CVE-2015-7706

Multiple cross-site scripting XSS vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to api/v3/public/shares/downloads/, the 2 authType parameter to api/v3/auth/login, or the 3 login parameter to...

TrueCrypt 7.1a / 7.2 DLL Hijacking

Hi @ll, the executable installers "TrueCrypt Setup 7.1a.exe" and TrueCrypt-7.2.exe load and execute USP10.dll, RichEd20.dll, NTMarta.dll and SRClient.dll from their "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads"...

ZoneAlarm DLL Hijacking

Hi @ll, the executable installers ZASPSetupWeb141011000.exe and zafwSetupWeb141011000.exe load and execute at least UXTheme.dll, WindowsCodecs.dll and ProfAPI.dll from their "application directory". For software downloaded with a web browser the application directory is typically the user's...

Simple PHP Polling System - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title : Multiple Vulnerabilities in Simple PHP Polling System. Author : WICS Date : 05-Jan-2016 Software Link : http://sourceforge.net/projects/pollingsystem/ Overview : Simple PHP Polling System helps organizations to make polls of...

Trend Micro DLL Hijacking

Hi @ll, TrendMicroMAX10.0US-enDownloader.exe available from loads and executes ProfAPI.dll and UXTheme.dll and other DLLs too eventually found in the directory it is started from the "application directory". For software downloaded with a web browser the application directory is typically the...

FireEye MPS JAR analyzer command execution

Added: 12/28/2015 BID: 78809 Background The FireEye Malware Protection System MPS detects and eliminates malware found on file shares, web downloads, and e-mail. Problem A vulnerability in the Java Archive analysis tool could allow command execution when the tool analyzes a specially crafted JAR...

Vulnerability of the EMC Documentum Administrator, a tool for managing electronic document systems; the EMC Documentum Digital Asset Management, a tool for managing multimedia materials within electronic document systems; the EMC Documentum TaskSpace, a tool for accessing the repository of electronic document systems; the EMC Documentum Web Publisher, a system for managing web projects. The web interface provides access to the EMC Documentum Webtop repository, allowing an attacker to execute arbitrary code.

The vulnerability of the EMC Documentum Administrator, a tool for managing electronic document systems, and the EMC Documentum Digital Asset Management tool for managing multimedia materials within electronic document systems, as well as the tools for accessing the repository of EMC Documentum...

How to Run Multiple Android apps on Windows and Mac OS X Simultaneously

Bluestacks, the first app player for running Android apps on Windows, has launched the latest version of its Android emulator platform with one major upgrade: The Ability to Run Multiple Android apps Simultaneously. BlueStacks 2 Released Bluestacks previously only run a single app at a time...

WordPress Sell Downloads Plugin 1.0.16 - Local File Disclosure

WordPress Sell Downloads plugin is prone to a local file disclosure vulnerability that allows an attacker to get potentially sensitive information from local files on computers running the vulnerable application. Solution Upgrade the plugin...

The vulnerability of the microprogramming software for Micrologix 1100 and 1400 allows a intruder to inject content from an arbitrary file into the FRAME element.

The vulnerability of the microprogrammed logic controllers Micrologix 1100 and 1400 lies in the lack of restrictions on the download of files. Exploiting this vulnerability allows a malicious actor to inject any file content into the FRAME element remotely...

Mac OS X < 10.11 Multiple Vulnerabilities

Binary data 8982.prm...

Mac OS X : Apple Safari < 9.0 Multiple Vulnerabilities

The version of Apple Safari installed on the remote Mac OS X host is prior to 9.0. It is, therefore, affected by multiple vulnerabilities in the following components : - Safari - Safari Downloads - Safari Extensions - Safari Safe Browsing - WebKit - WebKit CSS - WebKit JavaScript Bindings - WebKi...

Multiple McAfee Products OS Command Injection Vulnerabilities

McAfee ESM is a security management product that performs real-time baseline activity calculations on all information collected and provides prioritized alerts before potential threats occur; McAfee ESMLM is a log collection, storage, and management product.McAfee ESMREC is an event receiver...

openSUSE Security Update : MozillaFirefox (openSUSE-2015-548)

update to Firefox 40.0 bnc940806 - Added protection against unwanted software downloads - Suggested Tiles show sites of interest, based on categories from your recent browsing history - Hello allows adding a link to conversations to provide context on what the conversation will be about - New...

openSUSE: Security Advisory for MozillaFirefox (openSUSE-SU-2015:1390-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for MozillaFirefox (important)

update to Firefox 40.0 bnc940806 Added protection against unwanted software downloads Suggested Tiles show sites of interest, based on categories from your recent browsing history Hello allows adding a link to conversations to provide context on what the conversation will be about New style for...

Security update for MozillaFirefox (important)

update to Firefox 40.0 bnc940806 Added protection against unwanted software downloads Suggested Tiles show sites of interest, based on categories from your recent browsing history Hello allows adding a link to conversations to provide context on what the conversation will be about New style for...

cristianoronaldo.com XSS vulnerability

Vulnerable URL: http://www.cristianoronaldo.com/out.php?utmsource=downloadsmedium=keyboardterm=downloads-keyboardcontent=downloads-keyboardcampaign=downloads-links=';alert/XSSPOSED///';alert/XSSPOSED///";alert/XSSPOSED///";alert/XSSPOSED///--alert/XSSPOSED/...

HTTPie - a CLI, cURL-like tool for humans

HTTPie pronounced aych-tee-tee-pie is a command line HTTP client. Its goal is to make CLI interaction with web services as human-friendly as possible. It provides a simple http command that allows for sending arbitrary HTTP requests using a simple and natural syntax, and displays colorized output...

Shopify: XSS https://delivery.shopifyapps.com/ (Digital Downloads App in myshopify.com)

Hello Installing the Digital Downloads App in .myshopify.com 1-install the app https://apps.shopify.com/digital-downloads 2-select product and click Add Digital Attachment 3-click to upload file and upload file with name the code will execute XSS Success: tested in firefox Hadji Samir...