Apple Zaps JailbreakMe Bugs in Record Time

Less than two weeks after exploits for a pair of serious security vulnerabilities were fitted into an automated JailbreakMe.com exploit, Apple has rushed out a patch to block the jailbreaking of iPhone, iPad and iPod Touch devices. The iOS 3.2.2 for iPad and iOS 4.0.2 iPhone and iPod Touch update...

VUPEN Security Research - Microsoft Internet Explorer "CIframeElement" Object Use-after-free Vulnerability (CVE-2010-2558)

VUPEN Security Research - Microsoft Internet Explorer "CIframeElement" Object Use-after-free Vulnerability CVE-2010-2558 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Microsoft Internet Explorer is a web browser developed by Microsoft and included as part of the...

Nagios XI 2009R1.2B Multiple CSRF

Advisory Information Advisory ID: NGENUITY-2010-006 Date published: Aug. 7, 2010 Class: Cross-Site Request Forgery CSRF Software Description Nagios XI is the commercial / enterprise version of the open source Nagios project. Vulnerability Description Nagios XI 2009R1.2B is vulnerable to multiple...

Mantis 'manage_proj_cat_add.php' HTML Injection Vulnerability

Mantis is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing...

Muraus Open Blog - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/42255/info Tomaž Muraus Open Blog is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplie...

CVE-2010-2932

creationtimestamp| type| source ---|---|--- 2010-07-30 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14505 2010-07-30 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14504 2010-07-31 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14519...

Hacker Demos Remote Attacks Against ATMs

LAS VEGAS — Using home-brewed software tools and exploiting a gaping security hole in the authentication mechanism used to update the firmware on automated teller machines ATMs, a security researcher hacked into ATMs made by Triton and Tranax and planted a rootkit that dispensed cash on demand...

[DSECRG-09-068] SAP NetWaver SLD - multiple XSS

Digital Security Research Group DSecRG Advisory DSecRG-09-068 Application: SAP NetWeaver SLD Versions Affected: 6.4 - 7.02 Vendor URL: http://SAP.com Bugs: XSS Exploits: YES Reported: 14.12.2009 Vendor response: 15.12.2009 last response: 06.05.2010 Date of Public Advisory: 13.07.2010 CVE-number:...

[DSECRG-09-040] SAP Netweaver wsnavigator XSS Security Vulnerability

Digital Security Research Group DSecRG Advisory DSECRG-09-040 Application: SAP Netweaver Versions Affected: Version 6.4 - 7.0 Vendor URL: http://SAP.com Bugs: XSS Exploits: YES Reported: 26.05.2009 Vendor response: 27.05.2009 Date of Public Advisory: 13.07.2010 CVE-number: Author: Alexandr Polyak...

sNews (index.php) SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================= sNews index.php SQL Injection Vulnerability ============================================= Author: MajoR Software Link: http://snews.awddesign.co.uk Version: N/A Tested on: Wnidows xp SP2 CVE : N/A...

vBulletin <= 3.8.6 'faq.php' Information Disclosure Vulnerability - Active Check

vBulletin is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

'Protected Mode' Brings Sandbox to Adobe Reader

The next major version of Adobe’s PDF Reader will feature new sandboxing technology aimed at curbing a surge in malicious hacker attacks against the widely deployed software. The security feature, called “Protected Mode,” is similar to the Google Chrome sandbox and Microsoft Office 2010 Protected...

CVE-2010-1214

creationtimestamp| type| source ---|---|--- 2010-07-20 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/34358 2010-09-17 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/15027...

CVE-2010-3187

creationtimestamp| type| source ---|---|--- 2010-07-18 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14409 2010-07-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14456...

Malware-Spiked Spam Uses Amazon.com Lure

A currently spamvertised malware campaign is brand-jacking Amazon.com, in an attempt to trick end users into visiting a client-side exploits serving URL. Read the full article. ZDNet...

MS Windows Token Kidnapping Problems Resurface

Microsoft’s problems with Token Kidnapping .pdf on the Windows platform aren’t going away anytime soon. More than a year after Microsoft issued a patch to cover privilege escalation issues that could lead to complete system takeover, a security researcher plans to use the Black Hat conference...

ASX to MP3 Converter 3.1.2.1 - Multiple OS ASLR + DEP Bypass (SEH) (Metasploit)

ASX to MP3 Converter 3.1.2.1 - Multiple OS ASLR + DEP Bypass SEH Metasploit Exploit Title: ASX to MP3 Converter v3.1.2.1 SEH Exploit Multiple OS, DEP and ASLR Bypass Date: July 13, 2010 Author: Node Software Link: http://www.mini-stream.net/downloads/ASXtoMP3Converter.exe Version: Mini-Stream...

Elite CMS 1.01 Cross Site Request Forgery / Cross Site Scripting

Name: Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities Author: 10n1z3d Date: Sat 10 Jul 2010 08:05:44 PM EEST Vendor: http://elitecms.net/ Download: http://elitecms.net/download.php?download=eliteCMS -= CSRF PoC 1 - Change Admin Password =- Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities - Chang...

PHP Bible Search 'bible.php' SQL Injection and Cross Site Scripting Vulnerabilities

PHP Bible Search is prone to SQL injection and cross site scripting vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Joomla! Component Rapid-Recipe - HTML Injection

source: https://www.securityfocus.com/bid/41531/info Joomla! Rapid-Recipe component is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplied HTML and...