CrushFTP HTTP Injection Vulnerability

CrushFTP is a cross-platform Java FTP server from the U.S. CrushFTP company . A security vulnerability exists in CrushFTP versions prior to 7.8.0 and 8.x versions prior to 8.2.0. No detailed vulnerability details are provided at this time...

Wikileaks Unveils CIA's Man-in-the-Middle Attack Tool

Wikileaks has published a new batch of the Vault 7 leak, detailing a man-in-the-middle MitM attack tool allegedly created by the United States Central Intelligence Agency CIA to target local networks. Since March, WikiLeaks has published thousands of documents and other secret tools that the...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

Chinese ISPs Caught Injecting Ads and Malware into Web Pages

China has gained a considerable global attention when it comes to their Internet policies in the past years; whether it's introducing its own search engine dubbed "Baidu," Great Firewall of China, its homebrew China Operating System COP and many more. Along with the developments, China has long...

Sierra Wireless AirCard 760S/762S/763S Mobile Hotspot CRLF Injection Vulnerability

Sierra Wireless produces a mobile wi-fi hotspot device that is popular amongst telecommunication companies for re-branding to suit local markets. The AirCard 760S/762S/763S Web-based Administrative Console suffers from a HTTP header injection that allows an attacker to inject a file into the HTTP...

PHPList Mailing List Manager 2.x /admin/eventlog.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/15350/info PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input. The application is prone to multiple cross-site...

PHPList Mailing List Manager 2.x /admin/users.php find Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/15350/info PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input. The application is prone to multiple cross-site...

PHPList Mailing List Manager 2.x /admin/admin.php id Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/15350/info PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input. The application is prone to multiple cross-site...

PHPList Mailing List Manager 2.x /admin/editattributes.php id Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/15350/info PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input. The application is prone to multiple cross-site...

i2Ninja Financial Malware Communicates on I2P Darknet

The Mevade botnet made news when it was found to be using the Tor anonymity network to communicate with its command and control infrastructure. Running C&C on Tor, however, turned out to be a fatal mistake when Tor usage spiked alerting administrators to the unusual activity. A group of Russian...

cultbooking 2.0.4 - Multiple Vulnerabilities

cultbooking 2.0.4 - Multiple Vulnerabilities CultBooking 2.0.4 lang Local File Inclusion Vulnerability Vendor: Cultuzz Digital Media GmbH Product web page: http://www.cultuzz.com Affected version: 2.0.4 Summary: Open source hotel booking system Internet Booking Engine IBE. Via a central api calle...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6655)

The TLS/SSLv3 protocol as implemented in openssl prior to this update was not able to associate data to a renegotiated connection. This allowed man-in-the-middle attackers to inject HTTP requests in a HTTPS session without being noticed. For example Apache's modssl was vulnerable to this kind of...

Oracle WebLogic Server Plug-in HTTP Injection

The remote web server is using the WebLogic plug-in for Apache, IIS, or Sun web servers, a module included with Oracle formerly BEA WebLogic Server and used to proxy requests from an HTTP server to WebLogic. The version of this plug-in on the remote host is affected by an HTTP injection...

CVE-2010-2375: WebLogic Plugin HTTP Injection via Encoded URLs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: WebLogic Plugin HTTP Injection via Encoded URLs Release Date: 2010-07-13 Application: WebLogic Plugin...

WebLogic Plugin HTTP Injection Via Encoded URLs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: WebLogic Plugin HTTP Injection via Encoded URLs Release Date: 2010-07-13 Application: WebLogic Plugin...

CVE-2010-2504

Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allows remote authenticated users to obtain sensitive information via HTTP header injection, aka SPL-31066...

JSBoard 2.0.10 - login.php?table Local File Inclusion

JSBoard 2.0.10 - login.php?table Local File Inclusion !/usr/bin/perl jsboard 2.0.10login.php tableLocal File Inclusion Exploit D.Script: http://kldp.net/frs/download.php/1729/jsboard-2.0.10.tar.gz if$table && fileexists"data/$table/config.php" include "data/$table/config.php"; Discovered & Coded ...

PHPList Mailing List Manager 2.x - adminusers.php?find Cross-Site Scripting

PHPList Mailing List Manager 2.x - adminusers.php?find Cross-Site Scripting source: https://www.securityfocus.com/bid/15350/info PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input. The...

PHPList Mailing List Manager 2.x - admineditattributes.php?id SQL Injection

PHPList Mailing List Manager 2.x - admineditattributes.php?id SQL Injection source: https://www.securityfocus.com/bid/15350/info PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input. The...

PHPList Mailing List Manager 2.x - adminconfigure.php?id Cross-Site Scripting

PHPList Mailing List Manager 2.x - adminconfigure.php?id Cross-Site Scripting source: https://www.securityfocus.com/bid/15350/info PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input. The...