Critical Remote Code Execution Flaw Found in WordPress Plugin

There is an easily exploitable remote code execution vulnerability in a popular WordPress plugin that helps manage file downloads and researchers say the bug could be used by even a low-level attacker to run arbitrary code on a vulnerable site. The vulnerability is in the WP Download Manager,...

Multiple vulnerabilities in MantisBT

High-Tech Bridge Security Research Lab has discovered multiple vulnerabilities in MantisBT, which can be exploited to perform Cross-Site Scripting XSS and SQL injection attacks. Improper access control vulnerability discloses database's credentials login and password in plaintext. 1 Cross-Site...

xEpan 1.0.4 - Multiple Vulnerability

Exploit for php platform in category web applications Exploit Title: Multiple Vulnerability xEpan 1.0.4 Google Dork: not yet Date: 2014-11-27 Exploit Author: Parikesit , Kurawa In Disorder Vendor Homepage: http://xepan.org Software Link: http://www.xepan.org/index.php?subpage=download Version:...

xEpan 1.0.4 - Multiple Vulnerabilities

xEpan 1.0.4 - Multiple Vulnerabilities Exploit Title: Multiple Vulnerability xEpan 1.0.4 Google Dork: not yet Date: 2014-11-27 Exploit Author: Parikesit , Kurawa In Disorder Vendor Homepage: http://xepan.org Software Link: http://www.xepan.org/index.php?subpage=download Version: 1.0.4 Tested on:...

xEpan 1.0.4 - Multiple Vulnerabilities

Exploit Title: Multiple Vulnerability xEpan 1.0.4 Google Dork: not yet Date: 2014-11-27 Exploit Author: Parikesit , Kurawa In Disorder Vendor Homepage: http://xepan.org Software Link: http://www.xepan.org/index.php?subpage=download Version: 1.0.4 Tested on: Windows 7 Ultimate Vulnerability Type:...

Free theme hidden back door, spread WordPress and other renowned CMS system-vulnerability warning-the black bar safety net

Recently the United States security researchers broke the news, for the CMS site of the thousands of plugins and themes are implanted called CryptoPHP Backdoor, which may lead to a lot ofWeb serveris an attacker for himself. Hidden in the CMS free plug-in the midst of the This new-found back door...

CryptoPHP Backdoor Hijacks Servers with Malicious Plugins & Themes

Security researchers have discovered thousands of backdoored plugins and themes for the popular content management systems CMS that could be used by attackers to compromise web servers on a large scale. The Netherlands-based security firm Fox-IT has published a whitepaper revealing a new Backdoor...

QiboCMS v7 /ewebeditor/ckfinder/plugins/fileeditor/codemirror/contrib/php/js/net.php 后门

/ewebeditor/ckfinder/plugins/fileeditor/codemirror/contrib/php/js/net.php?php errorreporting7; //设定错误讯息回报的等级 obstart; //打开缓冲区,当缓冲区激活时，所有来自PHP程序的非文件头信息均不会发送，而是保存在内部缓冲区。为了输出缓冲区的内容，可以使用obendflush或flush输出缓冲区的内容。 $mtime = explode' ', microtime; $starttime = $mtime1 + $mtime0; @settimelimit0;...

OnionDuke APT Malware served through Tor Network

The malicious Russian Tor exit node, which was claimed to be patching binary files, is actually distributing a malware program to launch cyber-espionage attacks against European government agencies. The group behind the rogue Tor exit node had likely been infecting files for more than a year,...

Softing FG-100 security vulnerabilities

Backdoor accounts, crossite scripting...

CVE-2014-6617 Softing FG-100 Backdoor Account

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Softing FG-100 PB Vendor: Softing AG www.softing.com CVD ID: CVE-2014-6617 Subject: Backdoor Account Risk: High Effect: Remotely exploitable Author: Ingmar Rosenhagen Daniel Marzin Johannes Klick Date: 05.11.2014...

Softing FG-100 PB Hardcoded Backdoor

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Softing FG-100 PB Vendor: Softing AG www.softing.com CVD ID: CVE-2014-6617 Subject: Backdoor Account Risk: High Effect: Remotely exploitable Author: Ingmar Rosenhagen Daniel Marzin Johannes Klick Date: 05.11.2014...

Drupal SQL Injection Vulnerability leaves Millions of Websites Open to Hackers

One of the most popular content management systems, Drupal, is warning its users to consider their websites as compromised unless their sites were updated immediately with a security patch released on 15 October 2014. Drupal is an open source software package which provides a Content management...

MAARCH 1.4 - SQL Injection / Arbitrary File Upload Vulnerabilities

Exploit for php platform in category web applications / Exploit Title: Maarch 1.4 SQL Injection Google Dork: intext:"Maarch Maerys Archive v2.1 logo" Date: 29/10/2014 Exploit Author: Adrien Thierry Exploit Advisory:...

Broken shell Vulnerability, CVE-2 0 1 4-6 2 7 1 Integrated analysis:“break the shell”loophole series analysis of two-vulnerability and early warning-the black bar safety net

A“broken shell”vulnerability overview Our team in 9 months 2 5, 1 0 when released the“break the shell”VulnerabilityCVE-2 0 1 4-6 2 7 1A comprehensive analysis of, and update multiple versions. In this process, we monitor the collection and sample Exchange System, found a lot to exploit the...

Techboard/Syac backdoor

Backdoor service is available via TCP/7339 port...

Backdoor access to Techboard/Syac devices

ADVISORY INFORMATION Title: Backdoor access to Techboard/Syac devices Discovery date: 02/04/2014 Release date: 07/07/2014 Advisory URL: http://blog.emaze.net/2014/07/backdoor-techboardsyac.html Credits: Roberto Paleari @rpaleari, Luca Giancane [email protected] VULNERABILITY INFORMATION...

ZXShell Malware Services Detection

ZXShell is a remote access trojan backdoor that can be used to persist on your network for malicious purposes. Detections : - ZXShell HTTP server - ZXShell Command and Control server %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Hikit Backdoor Detection

The remote host is running a Hikit backdoor client. Hikit is a remote administration tool RAT used to control computers infected by malware. The 'client' component is used to control those computers and is associated with malicious activity. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Wordpress Slideshow Gallery 1.4.6 - Shell Upload (Python Exploit)

No description provided by source. !/usr/bin/env python WordPress Slideshow Gallery 1.4.6 Shell Upload Exploit WordPress Slideshow Gallery plugin version 1.4.6 suffers from a remote shell upload vulnerability CVE-2014-5460 Vulnerability discovered by: Jesus Ramirez Pichardo -...