Malware, Exploit Kit Writers Merging Their Talents

MALAGA, SPAIN–Botnets have been around for more than 15 years now, and for much of that time they’ve been the favored platform for attackers looking to compromise users on a large scale and monetize those infected machines. But now, as researchers and authorities begin to have more success with...

Storm Botnet Returns as Part of New Year's Attacks

A new spam campaign that appeared shortly before the New Year is part of a new effort by the crew behind the Storm/Waledac botnet and is using some rather elementary tactics–in combination with fast-flux–to attempt to compromise unsuspecting users. The new attack emerged late last week and is...

'Avalanche' Crimeware Kit Fuels Phishing Attacks

A single cybercrime group called “Avalanche” was responsible for nearly one-quarter of all identity theft-related phishing attacks in the first half of 2009, according to a new report by the Anti-Phishing Work Group APWG. According to the report, phishing sites on Avalanche domains target the...

Unfixed XSS vulnerability at www.e-flux.com

Security researcher Zeryus, has submitted on 08/06/2008 a cross-site-scripting XSS vulnerability affecting www.e-flux.com, which at the time of submission ranked 489203 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/06/2008. It is currently...

CVE-2008-2686

webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body, then making a direct request for this filename...

Design/Logic Flaw

webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body, then making a direct request for this filename...

CVE-2008-2686

CVE-2008-2686 affects Flux CMS up to version 1.5.0 and earlier. The flaw allows remote code execution by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body, followed by a direct request for the crafted filename. The NVD entry do...

CVE-2008-2686

webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body, then making a direct request for this filename...

Flux CMS 'loadsave.php'任意文件覆盖漏洞

BUGTRAQ ID: 29618 CNCAN ID:CNCAN-2008061003 Flux CMS是一款内容管理程序。 Flux CMS 'loadsave.php'不正确验证用户输入，远程攻击者可以利用漏洞以WEB进程权限覆盖任意文件。 提交特殊构建的POST数据给'loadsave.php'脚本，可导致EB进程权限覆盖任意文件。 Flux CMS 1.5 目前没有解决方案提供： http://wiki.flux-cms.org/display/FLX/Home;jsessionid=D59E863574281A9BB6C951E073B3805C...

Flux CMS <= 1.5.0 (loadsave.php) Remote Arbitrary File Overwrite Exploit

No description provided by source. ?php / ------------------------------------------------------------------------ Flux CMS = 1.5.0 loadsave.php Remote Arbitrary File Overwrite Exploit ------------------------------------------------------------------------ author...: EgiX mail.....:...

Flux CMS <= 1.5.0 (loadsave.php) Remote Arbitrary File Overwrite Exploit

Exploit for unknown platform in category web applications ======================================================================== Flux CMS = 1.5.0 loadsave.php Remote Arbitrary File Overwrite Exploit ======================================================================== ?php /...

Flux CMS 1.5.0 - loadsave.php Arbitrary File Overwrite

Flux CMS 1.5.0 - loadsave.php Arbitrary File Overwrite ?php / ------------------------------------------------------------------------ Flux CMS = 1.5.0 loadsave.php Remote Arbitrary File Overwrite Exploit ------------------------------------------------------------------------ author...: EgiX...

fluxcms-overwrite.txt

?php / ------------------------------------------------------------------------ Flux CMS = 1.5.0 loadsave.php Remote Arbitrary File Overwrite Exploit ------------------------------------------------------------------------ author...: EgiX mail.....: n0b0d13satgmaildotcom link.....:...

Flux CMS 1.5.0 - 'loadsave.php' Arbitrary File Overwrite

?php / ------------------------------------------------------------------------ Flux CMS = 1.5.0 loadsave.php Remote Arbitrary File Overwrite Exploit ------------------------------------------------------------------------ author...: EgiX mail.....: n0b0d13satgmaildotcom link.....:...

Unfixed XSS vulnerability at www.liblogging.org

Security researcher flux, has submitted on 25/03/2008 a cross-site-scripting XSS vulnerability affecting www.liblogging.org, which at the time of submission ranked 13812528 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 31/03/2008. It is...

Unfixed XSS vulnerability at search.tennessean.com

Security researcher flux, has submitted on 25/01/2008 a cross-site-scripting XSS vulnerability affecting search.tennessean.com, which at the time of submission ranked 30464 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/03/2008. It is...

Unfixed XSS vulnerability at www.freexxxpass.co.nz

Security researcher flux, has submitted on 21/01/2008 a cross-site-scripting XSS vulnerability affecting www.freexxxpass.co.nz, which at the time of submission ranked 185540 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 03/03/2008. It is...

Unfixed XSS vulnerability at www.devbistro.com

Security researcher flux, has submitted on 13/12/2007 a cross-site-scripting XSS vulnerability affecting www.devbistro.com, which at the time of submission ranked 73821 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/01/2008. It is currently...

Unfixed XSS vulnerability at www.aeropostale.com

Security researcher flux, has submitted on 26/10/2007 a cross-site-scripting XSS vulnerability affecting www.aeropostale.com, which at the time of submission ranked 7058 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is currentl...

Unfixed XSS vulnerability at www.dreamddl.com

Security researcher flux, has submitted on 27/09/2007 a cross-site-scripting XSS vulnerability affecting www.dreamddl.com, which at the time of submission ranked 22645 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/10/2007. It is currently...