SNMP Community String Detection

Binary data 7134.pasl...

SNMP community detection

Binary data 8351.prm...

Piwigo vulnerable to cross-site scripting

Overview Piwigo is a software to manage and host image files on the web. Piwigo contains a cross-site scripting vulnerability when the "Community" plugin is activated and validation on user uploaded photos is disabled. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC...

JVN#80310172: Piwigo vulnerable to cross-site scripting

Piwigo is a software to manage and host image files on the web. Piwigo contains a cross-site scripting vulnerability when the "Community" plugin is activated and validation on user uploaded photos is disabled. Impact When a user views a specially crafted image, arbitrary JavaScript may be execute...

TomatoCart 1.x Cross Site Scripting / SQL Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3978 - Remote SQL Injection Vulnerability CVE-2014-3830 - Reflected Cross Site Scripting - ------------------------------------------------------------------------------ Title: TomatoCart v1.x latest-stable Remote SQL Injection Vulnerability...

Researchers Plan to Disclose Critical Bugs to TAILS Team Soon

The developers of the TAILS operating system are poised to release a new version of the software–which is designed to preserve privacy and anonymity–and it includes several security fixes. However, there are several other security issues that aren’t patched in the new release, vulnerabilities...

Miscellaneous memory safety hazards (rv:31.0 / rv:24.7) — Mozilla

Mozilla developers and community identified identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least...

5: Remote code execution via unauthenticated JMX/RMI connector

JBoss Application Server 5 and supported Red Hat JBoss 5.x products contain JBoss Remoting, which includes a partial implementation of the JMX remoting specification JSR 160. This implementation is provided in jmx-remoting.sar, which is deployed by default in unsupported community releases of JBo...

Alfresco Community Edition 4.2.f Server Side Request Forgery

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple SSRF vulnerabilities product: Alfresco Community Edition vulnerable version: =4.2.f fixed version: 5.0.a impact: Hi...

Alfresco - proxy?endpoint Server-Side Request Forgery

Alfresco - proxy?endpoint Server-Side Request Forgery source: https://www.securityfocus.com/bid/68/info http://www.example.com/alfresco/proxy?endpoint=http://internalsystem:port 663/info Alfresco Community Edition is prone to multiple security vulnerabilities. An attacker may leverage these issue...

Alfresco - cmisbrowser?url Server-Side Request Forgery

Alfresco - cmisbrowser?url Server-Side Request Forgery source: https://www.securityfocus.com/bid/68/info http://www.example.com/alfresco/proxy?endpoint=http://internalsystem:port 663/info Alfresco Community Edition is prone to multiple security vulnerabilities. An attacker may leverage these issu...

Alfresco - '/cmisbrowser?url' Server-Side Request Forgery

source: https://www.securityfocus.com/bid/68/info http://www.example.com/alfresco/proxy?endpoint=http://internalsystem:port 663/info Alfresco Community Edition is prone to multiple security vulnerabilities. An attacker may leverage these issues to gain sensitive information or bypass certain...

Project Zero - A Team of Star-Hackers Hired by Google to Protect the Internet

Today Google has publicly revealed its new initiative called “Project Zero,” a team of Star Hackers and Bug Hunters with the sole mission to improve security and protect the Internet. A team of superheroes in sci-fi movies protect the world from Alien attack or bad actors, likewise Project Zero i...

Announcing Project Zero

Posted by Chris Evans, Researcher Herder Security is a top priority for Google. We’ve invested a lot in making our products secure, including strong SSL encryption by default for Search, Gmail and Drive, as well as encrypting data moving between our data centers. Beyond securing our own products,...

All Seized Domains Returned to No-IP

Less than a week after Microsoft seized nearly two dozen domains owned by a small hosting provider as part of a takedown of a malware operation, all of those domains are back in the control of the provider, No-IP. When Microsoft announced the takedown on June 30, officials said that the company h...

EFF Sues NSA, ODNI Over Zero-Day Disclosure Processes

The Electronic Frontier Foundation wants a peek behind the curtain of the government’s Vulnerabilities Equities Process. The advocacy group on Tuesday filed a Freedom of Information Act FOIA lawsuit against the National Security Agency and the Office of the Director of National Intelligence hopin...

Latest Microsoft Malware Takedown Causes Waves in Security Community

Microsoft’s latest takedown of a malware operation, announced Monday and involving the infrastructure of several malware families, has, like many of the company’s actions, elicited strong opinions on both sides of the issue from security researchers, activists and others with a stake in the game...

Softbiz Resource Repository Script Blind SQL Injection Vulnerability

No description provided by source. $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $ Softbiz Resource repository script Blind SQL Vulnerability Normal version $ Author : Sangteamtham $ Home : Hcegroup.net & vnbrain.net $ Download...

Creative Software UK Community Portal 1.1 ArticleView.php article_id Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/17890/info Creative Community Portal is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. A...

Community CMS <= 0.4 (/index.php id) Blind SQL Injection Exploit

No description provided by source. --+++==============================================================+++-- --+++====== Community CMS = 0.4 Blind SQL Injection Exploit ======+++-- --+++==============================================================+++-- ?php function query $user, $pos, $chr $query...