Remote Buffer Overflow Vulnerability in Samsung Kies

Advisory ID: HTB23136 Product: Samsung Kies Vendor: Samsung Electronics Vulnerable Versions: 2.5.0.121141 Tested Version: 2.5.0.121141 on Windows 7 SP1 and Internet Explorer 9.0 Vendor Notification: December 19, 2012 Vendor Patch: December 27, 2012 Public Disclosure: January 9, 2013 Vulnerability...

Samsung Kies - Remote Buffer Overflow

Samsung Kies - Remote Buffer Overflow source: https://www.securityfocus.com/bid/57249/info Samsung Kies is prone to a remote buffer-overflow vulnerability because it fails to properly validate user-supplied input before copying it into a fixed-length buffer. Attackers can exploit this issue to...

Wordpress Valums Uploader - File Upload Vulnerability

Document Title: =============== Wordpress Valums Uploader - File Upload Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=817 Release Date: ============= 2013-01-04 Vulnerability Laboratory ID VL-ID: ==================================== 817...

Travis Goodspeed - Prototyping Active Disk Antiforensics

Document Title: =============== Travis Goodspeed - Prototyping Active Disk Antiforensics References: =========== View: http://www.youtube.com/watch?v=qZtkANvDxZA Release Date: ============= 2013-01-04 Vulnerability Laboratory ID VL-ID: ==================================== 818 Common Vulnerability...

Google Begins Blocking Silent Extension Installations with Chrome 25

Google announced late last week it would begin halting the silent installation of extensions on its flagship Chrome browser. In a post on the company’s Chromium Blog, Chrome’s Product Manager Peter Ludwig described the problem that led to the change and two new features present on the latest...

Elite Bulletin Board 2.1.21 - Multiple SQL Injections

Elite Bulletin Board 2.1.21 - Multiple SQL Injections Advisory ID: HTB23133 Product: Elite Bulletin Board Vendor: elite-board.us Vulnerable Versions: 2.1.21 and probably prior Tested Version: 2.1.21 Vendor Notification: November 28, 2012 Vendor Patch: December 6, 2012 Public Disclosure: December...

Elite Bulletin Board 2.1.21 SQL Injection

Advisory ID: HTB23133 Product: Elite Bulletin Board Vendor: elite-board.us Vulnerable Versions: 2.1.21 and probably prior Tested Version: 2.1.21 Vendor Notification: November 28, 2012 Vendor Patch: December 6, 2012 Public Disclosure: December 19, 2012 Vulnerability Type: SQL Injection CWE-89 CVE...

Banana Dance B.2.6 Inclusion / Access Control / SQL Injection

Banana Dance version B.2.6 suffers from local file inclusion, remote SQL injection, and improper access control vulnerabilities. Product: Banana Dance Vendor: bananadance.org Vulnerable Versions: B.2.6 and probably prior Tested Version: B.2.6 Vendor Notification: October 3, 2012 Public Disclosure...

Banana Dance B.2.6 Inclusion / Access Control / SQL Injection

Advisory ID: HTB23118 Product: Banana Dance Vendor: bananadance.org Vulnerable Versions: B.2.6 and probably prior Tested Version: B.2.6 Vendor Notification: October 3, 2012 Public Disclosure: December 19, 2012 Vulnerability Type: PHP File Inclusion CWE-98, Improper Access Control CWE-284, SQL...

Elite Bulletin Board 2.1.21 SQL Injection Vulnerability

Elite Bulletin Board version 2.1.21 suffers from multiple remote SQL injection vulnerabilities. Product: Elite Bulletin Board Vendor: elite-board.us Vulnerable Versions: 2.1.21 and probably prior Tested Version: 2.1.21 Vendor Notification: November 28, 2012 Vendor Patch: December 6, 2012 Public...

Iran CERT Reports New Data-Wiping Malware

Computer systems in Iran are being targeted by a new strain of malware that is capable of wiping disk partitions clean of files. Security researchers are calling the attacks simplistic, yet effective. Researchers at Kaspersky Lab said the malware launches only on pre-determined dates and will...

TVMOBiLi Media Server Multiple Remote DoS Vulnerabilities

Advisory ID: HTB23120 Product: TVMOBiLi media server Vendor: TVMOBiLi Vulnerable Versions: 2.1.0.3557 and probably prior version Tested Version: 2.1.0.3557 in Windows XP SP3 32 bits Vendor Notification: October 15, 2012 Vendor Patch: November 21, 2012 Public Disclosure: December 5, 2012...

TVMOBiLi 2.1.0.3557 - Denial of Service

Advisory ID: HTB23120 Product: TVMOBiLi media server Vendor: TVMOBiLi Vulnerable Versions: 2.1.0.3557 and probably prior version Tested Version: 2.1.0.3557 in Windows XP SP3 32 bits Vendor Notification: October 15, 2012 Vendor Patch: November 21, 2012 Public Disclosure: December 5, 2012...

Achievo 1.4.5 - Multiple Vulnerabilities (2)

Achievo 1.4.5 - Multiple Vulnerabilities 2 Advisory ID: HTB23126 Product: Achievo Vendor: www.achievo.org Vulnerable Versions: 1.4.5 and probably prior Tested Version: 1.4.5 Vendor Notification: November 14, 2012 Public Disclosure: December 5, 2012 Vulnerability Type: SQL Injection CWE-89,...

NVIDIA Install Application 2.1002.85.551 (NVI2.dll) Unicode Buffer Overflow PoC

Summary NVIDIA install core application for Windows. Description The vulnerability is caused due to a boundary error in NVI2.DLL when handling the value assigned to the 'pDirectory' string variable in the 'AddPackages' function and can be exploited to cause a unicode buffer overflow by inserting ...

Algerian Hacker hijack Romanian Google and Yahoo Domain

Algerian Hacker today hijack DNS Yahoo, Microsoft or Google and Paypal redirect users to a deface page. Credit being taken by Hacker going by name MCA-CRB, a serial website defacer. MCA-CRB is a prolific online graffiti artist who has defaced at least 5,000 sites, according to records kept by...

Update: Attack on Romanian TLD Register led to Google, Yahoo Defacements and DNS Redirects

UPDATE — DNS hijacking attacks carried out today against the home pages of Google, Yahoo and other high-profile sites in Romania have been traced to an attack on the Romanian Top Level Domain Register, researchers at Kaspersky Lab said. “The altered DNS records propagated from there to different...

Multiple SQL Injection Vulnerabilities in Elite Bulletin Board

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Elite Bulletin Board, which can be exploited to perform SQL injection attacks. 1 Multiple SQL injection vulnerabilities in Elite Bulletin Board: CVE-2012-5874 The vulnerabilities exist due to insufficient sanitation of...

PayPal Plaza Cross Site Scripting

Title: ====== Paypal Bug Bounty 21 - Persistent Encoding Vulnerability Date: ===== 2012-11-25 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=684 VL-ID: ===== 684 Common Vulnerability Scoring System: ==================================== 3 Introduction: =============...

Narilam malware target Iran Financial SQL Databases

Symantec recently identified a database-corrupting piece of malware targeting systems mostly in Iran, but despite early speculation that it could be related to the likes of Stuxnet and Flame, it appears to be targeting small businesses rather than the country's infrastructure. Malware Dubbed...