jetlib.sec

Feeds

250728 items (0 unread) in 27 feeds

46 items tagged "view"

Related tags: hacks [+], street [+], google [+], sql [+], google street view [+], connection server [+], street view [+], sql injection [+], server [+], google street [+], vulnerable versions [+], tunnel server [+], php [+], facebook [+], digital [+], day [+], cameras [+], calendar [+], url [+], server directory [+], privilege [+], php addressbook [+], mark [+], home [+], escalation [+], cross site scripting [+], cms [+], article [+], addressbook [+], vulnerability [+], wiretap [+], webcat [+], viewphoto [+], view photo [+], view cars [+], view camera [+], view 3 [+], treadmill [+], transportation [+], traidnt [+], tool [+], thomas clauser [+], team [+], street legal [+], sql query [+], speedometer [+], smf [+], scrutiny [+], ruby [+], roadster [+], risk [+], quick [+], pulse [+], prompts [+], privacy code [+], photo [+], page [+], nvu [+], modelbook [+], mini [+], michael [+], magnet [+], lens [+], lego nxt [+], lego [+], leak [+], judge grants [+], jequoteform [+], indicator lights [+], ico warns [+], home controller [+], hijacking [+], high altitude balloons [+], hall effect sensors [+], google uk [+], gitmo [+], germany [+], gerber [+], gem environment [+], football [+], exploits [+], exercise [+], event [+], dll [+], directory traversal vulnerability [+], directory traversal [+], czech ing [+], controller code [+], controller [+], connection [+], com [+], clauser [+], candid view [+], candid [+], camera lens [+], camera [+], calendar component [+], bugtraq [+], bike control [+], bellows [+], appeal [+], ajax [+], vmware [+]

December 26, 2012
16:00
VMware View Connection Server Directory Traversal Vulnerability
» ‎ SecuriTeam

VMware View releases address a critical directory traversal vulnerability in the View Connection Server and View Security Server.
Tags: vmware server view directory-traversal-vulnerability connection-server server-directory

December 14, 2012
20:08
VMware View Connection Server Directory Traversal
» ‎ Packet Storm Security Advisories

The tunnel-server component of the VMware View Connection Server fails to ensure that each requested URL refers to a file that is both located within the web root of the server and is of a type that is allowed to be served. A remote unauthenticated attacker can use this weakness to retrieve arbitrary files from the affected server's underlying root file system. This can be accomplished by submitting URL encoded HTTP GET requests that traverse out of the affected subdirectory. Vulnerable versions are VMware View 5.x prior to version 5.1.2 and VMware View 4.x prior to version 4.6.2.
Tags: vmware server view connection-server tunnel-server vulnerable-versions

20:08
VMware View Connection Server Directory Traversal
» ‎ Packet Storm Security Recent Files

The tunnel-server component of the VMware View Connection Server fails to ensure that each requested URL refers to a file that is both located within the web root of the server and is of a type that is allowed to be served. A remote unauthenticated attacker can use this weakness to retrieve arbitrary files from the affected server's underlying root file system. This can be accomplished by submitting URL encoded HTTP GET requests that traverse out of the affected subdirectory. Vulnerable versions are VMware View 5.x prior to version 5.1.2 and VMware View 4.x prior to version 4.6.2.
Tags: vmware server view connection-server tunnel-server vulnerable-versions

20:08
VMware View Connection Server Directory Traversal
» ‎ Packet Storm Security Misc. Files

The tunnel-server component of the VMware View Connection Server fails to ensure that each requested URL refers to a file that is both located within the web root of the server and is of a type that is allowed to be served. A remote unauthenticated attacker can use this weakness to retrieve arbitrary files from the affected server's underlying root file system. This can be accomplished by submitting URL encoded HTTP GET requests that traverse out of the affected subdirectory. Vulnerable versions are VMware View 5.x prior to version 5.1.2 and VMware View 4.x prior to version 4.6.2.
Tags: vmware server view connection-server tunnel-server vulnerable-versions

13:00
Bugtraq: DDIVRT-2012-48 VMware View Connection Server Directory Traversal (CVE-2012-5978)
» ‎ SecurityFocus Vulnerabilities

DDIVRT-2012-48 VMware View Connection Server Directory Traversal (CVE-2012-5978)
Tags: vmware connection view connection-server server-directory directory-traversal

December 10, 2012
16:00
SMF 'view' Parameter Cross Site Scripting Vulnerability
» ‎ SecuriTeam

SMF is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.
Tags: view vulnerability smf cross-site-scripting

October 16, 2012
13:58
Basics of Rails Part 3
» ‎ Carnal0wnage
If you've been following along in this series you've already created a Rails application called "attackresearch, configured your Ruby/gem environment with RVM, and created a Rake task to start the application with Unicorn.

In this portion, we will create our first Rails page and configure the appropriate routes.

Now, first thing first, remove the index.html file located under the public directory:

Removing this file removes the new Rails application landing page as it is unecessary.
Fire up the server using the rake task created earlier in this series and browse to the site.

Uh-oh:
Why did this occur? Rails requires some direction from you, the developer. Where does the default or "root" page live and how do I get there?

Like any good map, you need to show a route. That being said, open config/routes.rb and take a look at what I mean:

Notice the comment? Each comment block provides instructions on mapping routes in various ways. You can delete them :-). Leave the first and last line (actual code) but remove the comments.

Now that we know where to map out the route to our destination, let's create a destination. The first thing we want to do is go to our terminal and enter the following (this only has to be done once):

Remember the twitter-bootstrap-rails gem we added in the first part of this series? We just installed it. This allows us to forego some CSS and HTML work and piggyback off those of the Twitter designers (thanks gals/guys).

Next, we will generate our first controller and view. As of right now, we don't necessarily require a model. First, here is a quick break down of MVC:
- Model - Used for handling data resources (databases, usually).
- View - Renders HTML content to users.
- Controller - Code that handles the bulk of the logic and decision making.
Generating a "Home" controller:

We used --skip-stylesheets as they are unnecessary when using twitter-bootstrap
Note that a new *View* folder was created app/views/home and a controller file "app/controllers/home_controller.rb".

One thing to be aware of. The name of your controller will have `_controller.rb` appended to it. This is the standard convention.

Time to make an entry in routes.rb. The first thing we need to define is a landing page so that if you request our URL, you have a starting page. We will call it "welcome". There are a few things that have to happen:
- Make an action inside the home controller called "welcome".
- Create a view page under the /app/views/home folder called "welcome.html.erb".
- Configure the route but since this is our first, we will simply use `root :to => "<controller>#<action>"
Note: Rails does not require code within the action (method), only that it exists.

Note: Only one root route can exist.

Time to edit the welcome.html.erb...

Note that the h1 tag is has a look and feel defined by the h1 definition in Twitter's CSS.
Welcome Page
..And with that we have a website, sort of. To recap we covered generating a controller and making a view page as well as adding the action with the home_controller called "welcome".

That last thing I'll cover before the next tutorial is the flow of a request. So when you request http://localhost/ this is what is happening.
1. The config/routes.rb file is checked to see where this request should go.
2. Since the request is for the root page '/', it is rerouted to the Home controller and Welcome action.
3. Immediately following any code executing in the Welcome action (none right now), the request finally lands on the view page or the last part in it's journey, welcome.html.erb.
Again, the flow is route -> controller -> view.

If you want to see what I mean, we can stop the flow from reaching the view stage by (welcome.html.erb) by rendering content at the controller. Observe:

Added the directive render :text => <some text> which stops the flow from reaching the view page and renders content itself.

The outcome of this change.

Thanks for following along, more to come in the next post as we dig a bit deeper with routes and the MVC.

~cktricky

Tags: view controller page ruby gem-environment home-controller controller-code

October 09, 2012
9:02
Teens pulled over while driving their wooden roadster
» ‎ Hack a Day

From this view we would think the handmade wooden roadster (translated) was street legal. But it’s missing a few items that are required to take it out on the highway. The teenagers that built it were pulled over the other night (translated) and cited for driving without a speedometer or side indicator lights. The image above shows the [...]
Tags: view roadster street indicator-lights street-legal speedometer transportation hacks

October 01, 2012
0:00
Vuln: VMware View URL Processing Cross-site Scripting Vulnerability
» ‎ SecurityFocus Vulnerabilities

VMware View URL Processing Cross-site Scripting Vulnerability
Tags: vmware url view vulnerability

July 29, 2012
17:00
WebCAT 'cms_view.php' Multiple SQL Injection Vulnerabilities
» ‎ SecuriTeam

WebCAT is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Tags: view webcat sql sql-injection sql-query

July 25, 2012
13:01
New cameras learning old lens tricks
» ‎ Hack a Day

[Michael H] tipped us off about this guide to using view camera lens parts with DSLR cameras and lenses. We weren’t familiar with the term ‘view camera’ but we certainly recognize the accordion-like bellows that define that type of camera. The idea is that modern cameras with their fixed lenses miss out on some types [...]
Tags: lens view camera michael view-camera camera-lens bellows digital cameras hacks

May 08, 2012
17:00
VMware View Manager Portal Cross-site Scripting Vulnerability
» ‎ SecuriTeam

VMware View is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
Tags: vmware vulnerability view cross-site-scripting

May 01, 2012
14:23
Google Street View Wi-Fi Data Slurper Named
» ‎ Packet Storm Security Headlines

Google Street View Wi-Fi Data Slurper Named
Tags: google street view google-street-view
April 18, 2012
0:45
Google Street View May Face Further Scrutiny
» ‎ Packet Storm Security Headlines

Google Street View May Face Further Scrutiny
Tags: google street view google-street-view scrutiny

April 17, 2012
16:01
View Gerber files in 3d in your browser
» ‎ Hack a Day

[Mark] wrote in, eager to show off this new tool he’s created to view your gerber files in 3d. He also wrote an instructible to go along with it, to help you figure out how to use the tool. Being an in-browser tool also means you can shoot it to your friends for a quick [...]
Tags: tool gerber view mark hacks

March 16, 2012
14:00
Bugtraq: VMSA-2012-0004 VMware View privilege escalation and cross-site scripting
» ‎ SecurityFocus Vulnerabilities

VMSA-2012-0004 VMware View privilege escalation and cross-site scripting
Tags: vmware privilege view escalation
0:00
Vuln: VMware View Privilege Escalation Vulnerabilities
» ‎ SecurityFocus Vulnerabilities

VMware View Privilege Escalation Vulnerabilities
Tags: vmware privilege view escalation

February 13, 2012
16:36
Facebook View My Calendar SQL Injection
» ‎ Packet Storm Security Exploits

Facebook View My Calendar suffers from a remote SQL injection vulnerability.
Tags: facebook calendar view vulnerability

16:36
Facebook View My Calendar SQL Injection
» ‎ Packet Storm Security Recent Files

Facebook View My Calendar suffers from a remote SQL injection vulnerability.
Tags: facebook calendar view vulnerability

16:36
Facebook View My Calendar SQL Injection
» ‎ Packet Storm Security Misc. Files

Facebook View My Calendar suffers from a remote SQL injection vulnerability.
Tags: facebook calendar view vulnerability

December 10, 2011
11:13
View Article Blind SQL Injection
» ‎ Packet Storm Security Recent Files

View Article suffers from a remote blind SQL injection vulnerability.
Tags: article sql view sql-injection vulnerability

11:13
View Article Blind SQL Injection
» ‎ Packet Storm Security Misc. Files

View Article suffers from a remote blind SQL injection vulnerability.
Tags: article sql view sql-injection vulnerability

September 05, 2011
14:01
Czech-ing out the view from 31 kilometers
» ‎ Hack a Day

The team at czANZO, the Czech Amateur Near-Space Object group, sent up one of the best high-altitude balloons we’ve ever seen last weekend and the resulting video is remarkable. The team’s build blog (Google Translate link for everyone without Chrome) goes through the design and construction of their payload. Like every other balloon build we’ve [...]
Tags: view team czech-ing high-altitude-balloons google digital cameras hacks

August 16, 2011
8:35
Street View Wi-Fi Collection Incident Could Happen Again, ICO Warns
» ‎ Packet Storm Security Headlines

Street View Wi-Fi Collection Incident Could Happen Again, ICO Warns
Tags: street view ico-warns street-view

July 27, 2011
15:00
Bugtraq: FootBall Cms (view_table_lig.php?group) XSS Vulnerability
» ‎ SecurityFocus Vulnerabilities

FootBall Cms (view_table_lig.php?group) XSS Vulnerability
Tags: view cms football bugtraq vulnerability

July 19, 2011
7:50
Judge Grants Google Street View Wiretap Appeal
» ‎ Packet Storm Security Headlines

Judge Grants Google Street View Wiretap Appeal
Tags: wiretap appeal view judge-grants google-street google-street-view google

June 20, 2011
5:05
Mini Google Street View car built from Lego
» ‎ Hack a Day

[Mark] was playing around with a small GPS sensor when a light bulb lit over his head. He imagined it would be pretty cool to replicate one of Google’s Street View cars at a fraction of the scale using Lego NXT parts. He figured it would be easy enough to rig a few cameras to [...]
Tags: lego mini view mark google-street google-street-view lego-nxt view-cars digital cameras hacks

June 17, 2011
21:00
[local exploits] - Nvu (N-view) Html-Builder v1.0 DLL Hijacking Exploit (js3250.dll)
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

[local exploits] - Nvu (N-view) Html-Builder v1.0 DLL Hijacking Exploit (js3250.dll)
Tags: view dll nvu hijacking exploits
June 03, 2011
21:00
[webapps / 0day] - PHP-AddressBook v6.2.12 (view.php) SQL Injection Vulnerability
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

[webapps / 0day] - PHP-AddressBook v6.2.12 (view.php) SQL Injection Vulnerability
Tags: php-addressbook view day addressbook vulnerability
21:00
[webapps / 0day] - PHP-AddressBook v6.2.12 (view.php) SQL Injection Vulnerability
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

[webapps / 0day] - PHP-AddressBook v6.2.12 (view.php) SQL Injection Vulnerability
Tags: php-addressbook view day addressbook vulnerability
May 08, 2011
21:00
[webapps / 0day] - Traidnt UP (view.php) SQL Injection Vulnerability
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

[webapps / 0day] - Traidnt UP (view.php) SQL Injection Vulnerability
Tags: view day traidnt vulnerability

April 25, 2011
7:18
Gitmo Leak Reveals View Of Detainees' Risk
» ‎ Packet Storm Security Headlines

Gitmo Leak Reveals View Of Detainees' Risk
Tags: leak gitmo view risk
December 20, 2010
14:02
Google UK Street View Wi-Fi Data Deleted
» ‎ Packet Storm Security Headlines

Google UK Street View Wi-Fi Data Deleted
Tags: google street view google-uk street-view

November 04, 2010
10:00
Quick and easy Street View treadmill
» ‎ Hack a Day

This is [Thomas Clauser's] Google Street View enabled treadmill. He points out that most of the Street View hacks use a measurement of rotational movement to interface with a computer. He respects that but didn’t want to take the time to make it work with his treadmill. Instead, he used a stealth switch propped up [...]
Tags: quick treadmill view thomas-clauser google-street google-street-view clauser google home hacks
October 29, 2010
11:01
Exercise along to Google Street View
» ‎ Hack a Day

As part of a Master’s Thesis [Lette Moloney] made this exercise bike control Google Street View. The hardware setup is quite rudimentary, two hall effect sensors mounted next to each other detect a magnet that was hot-glued to the crank. When the magnet passes the sensors an Arduino establishes if it was a forward or [...]
Tags: magnet exercise view google-street hall-effect-sensors bike-control street-view home hacks