ClipSharePro 4.1 Local File Inclusion

Exploit Title : ClipSharePro 0 $configfile = $GET'configfile'; else showAlertMessage"ERROR: Failed to find configfile parameter", 1; else $configfile = $DEFAULTCONFIG; // Load config file require $configfile; //including arbitrary file $GET'configfile' echo $configfile; The vulnerability can be...

ClipSharePro 4.1 - Local File Inclusion

Exploit Title : ClipSharePro 0 $configfile = $GET'configfile'; else showAlertMessage"ERROR: Failed to find configfile parameter", 1; else $configfile = $DEFAULTCONFIG; // Load config file require $configfile; //including arbitrary file $GET'configfile' echo $configfile; The vulnerability can be...

HTTPS can leak your Personal details to Attackers

Explosive revelations of massive surveillance programs conducted by government agencies by the former contractor Edward Snowden triggered new debate about the security and privacy of each individual who is connected somehow to the Internet and after the Snowden’s disclosures they think that by...

PT-2014-2155 · Debian · Apt

Name of the Vulnerable Software and Affected Versions: apt versions prior to 0.8.11 Description: The issue allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors when the certificate host name fails validation and Verify-Host is enabled. Recommendations: For...

MGASA-2014-0103 Updated kernel fixes security vulnerabilities

This kernel update provides an update to the upstream stable 3.12.13 maintenance release and fixes the following security issues: A flaw was found in the way cifs handled iovecs with bogus pointers userland passed down via writev during uncached writes. An unprivileged local user with access to...

MGASA-2014-0083 Updated mongodb package fixes security vulnerability

A possible DoS issue was discovered in MongoDB CVE-2012-6619. The --objcheck command line switch has now been enabled by default in the mongod service as a protective measure...

Printer Job Language Abuse Tool

!/usr/bin/python2 """ printit.py - sends postscript files to printers. Never pay extortionate prices for printing again! Author: Darren "infodox" Martyn Twitter: @infodox Licence: WTFPL - wtfpl.net Bitcoins: 1PapWy5tKx7xPpX2Zg8Rbmevbk5K4ke1ku Version: 20140109.1 Changes: Added ReadyMessage...

CVE-2010-4777

The Perlregnumberedbufffetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service assertion failure and application exit via crafted input that is not properly handled when using certain...

CVE-2010-4777

The Perlregnumberedbufffetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service assertion failure and application exit via crafted input that is not properly handled when using certain...

Bluetooth Gas Pump Skimmer Scam Nets $2 Million

Thirteen men were indicted this week for allegedly using Bluetooth-enabled skimmers to steal more than $2 million from customers at gas stations across the Southern United States between 2012 and 2013. Documents released on Tuesday by the offices of Manhattan District Attorney Cyrus R. Vance, Jr...

Bluetooth enabled Credit Card Skimmers planted at Gas Station lead to $2 Million heist

Cyber Criminals will not let any way out without making Money. Another huge Credit Card theft and this time they targeted Gas Stations. 13 men were suspected and charged for stealing banking information, using Bluetooth enabled Credit Card Skimmers planted on the gas stations throughout the...

Debian Security Advisory DSA 2800-1 (nss - buffer overflow)

Andrew Tinits reported a potentially exploitable buffer overflow in the Mozilla Network Security Service library nss. With a specially crafted request a remote attacker could cause a denial of service or possibly execute arbitrary code. OpenVAS Vulnerability Test $Id: deb2800.nasl 6611 2017-07-07...

Dahua DVR 2.608.0000.02.608.GV00.0 - Authentication Bypass (Metasploit)

Dahua DVR 2.608.0000.02.608.GV00.0 - Authentication Bypass Metasploit Dahua DVR Authentication Bypass - CVE-2013-6117 --Summary-- Dahua web-enabled DVRs and rebranded versions do not enforce authentication on their administrative services. Zhejiang Dahua Technology Co., Ltd...

Dahua DVR Authentication Bypass - CVE-2013-6117

Dahua DVR Authentication Bypass - CVE-2013-6117 --Summary-- Dahua web-enabled DVRs and rebranded versions do not enforce authentication on their administrative services. Zhejiang Dahua Technology Co., Ltd. http://www.dahuasecurity.com --Affects-- Dahua web-enabled DVRs Dahua-rebranded web-enabled...

CVE-2013-4508

lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network...

SSH Server CBC Mode Ciphers Enabled

The SSH server is configured to support Cipher Block Chaining CBC encryption. This may allow an attacker to recover the plaintext message from the ciphertext. Note that this plugin only checks for the options of the SSH server and does not check for vulnerable software versions. C Tenable Network...

xinetd: enables unintentional services over tcpmux port

builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1...

UBUNTU-CVE-2013-2892

drivers/hid/hid-pl.c in the Human Interface Device HID subsystem in the Linux kernel through 3.11, when CONFIGHIDPANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service heap-based out-of-bounds write via a crafted device...

[SECURITY] Fedora 18 Update: WebCalendar-1.2.7-1.fc18

WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. MySQL, PostgreSQL, Oracle, DB2, Interbase, MS SQL Server, or ODBC is required. WebCalendar can be setup in a...

[SECURITY] Fedora 19 Update: WebCalendar-1.2.7-1.fc19

WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. MySQL, PostgreSQL, Oracle, DB2, Interbase, MS SQL Server, or ODBC is required. WebCalendar can be setup in a...