Watering-Hole Attack Compromises Key Tibetan Site

In what has become a familiar scenario over the last couple of years, attackers have compromised a key Tibetan web site and loaded it with code that redirects some users to a third-party site that installs an APT-style backdoor. The attack has hit the Web site of the Central Tibetan Administratio...

Carberp Web Panel C2 Backdoor Remote PHP Code Execution

This Metasploit module exploits backdoors that can be sighted all over the leaked source code of the Carberp botnet C2 Web Panel. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information...

Carberp Web Panel C2 Backdoor Remote PHP Code Execution

This module exploits backdoors that can be found all over the leaked source code of the Carberp botnet C2 Web Panel. Module Options msf use exploit/unix/webapp/carberp/backdoorexec msf undefinedbackdoorexec show actions ...actions... msf undefinedbackdoorexec set ACTION msf undefinedbackdoorexec...

Skype Malware Stealing Victims' Processing Power to Mine Bitcoins

Bitcoin may still be a virtual unknown quantity for most people, but the digital currency has not escaped the notice of attackers, many of whom are turning their attention to finding ways to use the system for their own gains. The attacks against Bitcoin exchange Mt. Gox and hack of Instawallet...

CVE-2013-0125

Cross-site scripting XSS vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter...

CVE-2013-0125

The CVE-2013-0125 entry describes a Cross-site Scripting (XSS) vulnerability in the C2 WebResource interface, specifically fileview.asp with the File parameter. The issue allows remote attackers to inject arbitrary script/HTML, enabling potential information leakage, privilege escalation, and den...

CVE-2013-0125

Cross-site scripting XSS vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter...

C2 WebResource - 'File' Cross-Site Scripting

source: https://www.securityfocus.com/bid/58838/info C2 WebResource is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the contex...

C2 WebResource - File Cross-Site Scripting

C2 WebResource - File Cross-Site Scripting source: https://www.securityfocus.com/bid/58838/info C2 WebResource is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

Researchers Uncover 'TeamSpy' Attack Campaign Against Government, Research Targets

Researchers have uncovered a long-term cyber-espionage campaign that used a combination of legitimate software packages and commodity malware tools to target a variety of heavy industry, government intelligence agencies and political activists. Known as the TeamSpy crew because of its affinity fo...

Israeli Government Websites Targeted in Watering Hole Attack

A new watering hole attack has been reported, this one targeting two government-related websites based in Israel that have been injected with malware exploiting a six-month-old vulnerability in Internet Explorer. The two sites, ict.org.il and herzliyaconference.org, are related to Israel’s first...

Spear Phishing Campaigns Use Fake Mandiant APT1 Report as Lure

People looking to download and read the Mandiant report on Chinese government attacks on U.S. infrastructure should look carefully at the name of the file before opening it. Researchers say that there are at least two different spear-phishing attacks going on right now that are using rigged copie...

Phuse Web / Element C2 / Cox Web Design SQL Injection

Exploit Title : Phuse Web Sql Injection Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://www.phusewebdesign.co.uk/ Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows Server - win7 Dork : intext:"Site by Phuse W...

Element C2 SQL Injection

---------------------------------------------------------------- Element C2 SQL Injection ---------------------------------------------------------------- Exploit Title: Element C2 SQL Injection Author: Hack Center Security Team Discovered By : Net.W0lf Software Link: www.elementc2.com Impact :...

Unfixed XSS vulnerability at c2.com

Security researcher Sony, has submitted on 09/02/2012 a cross-site-scripting XSS vulnerability affecting c2.com, which at the time of submission ranked 38577 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/08/2012. It is currently unfixed. I...

Microsoft SQL Server Configuration Enumerator

This module will perform a series of configuration audits and security checks against a Microsoft SQL Server database. For this module to work, valid administrative user credentials must be supplied. This module requires Metasploit: https://metasploit.com/download Current source:...

FreeBSD : xerces-c2 -- Attribute blowup denial-of-service (76301302-1d59-11d9-814e-0001020eed82)

Amit Klein reports about Xerces-C++ : An attacker can craft a malicious XML document, which uses XML attributes in a way that inflicts a denial of service condition on the target machine XML parser. The result of this attack is that the XML parser consumes all the CPU. %NASLMINLEVEL 70300 C Tenab...

FreeBSD Ports: xerces-c2

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: xerces-c2

The remote host is missing an update to the system as announced in the referenced advisory. VID 76301302-1d59-11d9-814e-0001020eed82 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

[SECURITY] Fedora 8 Update: cups-1.3.6-2.fc8

The Common UNIX Printing System provides a portable printing layer for UNIX=C2=AE operating systems. It has been developed by Easy Software Produc ts to promote a standard printing solution for all UNIX vendors and users. CUPS provides the System V and Berkeley command-line interfaces...