• Gitorious Remote Command Execution - Gitorious versions prior to 2.1.1 suffer from a remote command execution vulnerability.
• HP Diagnostics Server magentservice.exe Overflow - This Metasploit module exploits a stack buffer overflow in HP Diagnostics Server magentservice.exe service. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. Originally found and posted by AbdulAziz Harir via ZDI.
• MS12-004 midiOutPlayNextPolyEvent Heap Overflow - This Metasploit module exploits a heap overflow vulnerability in the Windows Multimedia Library (winmm.dll). The vulnerability occurs when parsing specially crafted MIDI files. Remote code execution can be achieved by using Windows Media Player's ActiveX control. Exploitation is done by supplying a specially crafted MIDI file with specific events, causing the offset calculation being higher than how much is available on the heap (0x400 allocated by WINMM!winmmAlloc), and then allowing us to either "inc al" or "dec al" a byte. This can be used to corrupt an array (CImplAry) we setup, and force the browser to confuse types from tagVARIANT objects, which leverages remote code execution under the context of the user. At this time, for IE 8 target, JRE (Java Runtime Environment) is required to bypass DEP (Data Execution Prevention). Note: Based on our testing, the vulnerability does not seem to trigger when the victim machine is operated via rdesktop.
• AWS Hash Collisions - AdaCore Security Advisory - All AWS releases and wavefronts prior to 2012-01-21 suffer from hash collision vulnerabilities.
• Studio Manolibera Listarivisteuk SQL Injection - Studio Manolibera's listarivisteuk.php suffers from a remote SQL injection vulnerability.
• Dark D0rk3r 0.5 - Dark D0rk3r is a python script that performs dork searching and searches for local file inclusion and SQL injection errors.
• IBBY SQL Injection - IBBY's nouvelles.php suffers from a remote SQL injection vulnerability.
• Kraken Payload Generator Beta 1.0 - Kraken Payload Generator is a bash script that makes use of msfpayload to generate various shellcode.
• Fortigate UTM WAF Appliance Cross Site Scripting - The Fortigate UTM WAF appliance suffers from persistent and reflective cross site scripting vulnerabilities.
• Adobe Cross Site Scripting - Adobe's forgotten password flow suffers from a cross site scripting vulnerability.
• Gentoo Linux Security Advisory 201201-16 - Gentoo Linux Security Advisory 201201-16 - A debugging functionality in the X.Org X Server that is bound to a hotkey by default can be used by local attackers to circumvent screen locking utilities. Versions less than 2.4.1-r3 are affected.
• Debian Security Advisory 2396-1 - Debian Linux Security Advisory 2396-1 - Nicolae Mogoraenu discovered a heap overflow in the emulated e1000e network interface card of KVM, a solution for full virtualization on x86 hardware, which could result in denial of service or privilege escalation.
• Debian Security Advisory 2395-1 - Debian Linux Security Advisory 2395-1 - Laurent Butti discovered a buffer underflow in the LANalyzer dissector of the Wireshark network traffic analyzer, which could lead to the execution of arbitrary code.
• Interactive Web Design SQL Injection - Interactive Web Design suffers from a remote SQL injection vulnerability.
• Global Media Service SQL Injection - Global Media Service suffers from a remote SQL injection vulnerability.
...