Cisco Systems Cross Site Scripting

. / \ | |/ / / /\ | |\ \ / | \ |/ \ | // / / / Corporation c 2014 CISCO Systems Inc. Security Report ============================================================ Published Report: 19/02/2014 Credits: Advanced Information Security Corporation, USA Severity: High/Critical OWASP TOP 10 CVSS: 7.0...

[SecLists] Collection of multiple types of lists used during security assessments

SecLists is a collection of multiple types of lists used during security assessments. List types include usernames, passwords, URLs, sensitive data grep strings, fuzzing payloads, and many more. The goal is to enable a security tester to pull this repo onto a new testing box and have access to...

Assessing risk for the February 2014 security updates

Today we released seven security bulletins addressing 31 unique CVE’s. Four bulletins have a maximum severity rating of Critical while the other three have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for you...

Realistic Risk Assessment Key to Security Management

PUNTA CANA – Although it may not be the most thrilling part of a security team’s job, the idea of operational risk assessment and management is perhaps the most important aspect of organizational security. Steve Adegbite, senior vice president in charge of enterprise information security program...

Senators Question Intelligence Officials About Snowden, Domestic Surveillance

In a hearing before the Senate Intelligence Committee to discuss the public portions of a new national security threat assessment, top intelligence and law enforcement officials said that attacks against financial networks and the critical infrastructure are major threats to the United States’...

[IPv6 Toolkit v1.5.2] A security assessment and troubleshooting tool for the IPv6 protocols

A security assessment and troubleshooting tool for the IPv6 protocols. Changelog v1.5.2 Add support for GNU Debian/kfreebsd. The toolkit would not build on GNU Debian/kfreebsd before this release. Add support for TCP/IPv6 probes. tcp6 can now send TCP/IPv6 packets “–probe-mode” option, and read t...

Assessing risk for the January 2014 security updates

Today we released four security bulletins addressing six CVE’s. All four bulletins have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin...

[Memoryze] Find Evil in Live Memory (Memory Forensic Software)

Mandiant’s Memoryze is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis. Mandiant’s Memoryze features: image the full range of system memory no...

PT-2014-68: Multiple SQL Injection in InstantCMS

The specialists of the Positive Research center have detected multiple SQL Injection vulnerabilities in InstantCMS. SQL Injection in the cms.php script allows remote attackers to execute arbitrary SQL commands via a specially crafted request. How to fix Update your software up to the latest...

CVE-2013-2068

creationtimestamp| type| source ---|---|--- 2013-12-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/30469 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cfmemanageiqevmuploadexec.rb 2025-02-06 03:13:41+00:0...

[SSLDigger v1.02] Tool to assess the strength of SSL

SSLDigger v1.02 is a tool to assess the strength of SSL servers by testing the ciphers supported. Some of these ciphers are known to be insecure. Features: full Browser Support using Microsoft Internet Explorer Browser Control support for operating the tool in batch modefor operating on multiple...

PT-2013-75: Cross-Site Scripting in Nuxeo Platform

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Nuxeo Platform. Cross-site scripting in the login.jsp page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to f...

PT-2014-78: Cross-site scripting in Kasseler CMS

The specialists of the Positive Research center have detected a Cross-site scripting vulnerability in Kasseler CMS. Insufficient validation of user input in the \function\init.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may...

PT-2014-75: Cross-Site Scripting in Kasseler CMS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Kasseler CMS. Cross-site scripting in the install.php page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to f...

Assessing risk for the December 2013 security updates

Today we released eleven security bulletins addressing 24 CVE’s. Five bulletins have a maximum severity rating of Critical while the other six have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

Up.Time Monitoring Station post2file.php Arbitrary File Upload

This Metasploit module exploits an arbitrary file upload vulnerability found within the Up.Time monitoring server 7.2 and below. A malicious entity can upload a PHP file into the webroot without authentication, leading to arbitrary code execution. This module requires Metasploit:...

Kaseya uploadImage Arbitrary File Upload

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Kaseya uploadImage Arbitrary File Upload', 'Description' = %q This module exploits an arbitrary file upload vulnerability found in...

DesktopCentral AgentLogUpload Arbitrary File Upload Vulnerability

This Metasploit module exploits an arbitrary file upload vulnerability in DesktopCentral 8.0.0 below build 80293. A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution. This module requires Metasploit: http//metasploit.com/download...

Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability found within the Up.Time monitoring server 7.2 and below. A malicious entity can upload a PHP file into the webroot without authentication, leading to arbitrary code execution. Although the vendor fixed Up.Time to prevent this...

Kaseya < 6.3.0.2 - Arbitrary File Upload

, , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Kaseya Arbitrary File Upload Vulnerability Affected versions: User-Agent: Mozilla/5.0 Windows NT 6.1; rv:22.0 Gecko/20100101 Fir...