Lansweeper 6.0.0.63 Cross Site Scripting Vulnerability

Exploit for asp platform in category web applications ============================================= - Discovered by: Giovanni Cerrato, Giovanni Guido and BackBox team - Severity: Medium ============================================= I. VULNERABILITY ------------------------- Lansweeper XSS...

UPDATE: WarBerryPi Version 5.1b!

PenTestIT RSS Feed My last post pertaining to this Red Teaming Hardware Implant was about an updated version. This post also covers the changes made to two versions since my last post about the WarBerryPi v5. We now have an updated release for the Raspberry Pi based hardware implant allowing you ...

Tails 3.2 - Live System to Preserve Your Privacy and Anonymity

Tails is a live system that aims to preserve your privacy and anonymity. It helps you to use the Internet anonymously and circumvent censorship almost anywhere you go and on any computer but leaving no trace unless you ask it to explicitly. It is a complete operating system designed to be used fr...

FLIR Systems FLIR Thermal Camera F/FC/PT/D Multiple Information Disclosures

Summary FLIR's PT-Series of high-performance, multi-sensor pan/tilt cameras bring thermal and visible-light imaging together in a system that gives you video and control over both IP and analog networks. The PT-Series' precision pan/tilt mechanism gives you accurate pointing control while providi...

CVE-2017-0899

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences...

CVE-2017-0900

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a query command...

Atlassian FishEye repository changelog resource cross-site scripting vulnerability

Atlassian FishEye is a suite of source code repository deep view software from Atlassian Australia. The software provides navigation, search, historical reporting and change analysis. repository changelog resource is one of the updated repositories. A cross-site scripting vulnerability exists in...

CVE-2017-9510

The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the start date and end date parameters...

CVE-2017-9510: Improper Neutralization of Input During Web Page Generation

The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the start date and end date parameters...

PT-2017-18979

Name of the Vulnerable Software and Affected Versions Atlassian Fisheye versions prior to 4.4.1 Description The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting XSS vulnerability. This is achieved through the start date and end date parameters in the...

SQL Injection(CVE-2017-12650) and CSRF(CVE-2017-12651) Security Vulnerability in Loginizer

As part of a vulnerability research project for our WordPress Security Scanner at WPcans.com, we have been auditing popular WordPress plugins looking for security issues. While auditing the WordPress plugin Loginizer, we discovered a SQL Injection vulnerability and a Cross-Site Request Forgery...

WordPress IBPS Online Exam plugin <=1.0 - Authenticated Stored Cross-site scripting (XSS) vulnerability

Authenticated Stored Cross-site scripting XSS vulnerability found in WordPress IBPS Online Exam plugin =1.0 versions by 8bitsec. The attack is possible when logged in as a student. Solution 2017.07.29 - We were unable to find information about patched release of WordPress IBPS Online Exam plugin...

WordPress IBPS Online Exam plugin <=1.0 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found in WordPress IBPS Online Exam plugin =1.0 versions. Blind SQL Injection possible when logged in as a student. Solution 2017.07.29 - We were unable to find information about patched release of WordPress IBPS Online Exam plugin. Also, we were...

WordPress Task Manager Pro plugin <=1.3.1 - Authenticated SQL Injection vulnerability

Authenticated SQL Injection vulnerability found in WordPress Task Manager Pro premium plugin version 1.3.1 and earlier versions by 8bitsec. Solution 2017.07.29 - We were unable to find information about patched release of WordPress Task Manager Pro plugin. The last record on the changelog of the...

WordPress Task Manager Pro plugin <=1.3.1 - Multiple Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Cross-Site Scripting XSS vulnerabilities found in WordPress Task Manager Pro premium plugin version 1.3.1 and earlier versions by 8bitsec. Solution 2017.07.29 - We were unable to find information about patched release of WordPress Task Manager Pro plugin. The last record on...

PHP < 5.6.31, 7.0.x < 7.0.21, 7.1.x < 7.1.7 Multiple Vulnerabilities (Jul 2017) - Windows

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2017:1315-1)

This update for mariadb fixes the following issues : - update to MariaDB 10.0.30 GA - notable changes : - XtraDB updated to 5.6.35-80.0 - TokuDB updated to 5.6.35-80.0 - PCRE updated to 8.40 - MDEV-11027: better InnoDB crash recovery progress reporting - MDEV-11520: improvements to how InnoDB dat...

Fedora 25 : weechat (2017-20dd9f26cf)

Fix for CVE-2017-8073 and various other changes. See https://weechat.org/files/changelog/ChangeLog-devel.htmlv1.7.1 for full changelog. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

openSUSE Security Update : libressl (openSUSE-2017-561)

This update for libressl to version 2.5.1 fixes the following issues : These security issues were fixed : - CVE-2016-0702: Prevent side channel attack on modular exponentiation boo968050. - CVE-2016-7056: Avoid a side-channel cache-timing attack that can leak the ECDSA private keys when signing...

MediaCoder 0.8.48.5888 - Local Buffer Overflow (SEH)

MediaCoder 0.8.48.5888 - Local Buffer Overflow SEH !/usr/bin/python Exploit Title : MediaCoder 0.8.48.5888 Local Buffer Overflow SEH CVE : CVE-2017-8869 Exploit Author : Muhann4d @0xSecured Vendor Homepage : http://www.mediacoderhq.com Vulnerable Software:...