WordPress SS Downloads Plugin <= 1.4 - XSS

Because of this vulnerability in templates/download.php, attackers can inject arbitrary web script or HTML via the "title" parameter. Solution Update the plugin...

Apple fixes 2 2 a Safari vulnerability-vulnerability warning-the black bar safety net

5 on 2 2nd, Apple released a about the Safari patch, which fixes the 2 2 vulnerability these vulnerabilities could cause code execution or a browser crash. These vulnerabilities affect OS X Mavericks 10.9 under Safari 7.0.4 and OS X Mountain Lion 10.8. Under the Safari 6.1.4 on. When a user brows...

Design/Logic Flaw

OpenStack Heat Templates heat-templates, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download 1 packages and 2 signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors...

PT-2014-3447 · Red Hat +1 · Yum +2

Name of the Vulnerable Software and Affected Versions: OpenStack Heat Templates heat-templates as used in Red Hat Enterprise Linux OpenStack Platform version 4.0 Description: The issue allows man-in-the-middle attackers to prevent updates via unspecified vectors, as OpenStack Heat Templates uses ...

CryptoLocker Ransomware Competitor May Have Fatal Flaw

CryptoLocker certainly changed the ransomware game last year when it threatened its victims with the loss of important files if a timely ransom payment was not made. Reportedly, criminal gangs utilizing this dangerous type of ransomware were earning hundreds of thousands of dollars per month...

Another Internet Explorer Zero Day Surfaces

Researchers have disclosed a new zero day vulnerability in Internet Explorer 8 that could enable an attacker to run arbitrary code on vulnerable machines via drive-by downloads or malicious attachments in email messages. The vulnerability was discovered and disclosed to Microsoft in October, but...

Cisco Unity Connection Directory Traversal Vulnerability

A vulnerability in the messaging API of Cisco Unity Connection could allow an authenticated, remote attacker to execute a directory traversal and download arbitrary files that match the allowed MIME types. The vulnerability occurs because there is insufficient input filtering and file types other...

[OWASP iGoat] Security learning tool for iOS developers

The OWASP iGoat project is a security learning tool for iOS developers to learn about security weaknesses in iOS -- by breaking things as well as fixing them. iGoat is available ONLY in source code format, and this is the official repository for that code. On the Downloads tab here, you will find...

Chrome Pop-Up Warns Windows Users of Browser Hijacking

A rising number of online scams involve the modification of browser settings where a hacker spikes a free download or website with malware. The end result is generally a click-fraud scheme of some kind where the new browser settings might include spiked search engine pages or a new home page...

MyBB 1.6.12 POST Cross Site Scripting

alert/XSS/ " / document.exploit.submit;...

A10 Networks AX Loadbalancer Directory Traversal

This module exploits a directory traversal flaw found in A10 Networks Soft AX Loadbalancer version 2.6.1-GR1-P5/2.7.0 or less. When handling a file download request, the xml/downloads class fails to properly check the 'filename' parameter, which can be abused to read any file outside the virtual...

WordPress SS Downloads Cross Site Scripting

Exploit Title : Wordpress SS Downloads Plugin Cross Site Scripting Exploit Author : ACC3SS Vendor Homepage : http://wordpress.org/plugins/ss-downloads/developers/ Software Link : http://downloads.wordpress.org/plugin/ss-downloads.1.4.4.1.zip Date : 2014-01-19 Tested on : Windows 7 / Mozilla Firef...

Design/Logic Flaw

The RBAC implementation in Cisco Identity Services Engine ISE Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, ak...

CVE-2014-0665

The RBAC implementation in Cisco Identity Services Engine ISE Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, ak...

PT-2014-3760

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE Software affected versions not specified Description The issue concerns the Role-Based Access Control RBAC implementation, which fails to properly verify privileges for support-bundle downloads. This allows...

CVE-2014-0665: Undefined Security Weakness

The RBAC implementation in Cisco Identity Services Engine ISE Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, ak...

Google Blocks Malicious File Downloads Automatically in Chome

Google has fixed five vulnerabilities in its Chrome browser and also has activated a feature that will block malicious file downloads automatically. The change is a major security upgrade for Chrome and will help prevent users from unwittingly downloading harmful files, an attack vector that...

[Pinpoint] Enumerates WebPage Components to help identify the Infected Files

Pinpoint works like wget/curl in that it just fetches a webpage without rendering any script. Pinpoint will then try to determine which links are used to make up the webpage such as Javascript, CSS, frames, and iframes and downloads those files too some Javascript content will produce incorrect...

[FoxAnalysis] Firefox Internet History Analysis Software

FoxAnalysis Plus is a software tool for extracting, viewing and analysing internet history from the Mozilla Firefox web browser. The main features are described below: Extract History :: Extract history regarding bookmarks, cookies, downloads, favicons, form entries, logins, saved sessions and...

CVE-2013-6695

The RBAC implementation in Cisco Secure Access Control System ACS does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug...