveX control DLL 'ChilkatUtil.dll' 3.0.3.0 and prior versions are affected.
26. Multiple SAGEM F@st Routers DHCP Hostname HTML Injection Vulnerability
BugTraq ID: 31331
Remote: Yes
Last Updated: 2008-09-24
Relevant URL: http://www.securityfocus.com/bid/31331
Summary:
Multiple SAGEM F@st routers are prone to an HTML-injection vulnerability because they fail to sufficiently sanitize user-supplied input data.
Attacker-supplied HTML and script code would run in the context of the web interface of the affected device, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
The issue affects SAGEM F@st routers 1200, 1240, 1400, 1400W, 1500, 1500-WG, and 2404.
27. Multiple Vendors IMAP Servers Denial of Service Vulnerability
BugTraq ID: 31318
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31318
Summary:
Multiple vendors' IMAP servers are prone to a remote denial-of-service vulnerability caused by an unspecified error when handling IMAP login requests.
An attacker can exploit this issue to make the affected applications unresponsive, denying service to legitimate users.
This issue affects:
University of Washington imapd
Carnegie Mellon University Cyrus IMAP Server
GNU Mailutils imapd
NOTE: Reports indicate that this issue arises when the affected serves are used with the Debian Sarge platform. Therefore these issues may affect only Debian-specific instances. We will update this BID as more information emerges.
28. HP OpenVMS 'SMGSHR.EXE' Local Buffer Overflow Vulnerability
BugTraq ID: 30840
Remote: No
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30840
Summary:
HP OpenVMS is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial of service.
29. Sun Ray Device Manager Daemon Multiple Vulnerabilities
BugTraq ID: 26944
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/26944
Summary:
Sun Ray Device Manager daemon is prone to multiple vulnerabilities.
Attackers can leverage these issues to create or delete arbitrary directories on the affected server or to crash the daemon and deny service to legitimate users.
30. MailWatch 'docs.php' Local File Include Vulnerability
BugTraq ID: 31378
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31378
Summary:
MailWatch is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.
MailWatch 1.0.4 is vulnerable; other versions may also be affected.
31. phpMyAdmin 'server_databases.php' Remote Command Execution Vulnerability
BugTraq ID: 31188
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31188
Summary:
phpMyAdmin is prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue occurs because the application fails to adequately sanitize user-supplied input.
Successful attacks can compromise the affected application and possibly the underlying computer.
This issue affects versions prior to phpMyAdmin 2.11.9.1.
32. Drupal Simplenews 'Newsletter Categories' HTML Injection Vulnerability
BugTraq ID: 31377
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31377
Summary:
The Simplenews module for Drupal is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
http://drupal.org/node/207891
33. Jadu CMS for Government 'recruit_details.php' SQL Injection Vulnerability
BugTraq ID: 31376
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31376
Summary:
Jadu CMS for Government is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
34. Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerabilities
BugTraq ID: 31346
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31346
Summary:
The Mozilla Foundation has released multiple security advisories specifying various vulnerabilities in Firefox 2.0.0.16 and prior versions, Firefox 3.0.1 and prior versions, Thunderbird 2.0.0.16 and prior versions, and SeaMonkey 1.1.11 and prior versions.
Exploiting these issues can allow attackers to:
- traverse directories
- obtain potentially sensitive information
- execute scripts with elevated privileges
- execute arbitrary code
- cause denial-of-service conditions
- carry out cross-site scripting attacks
- steal authentication credentials
- force users to download files
- violate the same-origin policy
Other attacks are also possible.
35. NMS DVD Burning SDK 'NMSDVDX.dll' ActiveX Control Arbitrary File Overwrite Vulnerability
BugTraq ID: 31374
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31374
Summary:
An ActiveX control in NMS DVD Burning SDK is prone to a vulnerability that lets attackers overwrite files with arbitrary, attacker-controlled content. The issue occurs because the control fails to sanitize user-supplied input.
Successful exploits will compromise affected computers and will aid in further attacks.
Numedia Soft NMS DVD Burning SDK 1.013C is vulnerable. Applications that use this framework may also be vulnerable.
36. TYPO3 freeCap CAPTCHA Unspecified Cross Site Scripting Vulnerability
BugTraq ID: 31370
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31370
Summary:
freeCap CAPTCHA (sr_freecap) for TYPO3 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to freeCap CAPTCHA 1.0.4 are vulnerable.
37. web-cp 'sendfile.php' Information Disclosure Vulnerability
BugTraq ID: 31371
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31371
Summary:
The 'web-cp' program is prone to an information-disclosure vulnerability because it fails to sufficiently sanitize user-supplied input data.
Exploiting the issue may allow the attacker to obtain sensitive information that could aid in further attacks.
This issue affects web-cp 0.5.7; other versions may also be vulnerable.
38. Google Chrome Carriage Return Remote Denial of Service Vulnerability
BugTraq ID: 31375
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31375
Summary:
Google Chrome is prone to a remote denial-of-service vulnerability because it fails to handle user-supplied input.
Attackers can exploit this issue to make the application unresponsive, denying service to legitimate users.
Google Chrome 0.2.149.29 and 0.2.149.30 are vulnerable; other versions may also be affected.
39. Connectra NGX 'index.php' Cross-Site Scripting Vulnerability
BugTraq ID: 31369
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31369
Summary:
Connectra NGX is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Connectra NGX R62 HFA_01, Hotfix 601, Builds 006 and 014 are vulnerable; other versions may also be affected.
40. PHPcounter 'defs.php' Local File Include Vulnerability
BugTraq ID: 31373
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31373
Summary:
PHPcounter is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.
PHPcounter 1.3.2 is vulnerable; other versions may also be affected.
41. ABB PCU400 'x87' Remote Buffer Overflow Vulnerability
BugTraq ID: 31391
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31391
Summary:
ABB PCU400 is used to control Supervisory Control And Data Acquisition (SCADA) systems.
ABB PCU400 is prone to a remote buffer overflow vulnerability.
The PCU400 'x87' executable version 3.5.5 is vulnerable; other versions may also be affected.
42. emergecolab 'index.php' Local File Include Vulnerability
BugTraq ID: 31372
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31372
Summary:
The 'emergecolab' program is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.
This issue affects emergecolab 1.0; other versions may also be affected.
43. Linux Kernel 'truncate()' Local Privilege Escalation Vulnerability
BugTraq ID: 31368
Remote: No
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31368
Summary:
The Linux kernel is prone to a local privilege-escalation vulnerability related to the 'truncate()' and 'ftruncate()' functions.
Versions prior to Linux kernel 2.6.22-rc1 are vulnerable.
44. AJ Auction Pro Platinum Skin #2 'detail.php' SQL Injection Vulnerability
BugTraq ID: 31362
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31362
Summary:
AJ Auction Pro Platinum Skin #2 is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
45. WebPortal CMS 'index.php' Remote Code Execution Vulnerability
BugTraq ID: 31353
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31353
Summary:
WebPortal CMS is prone to a vulnerability that lets remote attackers execute arbitrary code because the application fails to sanitize user-supplied input.
An attacker can leverage this issue to execute arbitrary PHP code on an affected computer with the privileges of the webserver process. This may facilitate a remote compromise of the affected computer.
This issue affects WebPortal CMS 0.7.4; other versions may also be affected.
46. Jetik.net ESA 'KayitNo' Parameter Multiple SQL Injection Vulnerabilities
BugTraq ID: 31352
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31352
Summary:
ESA is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ESA 2.0 is vulnerable; other versions may also be affected.
47. osCMax 'test.html' Arbitrary File Upload Vulnerability
BugTraq ID: 31351
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31351
Summary:
osCMax is prone to a vulnerability that lets remote attackers upload and execute arbitrary script code on an affected computer with the privileges of the webserver process. The issue occurs because the application fails to sanitize user-supplied input.
osCMax 2.0 is vulnerable; other versions may also be affected.
48. InterTech WCMS 'etemplate.php' SQL Injection Vulnerability
BugTraq ID: 31350
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31350
Summary:
InterTech Web Content Management System (WCMS) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
49. Microsoft Office OneNote URL Handler Remote Code Execution Vulnerability
BugTraq ID: 31067
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31067
Summary:
Microsoft Office OneNote is prone to a remote code-execution vulnerability.
An attacker could exploit this issue by enticing a victim to follow maliciously crafted URIs.
Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.
50. Microsoft Windows Media Player SSPL File Sample Rate Remote Code-Execution Vulnerability
BugTraq ID: 30550
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30550
Summary:
Microsoft Windows Media Player is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.
NOTE: Supported editions of Windows Server 2008 are not affected if installed using the Server Core installation option.
51. Microsoft GDI+ BMP Integer Overflow Vulnerability
BugTraq ID: 31022
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31022
Summary:
Microsoft GDI+ is prone to an integer-overflow vulnerability.
An attacker can exploit this issue by enticing unsuspecting users to view a malicious BMP file.
Successfully exploiting this issue allows remote attackers to corrupt memory and execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
52. Microsoft GDI+ WMF Image File Buffer Overflow Vulnerability
BugTraq ID: 31021
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31021
Summary:
Microsoft GDI+ is prone to a buffer-overflow vulnerability because the vector graphics linked library improperly allocates memory when parsing WMF image files.
Successfully exploiting this issue would allow an attacker to corrupt memory and execute arbitrary code in the context of the currently logged-in user.
53. Microsoft GDI+ GIF File Parsing Remote Code Execution Vulnerability
BugTraq ID: 31020
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31020
Summary:
Microsoft GDI+ is prone to a remote code-execution vulnerability because the vector graphics link library improperly parses GIF image files.
An attacker could exploit this issue to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts may crash applications that use the library.
54. Microsoft GDI+ EMF Image Processing Memory Corruption Vulnerability
BugTraq ID: 31019
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31019
Summary:
Microsoft GDI+ is prone to a remote memory-corruption vulnerability that occurs when an application that uses the library tries to process a specially crafted EMF (Enhanced Metafile) image file.
Successfully exploiting this issue would allow an attacker to execute arbitrary code in the context of the currently logged-in user.
55. Microsoft Windows Media Encoder 9 'wmex.dll' ActiveX Control Remote Buffer Overflow Vulnerability
BugTraq ID: 31065
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31065
Summary:
The Microsoft Windows Media Encoder 9 ActiveX control is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the context of an application using the affected ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
56. Microsoft GDI+ VML Heap-Based Buffer Overflow Vulnerability
BugTraq ID: 31018
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31018
Summary:
Microsoft GDI+ is prone to a heap-based buffer-overflow vulnerability because the vector graphics link library improperly processes gradient sizes.
Successfully exploiting this issue would allow an attacker to corrupt heap memory and execute arbitrary code in the context of the currently logged-in user.
57. Ol' Bookmarks Multiple Input Validation Vulnerabilities
BugTraq ID: 31348
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31348
Summary:
Ol' Bookmarks is prone to multiple vulnerabilities, including multiple local file-include issues and a remote file-include issue, because it fails to sufficiently sanitize user-supplied data.
Successful exploits of these vulnerabilities may allow attackers to view files and to execute remote and local scripts in the context of the webserver process.
These issues affect Ol' Bookmarks 0.7.5 and prior versions.
58. X.Org X Server MIT-SHM Extension Information Disclosure Vulnerability
BugTraq ID: 29669
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/29669
Summary:
X.Org X Server is prone to an information-disclosure vulnerability that lets X clients read arbitrary X server memory.
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
59. X.Org X server RENDER Extension Multiple Integer Overflow Vulnerabilities
BugTraq ID: 29670
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/29670
Summary:
The RENDER component for X Server is prone to multiple integer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.
Successful exploits may allow attackers to execute arbitrary code with the privileges of a user running the software. Failed exploit attempts likely cause denial-of-service conditions.
60. X.Org X Server RENDER Extension 'ProcRenderCreateCursor()' Denial of Service Vulnerability
BugTraq ID: 29665
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/29665
Summary:
X.Org X Server is prone to a denial-of-service vulnerability because the software fails to properly handle exceptional conditions.
Attackers who can connect to a vulnerable X Server may exploit this issue to crash the targeted server, denying further service to legitimate users.
61. RETIRED: Microsoft September 2008 Advance Notification Multiple Vulnerabilities
BugTraq ID: 31014
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31014
Summary:
Microsoft has released advance notification that the vendor will be releasing four security bulletins on September 9, 2008. The highest severity rating for these issues is 'Critical'.
Successfully exploiting these issues may allow remote or local attackers to compromise affected computers.
The following individual records have been created to better document these issues:
30550 Microsoft Windows Media Player SSPL File Sample Rate Remote Code-Execution Vulnerability
31065 Microsoft Windows Media Encoder 9 'wmex.dll' ActiveX Control Remote Buffer Overflow Vulnerability
31018 Microsoft Windows GDI+ VML Heap-Based Buffer Overflow Vulnerability
31019 Microsoft GDI+ EMF Image Processing Memory Corruption Vulnerability
31020 Microsoft GDI+ GIF File Parsing Remote Code Execution Vulnerability
31021 Microsoft GDI+ WMF Image File Buffer Overflow Vulnerability
31022 Microsoft GDI+ BMP Integer Overflow Vulnerability
31067 Microsoft Office OneNote URL Handler Remote Code Execution Vulnerability
62. Greatclone Hotscripts Clone 'showcategory.php' SQL Injection Vulnerability
BugTraq ID: 31345
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31345
Summary:
Hotscripts Clone is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
63. Mantis Insecure Cookie Disclosure Weakness
BugTraq ID: 31344
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31344
Summary:
Mantis is prone to a cookie-disclosure weakness.
An attacker may leverage this issue to obtain sensitive information, steal cookie-based authentication credentials, and carry out session-hijacking attacks; other attacks are also possible.
64. JETIK-WEB 'sayfa.php' SQL Injection Vulnerability
BugTraq ID: 31343
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31343
Summary:
JETIK-WEBis prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
65. BitlBee Unspecified Security Bypass Variant Vulnerability
BugTraq ID: 31342
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31342
Summary:
BitlBee is prone to an unspecified security-bypass vulnerability.
Successfully exploiting this issue may allow attackers to recreate or hijack user accounts on the system. Gaining access to these accounts may aid in further attacks.
Versions prior to BitlBee 1.2.3 are vulnerable.
NOTE: This issue is similar to the vulnerability discussed in BID 30858 (BitlBee Unspecified Security Bypass Vulnerability) and may be caused by an incomplete fix for that issue.
66. Symantec Veritas NetBackup Java Administration GUI Remote Privilege Escalation Vulnerability
BugTraq ID: 31221
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31221
Summary:
Symantec Veritas NetBackup Server and Symantec Veritas NetBackup Enterprise Server are prone to a remote privilege escalation vulnerability that occurs in the Java administration GUI (jnbSA).
Remote authorized attackers who have access to the GUI can exploit this issue to execute arbitrary commands with elevated privileges. Successfully exploiting this issue may compromise the affected computer.
67. Sofi WebGUI 'modstart.php' Remote File Include Vulnerability
BugTraq ID: 31341
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31341
Summary:
Sofi WebGUI is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
Sofi WebGUI 0.6.0.pre-release-3 is vulnerable; other versions may also be affected.
68. Apple Mac OS X Java Applet HMAC Provider Handling Remote Code Execution Vulnerability
BugTraq ID: 31379
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31379
Summary:
Apple Mac OS X is prone to a vulnerability that lets attackers run arbitrary code because the software fails to properly handle Java applets containing malicious values in the Hash-based Message Authentication Code (HMAC) provider.
Successful exploits will allow an attacker to run arbitrary code in the context of the affected software. Failed exploit attempts may result in denial-of-service conditions.
This issue affects the following:
Mac OS X 10.5.5 (and prior versions)
Mac OS X Server 10.5.5 (and prior versions)
Mac OS X 10.4.11 (and prior versions)
Mac OS X Server 10.4.11 (and prior versions)
69. Apple Mac OS X Java Plug-in 'file://' URL Handling Remote Code Execution Vulnerability
BugTraq ID: 31380
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31380
Summary:
Apple Mac OS X Java plug-in is prone to a remote code-execution vulnerability.
An attacker can exploit this issue by enticing an unsuspecting victim to visit a malicious webpage containing crafted Java applets.
Successfully exploiting this issue will allow attackers to run arbitrary code by launching arbitrary executables within the context of the affected application.
This issue affects Mac OS X 10.5.5 (and prior versions) and Mac OS X Server 10.5.5 (and prior versions).
70. Sun Java Runtime Environment XML Data Processing Multiple Vulnerabilities
BugTraq ID: 30143
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30143
Summary:
Sun Java Runtime Environment is prone to multiple remote vulnerabilities.
An attacker can exploit these issues to obtain sensitive information or crash the affected application, denying service to legitimate users.
These issues affect the following versions on Solaris, Linux, and Windows platforms:
JDK and JRE 6 Update 6 and earlier
JDK and JRE 5.0 Update 15 and earlier
71. Sun Java Runtime Environment Font Processing Buffer Overflow Vulnerability
BugTraq ID: 30147
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30147
Summary:
Sun Java Runtime Environment is prone to a buffer-overflow vulnerability when running untrusted applications or applets.
Successful exploits may allow attackers to read, write, or execute arbitrary local files in the context of the user running an untrusted application. This may result in a compromise of the underlying system.
This issue affects the following versions on Solaris, Windows, and Linux:
JDK and JRE 5.0 Update 9 and earlier
SDK and JRE 1.4.2_17 and earlier
SDK and JRE 1.3.1_22 and earlier
72. Sun Java SE Secure Static Versioning Applet Execution Weakness
BugTraq ID: 30142
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30142
Summary:
Sun JDK and JRE are prone to a weakness that may allow arbitrary applets to run on older releases of the software. This issue may lead to various attacks.
An attacker may exploit this weakness to potentially leverage vulnerabilities that may reside in older releases of the applications. This can lead to various attacks, depending on the presence of vulnerabilities in the older release of JDK/JRE on the vulnerable computer.
This issue affects the following versions on Windows VISTA:
JDK and JRE 6 Update 6 and earlier
JDK and JRE 5.0 Update 6 through 15
73. Sun Java Runtime Environment Virtual Machine Privilege Escalation Vulnerability
BugTraq ID: 30141
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30141
Summary:
Sun Java Runtime Environment Virtual Machine is prone to a privilege-escalation vulnerability when running untrusted applications or applets.
Successful exploits may allow attackers to read, write, or execute arbitrary local files in the context of the user running an untrusted application in the affected virtual machine. This may result in a compromise of the underlying system.
This issue affects the following versions:
JDK and JRE 6 Update 6 and earlier
JDK and JRE 5.0 Update 15 and earlier
SDK and JRE 1.4.2_17 and earlier
74. Sun Java SE Java Management Extensions (JMX) Unspecified Unauthorized Access Vulnerability
BugTraq ID: 30146
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30146
Summary:
JMX is prone to an unspecified unauthorized-access vulnerability.
The vulnerability allows a JMX client to perform unauthorized actions on a computer running JMX with local monitoring enabled.
The issue affects the following versions for Windows, Solaris, and Linux:
JDK and JRE 6 Update 6 and earlier
JDK and JRE 5.0 Update 15 and earlier
75. Sun Java Runtime Environment Multiple Security Vulnerabilities
BugTraq ID: 30144
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30144
Summary:
A privilege-escalation issue and an information-disclosure issue affect multiple implementations of Java Runtime Environment (JRE).
Sun has released an advisory addressing these vulnerabilities in the following software:
JDK and JRE 6 Update 6 and earlier.
76. Sun Java Web Start Multiple Vulnerabilities
BugTraq ID: 30148
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30148
Summary:
Sun Java Web Start is prone to multiple vulnerabilities, including buffer-overflow, privilege-escalation, and information-disclosure issues.
Successful exploits may allow attackers to execute arbitrary code, obtain information, or read, write, and execute arbitrary local files in the context of the user running a malicious Web Start application. This may result in a compromise of the underlying system.
This issue affects the following versions:
JDK and JRE 6 Update 6 and earlier
JDK and JRE 5.0 Update 15 and earlier
SDK and JRE 1.4.2_17 and earlier
77. Sun Java Runtime Environment Image Parsing Heap Buffer Overflow Vulnerability
BugTraq ID: 28125
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/28125
Summary:
Sun Java Runtime Environment is prone to a heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely crash the application.
This issue affects the following products and versions:
JDK and JRE 6 prior to Update 5
JDK and JRE 5.0 prior to Update 15
SDK and JRE prior to 1.4.2_17
SDK and JRE prior to 1.3.1_22
This vulnerability was previously covered in BID 28083 (Sun Java SE Multiple Security Vulnerabilities), but has been given its own record to better document the issue.
78. Sun Java Runtime Environment Multiple Unspecified Same Origin Policy Violation Vulnerabilities
BugTraq ID: 30140
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30140
Summary:
Sun Java Runtime Environment is prone to multiple unspecified vulnerabilities that allow attackers to bypass the same-origin policy. This issue occurs because the application fails to properly enforce the same-origin policy for Java applets.
An attacker may create a malicious applet that is loaded from a remote system to circumvent network access restrictions.
The following are affected:
JDK and JRE 6 Update 6 and earlier
JDK and JRE 5.0 Update 15 and earlier
SDK and JRE 1.4.2_17 and earlier
SDK and JRE 1.3.x_22 and earlier
79. Sun Java SE Multiple Security Vulnerabilities
BugTraq ID: 28083
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/28083
Summary:
Sun has released advisories addressing multiple vulnerabilities affecting the following software:
JDK and JRE 6 Update 5
JDK and JRE 5.0 Update 15
SDK and JRE 1.4.2_17
SDK and JRE 1.3.1_22
80. Linux Kernel 'snd_seq_oss_synth_make_info()' Information Disclosure Vulnerability
BugTraq ID: 30559
Remote: No
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30559
Summary:
The Linux kernel is prone to an information-disclosure vulnerability.
Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks.
Versions prior to Linux kernel 2.6.27-rc2 are vulnerable.
81. Blender Unspecified Insecure Temporary File Creation Vulnerability
BugTraq ID: 28936
Remote: No
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/28936
Summary:
Blender creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.
82. Blender 'radiance_hdr.c' Remote Buffer Overflow Vulnerability
BugTraq ID: 28870
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/28870
Summary:
Blender is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
The issue affects Blender 2.45; other versions may also be affected.
83. Peachtree Accounting 'PAWWeb11.ocx' ActiveX Control Insecure Method Vulnerability
BugTraq ID: 31096
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31096
Summary:
The Peachtree Accounting 'PAWWeb11.ocx' ActiveX control is prone to an insecure-method vulnerability.
Successfully exploiting this issue allows remote attackers to launch arbitrary applications with the privileges of the application running the ActiveX control (typically Internet Explorer).
The issue affects Peachtree Accounting 2004; other versions may also be affected.
84. Symantec Backup Exec Scheduler ActiveX Control Multiple Arbitrary File Overwrite Vulnerabilities
BugTraq ID: 28008
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/28008
Summary:
Symantec Backup Exec is prone to multiple vulnerabilities that allow attackers overwrite arbitrary files.
An attacker can exploit these issues by enticing an unsuspecting victim to view a malicious HTML page.
Successfully exploiting these issues will allow the attacker to corrupt and overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).
85. Linux Kernel UBIFS Orphan Inode Local Denial of Service Vulnerability
BugTraq ID: 30647
Remote: No
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/30647
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability affecting the VFS behavior in UBIFS (UBI File System).
Attackers can exploit this issue to cause the kernel to crash, denying service to legitimate users.
86. Mass Downloader Malformed Executable Denial Of Service Vulnerability
BugTraq ID: 31406
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31406
Summary:
Mass Downloader is prone to a remote denial-of-service vulnerability.
Exploiting this issue allows remote attackers to crash the application and trigger denial-of-service conditions, denying further service to legitimate users. Given the nature of this issue, code execution may be possible, but this has not been confirmed.
Mass Downloader 2.6 is vulnerable; other versions may also be affected.
87. PHP infoBoard 'idcat' Parameter SQL Injection and HTML Injection Vulnerabilities
BugTraq ID: 31405
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31405
Summary:
PHP infoBoard is prone to multiple input-validation vulnerabilities, including an SQL-injection issue and an HTML-injection issue.
Attackers can exploit these issues to steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHP infoBoard 7.0 is vulnerable; other versions may also be affected.
88. PHP infoBoard Cookie Authentication Bypass Vulnerability
BugTraq ID: 31404
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31404
Summary:
PHP infoBoard is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.
An attacker can exploit this vulnerability to gain administrative access to the affected application; other attacks are also possible.
PHP infoBoard 7.0 is vulnerable; other versions may also be affected.
89. Libra File Manager 'fileadmin.php' Local File Include Vulnerability
BugTraq ID: 31403
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31403
Summary:
Libra File Manager is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.
Libra File Manager 1.18 is vulnerable; other versions may also be affected.
90. Lansuite 'design' Parameter Local File Include Vulnerability
BugTraq ID: 31402
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31402
Summary:
Lansuite is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.
Lansuite 3.4 beta r1363 is vulnerable; other versions may also be affected.
91. EasyRealtorPRO 'site_search.php' Multiple SQL Injection Vulnerabilities
BugTraq ID: 31401
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31401
Summary:
EasyRealtorPRO is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
92. K-Lite Mega Codec Pack 'vsfilter.dll' Denial Of Service Vulnerability
BugTraq ID: 31400
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31400
Summary:
K-Lite Mega Codec pack is prone to a denial-of-service vulnerability. The problem occurs when the 'vsfilter.dll' library is installed on the affected computer.
Attackers can exploit this issue to cause Windows Explorer to crash, denying service to legitimate users.
93. Microsoft WordPad '.doc' File Remote Denial of Service Vulnerability
BugTraq ID: 31399
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31399
Summary:
WordPad is prone to a remote denial-of-service vulnerability.
Attackers can exploit this issue by enticing an unsuspecting victim to open a specially crafted .doc file.
Successfully exploiting this issue will cause the application to crash, denying service to legitimate users. Arbitrary code execution may also be possible; this has not been confirmed.
94. PHP 'create_function()' Code Injection Weakness
BugTraq ID: 31398
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31398
Summary:
PHP is prone to a code injection weakness as it fails to sufficiently sanitize input to 'create_function()'. Note that the anonymous function returned need not be called for the supplied code to be executed.
An attacker able to exploit this weakness will be able to execute code with the privilege of an additional vulnerable program.
This weakness is reported in PHP 5.2.6; other versions may also be affected.
95. Mozilla Firefox/SeaMonkey UTF-8 Stack-Based Buffer Overflow Vulnerability
BugTraq ID: 31397
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31397
Summary:
Mozilla Firefox and SeaMonkey are prone to a stack-based buffer-overflow vulnerability.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
Versions prior to Firefox 2.0.0.17 and prior to SeaMonkey 1.1.12 are vulnerable.
NOTE: This issue was originally documented in BID 31346 (Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerabilities). It has been given its own record to better document the details.
96. Bitweaver Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 31395
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31395
Summary:
Bitweaver is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Bitweaver 2.0.2 is vulnerable; other versions may also be affected.
97. Vikingboard 'upload/index.php' Local File Include Vulnerability
BugTraq ID: 31393
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31393
Summary:
Vikingboard is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.
Vikingboard 0.2 Beta is vulnerable; other versions may also be affected.
98. phpOCS 'index.php' Local File Include Vulnerability
BugTraq ID: 31392
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31392
Summary:
phpOCS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.
phpOCS 0.1-beta3 is vulnerable; other versions may also be affected.
99. AJ Auction Pro SQL Injection and Cross Site Scripting Vulnerabilities
BugTraq ID: 31390
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31390
Summary:
AJ Auction Pro is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
100. Drupal Stock 'stock quote' Page Authentication Bypass Vulnerability
BugTraq ID: 31389
Remote: Yes
Last Updated: 2008-09-25
Relevant URL: http://www.securityfocus.com/bid/31389
Summary:
The Stock module for Drupal is prone to an authentication-bypass vulnerability.
Attackers can exploit this issue to gain unauthorized access to certain portions of the affected application. Successfully exploiting this issue may allow attackers to execute arbitrary script code within the context of the web browser and steal cookie-based authentication credentials.
http://drupal.org/node/207891
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Security of Google's browser gets mixed marks
By: Robert Lemos
The search giant uses process isolation, least privilege rules, and sandboxing as the security foundation for its Chrome browser, but security experts say more is needed.
http://www.securityfocus.com/news/11533
2. Online intruders hit Red Hat, Fedora Project
By: Robert Lemos
A leading Linux company and its open-source distribution acknowledge that attackers breached several systems, including one that manages the Fedora signing process.
http://www.securityfocus.com/news/11532
3. Researchers race to zero in record time
By: Robert Lemos
On the first day, three teams of security professional finished the Race to Zero contest, successfully modifying nine well-known viruses and exploits to escape detection by major antivirus engines.
http://www.securityfocus.com/news/11531
4. Gov't charges alleged TJX credit-card thieves
By: Robert Lemos
U.S. prosecutors charge eleven people with taking part in an identity-theft ring that stole millions of credit-card accounts from major retailers, among them TJX Companies.
http://www.securityfocus.com/news/11530
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Account Manager, Ottawa
http://www.securityfocus.com/archive/77/496663
2. [SJ-JOB] Security Engineer, Waukegan
http://www.securityfocus.com/archive/77/496665
3. [SJ-JOB] Penetration Engineer, London
http://www.securityfocus.com/archive/77/496667
4. [SJ-JOB] Sales Engineer, Minneapolis
http://www.securityfocus.com/archive/77/496657
5. [SJ-JOB] Customer Service, St Paul
http://www.securityfocus.com/archive/77/496662
6. [SJ-JOB] Account Manager, Nashville
http://www.securityfocus.com/archive/77/496664
7. [SJ-JOB] Sales Engineer, New York
http://www.securityfocus.com/archive/77/496666
8. [SJ-JOB] Sales Engineer, New York
http://www.securityfocus.com/archive/77/496650
9. [SJ-JOB] Senior Software Engineer, Suitland
http://www.securityfocus.com/archive/77/496652
10. [SJ-JOB] Security System Administrator, Madison, NY or New Jersey
http://www.securityfocus.com/archive/77/496653
11. [SJ-JOB] Information Assurance Engineer, San Diego
http://www.securityfocus.com/archive/77/496655
12. [SJ-JOB] Application Security Architect, Portsmouth
http://www.securityfocus.com/archive/77/496660
13. [SJ-JOB] Sales Engineer, Boston
http://www.securityfocus.com/archive/77/496661
14. [SJ-JOB] Security Auditor, Cheltenham
http://www.securityfocus.com/archive/77/496649
15. [SJ-JOB] Security Researcher, Beaverton
http://www.securityfocus.com/archive/77/496651
16. [SJ-JOB] Sales Engineer, Atlanta
http://www.securityfocus.com/archive/77/496656
17. [SJ-JOB] Incident Handler, Washington
http://www.securityfocus.com/archive/77/496658
18. [SJ-JOB] Application Security Architect, Columbia
http://www.securityfocus.com/archive/77/496659
19. [SJ-JOB] Application Security Engineer, Ft.Lauderdale
http://www.securityfocus.com/archive/77/496643
20. [SJ-JOB] Security Engineer, New york
http://www.securityfocus.com/archive/77/496645
21. [SJ-JOB] Security Consultant, Reading
http://www.securityfocus.com/archive/77/496646
22. [SJ-JOB] VP, Information Security, Baltimore
http://www.securityfocus.com/archive/77/496648
23. [SJ-JOB] Director, Information Security, Portsmouth
http://www.securityfocus.com/archive/77/496640
24. [SJ-JOB] Management, San Jose
http://www.securityfocus.com/archive/77/496641
25. [SJ-JOB] Sales Engineer, Raleigh
http://www.securityfocus.com/archive/77/496642
26. [SJ-JOB] Manager, Information Security, Pune
http://www.securityfocus.com/archive/77/496644
27. [SJ-JOB] Sales Engineer, Atlanta
http://www.securityfocus.com/archive/77/496647
28. [SJ-JOB] Sr. Security Analyst, Aurora
http://www.securityfocus.com/archive/77/496639
V. INCIDENTS LIST SUMMARY
---------------------------
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Is the memory map of a process different when executed in GDB?
http://www.securityfocus.com/archive/82/496612
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.
XI. SPONSOR INFORMATION
------------------------
Download a FREE trial of HP WebInspect
Application attacks are growing more prevalent. New attacks are in the news each day. Now it's time for you to assess your applications and start detecting and removing vulnerabilities.
HP can help, with a full suite of application security solutions. Get started today with a complimentary trial download that uses an HP test application. Thoroughly analyze today's complex web applications in a runtime environment with fast scanning capabilities, broad assessment coverage and accurate web application scanning results.
Download WebInspect now: https://h10078.www1.hp.com/cda/hpdc/navigation.do?action=downloadBinStart&zn=bto&cp=54_4012_100__&caid=14563&jumpid=ex_r11374_us/en/large/tsg/WebInspect_Eval_Security_Focus/3-1QN6MIF_3-UTM2ZJ/20080920&origin_id=3-1QN6MIF
No comments:
Post a Comment