Piwigo 2.7.3 Cross Site Scripting / SQL Injection Vulnerabilities

CMS Piwigo versions 2.7.3 and below suffer from cross site scripting and remote SQL injection vulnerabilities. Reflecting XSS- and SQL Injection vulnerability in CMS Piwigo = v. 2.7.3 Author: Steffen Rösemann Affected Software: CMS Piwigo = v. 2.7.3 Release date: 9th January 2015 Vendor URL:...

Gold Partner: security researchers discovered Flash 0day vulnerability with BEDEP virus there is a close Association-vulnerability warning-the black bar safety net

2 0 1 5 year at the beginning of the Adobe Flash sequential burst more0dayvulnerability, and has not been repaired when it waslarge-scale malicious usethe. Recently, Trend Micro security researchers in Adobe 0day vulnerabilities in the tracking survey, found BEDEP series virus with the Adobe Flas...

Collect DNS Records Passively: PassiveDNS

Collect DNS Records Passively A tool to collect DNS records passively to aid Incident handling, Network Security Monitoring NSM and general digital forensics. PassiveDNS sniffs traffic from an interface or reads a pcap-file and outputs the DNS-server answers to a log file. PassiveDNS can...

Enter: CSRF token leakage

Hi, I have noticed that when the account verification fails here : https://wallet.robocoin.com/verify/ due to an error, the CSRF token is being leaked via GET method like : https://wallet.robocoin.com/verify/id?csrf=b8ede20d-0c0b-4e16-9d05-6ad2ed8b72c4 So the authenticity token is being stored in...

Veeam Backup & Replication console slow or unresponsive

The Veeam Backup & Replication console is slow to respond when switching between different views. The issue is more noticeable when attempting to search through the history of jobs...

Threat Outbreak Alert RuleID13303: Email Messages Distributing Malicious Software on January 28, 2015

Medium Alert ID: 37204 First Published: 2015 January 28 19:13 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13303 may contain the following files: Name |...

Threat Outbreak Alert RuleID13236: Email Messages Distributing Malicious Software on January 22, 2015

Medium Alert ID: 37130 First Published: 2015 January 23 15:53 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13236 may contain the following files: Name |...

Oracle E-Business Multiple Vulnerabilities (January 2015 CPU)

The version of Oracle E-Business installed on the remote host is missing the January 2015 Oracle Critical Patch Update CPU. It is, therefore, affected by vulnerabilities in the following components : - Oracle Application Object Library - Oracle Applications DBA - Oracle Applications DBA - Oracle...

Threat Outbreak Alert RuleID13218: Email Messages Distributing Malicious Software on January 21, 2015

Medium Alert ID: 37110 First Published: 2015 January 22 14:45 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13218 may contain the following files: Name |...

Unspecified Vulnerability in Oracle E-Business Suite Oracle Customer Interaction History Component

Oracle E-Business Suite is a new generation of e-business suite from Oracle. A security vulnerability exists in the Oracle Customer Interaction History component of Oracle E-Business Suite, which allows remote attackers to exploit the vulnerability to compromise the confidentiality, integrity of...

CVE-2014-6572

Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to List of Values...

Threat Outbreak Alert RuleID13113: Email Messages Distributing Malicious Software on January 14, 2015

Medium Alert ID: 37012 First Published: 2015 January 15 14:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13113 may contain the following files: Name |...

Threat Outbreak Alert RuleID12980: Email Messages Distributing Malicious Software on December 24, 2014

Medium Alert ID: 36891 First Published: 2015 January 5 15:05 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID12980 may contain the following files: Name |...

[SECURITY] Fedora 21 Update: subversion-1.8.11-1.fc21

Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file...

Maxthon Cloud Browser application Address Bar Spoofing Vulnerability

Maxthon is a versatile, personalized multi-tab browser based on the IE kernel. An address bar spoofing vulnerability exists in Maxthon Cloud Browser application versions prior to 4.1.6.2000, which allows remote attackers to spoof the address bar via JavaScript code crafted to use API history...

Enter: stored xss in transaction

Open wallet settings and remove maxlength="30" from wallet name input 2. Change name to something like this asdf'"alert1 3. Go to "Send bitcoin" and make inbound transfer from one wallet to another with description: descalert'xss in description' 4. Submit form 5. After submit we got xss both in...

CeWL - Custom WordList Generator Tool for Password Cracking

CeWL is a ruby app which spiders a given url to a specified depth, optionally following external links, and returns a list of words which can then be used for password crackers such as John the Ripper. CeWL also has an associated command line app, FAB Files Already Bagged which uses the same meta...

CVE-2014-1449

The Maxthon Cloud Browser application before 4.1.6.2000 for Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses the history API...

CVE-2014-1449

The Maxthon Cloud Browser application before 4.1.6.2000 for Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses the history API...

Threat Outbreak Alert RuleID12972: Email Messages Distributing Malicious Software on December 23, 2014

Medium Alert ID: 36887 First Published: 2014 December 24 12:54 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID12972 may contain the following files: Name |...