Threat Outbreak Alert: Fake Picture Link Email Messages on September 16, 2013

Low Alert ID: 25964 First Published: 2012 May 18 17:00 GMT Last Updated: 2013 September 17 14:05 GMT Version: 78 Summary Cisco Security has detected significant activity related to spam email messages. The text in the email message instructs the recipient to follow a link or open an attachment...

XSS Vulnerabilities in JIRA Attachments?

At the current moment, JIRA do not have any restrictions for attachment files, which allows users to upload malicious file into JIRA issues. This can be a problem when we open an attachments using Mozilla Firefox, since the browser allows us to open attachments using web browser. The steps to...

XSS Vulnerabilities in JIRA Attachments?

At the current moment, JIRA do not have any restrictions for attachment files, which allows users to upload malicious file into JIRA issues. This can be a problem when we open an attachments using Mozilla Firefox, since the browser allows us to open attachments using web browser. The steps to...

XSS Vulnerabilities in JIRA Attachments?

At the current moment, JIRA do not have any restrictions for attachment files, which allows users to upload malicious file into JIRA issues. This can be a problem when we open an attachments using Mozilla Firefox, since the browser allows us to open attachments using web browser. The steps to...

DNSChanger Malware

UPDATE: On March 5, 2012, a federal judge agreed to allow more time for organizations and individuals to clean systems of the DNSChanger malware and extended the deadline for shutting off servers that had been keeping infected computers connected to the internet. Although the new deadline is July...

Wordpress Auto Attachments 0.2.9 File Upload

File upload vulnerability in Wordpress Auto Attachments plugin Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Ongoing Targeted Attack Campaign Going After Defense, Aerospace Industries

Researchers have identified a strain of malware that’s being used in a string of targeted attacks against defense contractors, government agencies and other organizations by leveraging exploits against zero-day vulnerabilities. The attacks may have been going on since 2009 in some form and the...

CVE-2011-5070

Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to inject arbitrary web script or HTML via 1 the file name to incidentattachments.php; 2 unspecified vectors in linkadd.php, possibly involving origref, linkref, linktype parameters,...

CVE-2011-5070

Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to inject arbitrary web script or HTML via 1 the file name to incidentattachments.php; 2 unspecified vectors in linkadd.php, possibly involving origref, linkref, linktype parameters,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to inject arbitrary web script or HTML via 1 the file name to incidentattachments.php; 2 unspecified vectors in linkadd.php, possibly involving origref, linkref, linktype parameters,...

Nova CMS Directory Traversal

Title : Nova CMS Directory Travel Author : Red Security TEAM Date : 21/01/2012 Download : http://www.nova-cms.com/uploads/files/novacms.zip Tested On : CentOS Dork : Copyright ©2005-2011 by Nova CMS. Contact : Info 4t RedSecurity d0t COM Home : http://RedSecurity.COM Exploit : 1. Register 2. Go t...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote authenticated users to affect integrity via unknown vectors related to Attachments / File Upload...

CVE-2011-2271

CVE-2011-2271 affects Oracle E-Business Suite 11.5.10.2 through the Oracle Application Object Library. The vulnerability involves Attachments / File Upload and allows remote authenticated users to impact integrity via unknown vectors. The provided sources list this entry with a low severity (CVSS...

Phishing Campaign Using Spoofed US-CERT Email Addresses

On January 10, 2012, US-CERT received reports of a phishing campaign that is spoofing US-CERT email to deliver a variant of the Zeus/Zbot Trojan known as Ice-IX. This campaign appears to be targeting a large number of private sector organizations as well as federal, state, and local governments...

Bugzilla XSS / XSRF / Unauthorized Account Creation

No description provided by source. Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: When viewing tabular or graphical reports as well as new charts, an XSS vulnerability is...

USAA Phishing Scam and Malware Campaign

US-CERT is aware of public reports of an active spear-phishing attack via email messages directed at United Services Automobile Association USAA members. These messages contain the subject line "Deposit Posted" and contain a randomly generated four-digit number placed in the USAA security zone...

Microsoft Publisher Out of Bound Array Index Remote Code Execution Vulnerability

Description Microsoft Publisher is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting user into opening a specially crafted Publisher file. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of t...

Microsoft Publisher Invalid Pointer Remote Code Execution Vulnerability

Description Microsoft Publisher is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting user into opening a specially crafted Publisher file. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of t...

Docebo Lms 4.0.4 - 'Messages' Remote Code Execution

if$GLOBALS'modname' != '' $modulecfg =& createModule$GLOBALS'modname'; ............ elseif$GLOBAL...

Microsoft Releases Security Advisory for Vulnerability in TrueType Font Parsing

Microsoft has released Microsoft Security Advisory 2639658 to address a vulnerability in the Win32k TrueType font parsing engine. By convincing a user to open a malicious email attachment, an attacker may be able to exploit this vulnerability and execute arbitrary code. Microsoft has indicated th...