Team Johnlong RaidenTunes 2.1.1 Cross Site Scripting

Title: Team Johnlong RaidenTunes 2.1.1 Remote Cross-Site Scripting Vulnerability Vendor: RaidenFTPDteam / Team Johnlong Software Product Web Page: http://www.raidentunes.com Summary: RaidenTunes is a Web server based + application software that allows You to setup an online music server quickly. ...

Team Johnlong RaidenTunes 2.1.1 Remote Cross-Site Scripting Vulnerability

Summary RaidenTunes is a Web server based + application software that allows You to setup an online music server quickly. It can scan the music folders in Your PC and organize them into a database, allowing users to connect to this server and browser/search and listen to the music easily...

Team Johnlong RaidenTunes 2.1.1 Remote XSS Vulnerability

Exploit for php platform in category web applications ======================================================== Team Johnlong RaidenTunes 2.1.1 Remote XSS Vulnerability ======================================================== Title: Team Johnlong RaidenTunes 2.1.1 Remote Cross-Site Scripting...

Cross-site Request Forgery (CSRF) in pimcore

High-Tech Bridge SA Security Research Lab has discovered vulnerability in pimcore which could be exploited to perform cross-site request forgery attacks. 1 Cross-site Request Forgery CSRF in pimcore The vulnerability exists due to insufficient validation of the request origin in...

Multiple Vulnerabilities in CMS Source

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in CMS Source, which could be exploited to perform cross-site scripting and SQL Injection attacks and compromise vulnerable system. 1 Cross-site scripting XSS vulnerabilities in CMS Source 1.1 The vulnerability exis...

Multiple Cross-site Scripting (XSS) Vulnerabilities in allinta CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in allinta CMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in allinta CMS 1.1 The vulnerability exists due to input sanitation error in the "langURL"...

Multiple Web Browser Clickjacking Vulnerability (FF3.6.7/SM 2.0.6)

. Mozilla Firefox 3.6.7 & SeaMonkey 2.0.6 Waiting for patch htmlhead meta http-equiv="content-type" content="text/html; charset=UTF-8" titleFF3.6.7/SM 2.0.6 ClickJacking Vulnerability/title /headbody div id="mydiv" onmouseover="document.location='http://www.mozilla.org';" style="border: 0px none ...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 12.2, 13.0, 13.1, and -current to fix security issues. Here are the details from the Slackware 13.1 ChangeLog: patches/packages/mozilla-firefox-3.6.7-i686-1.txz: Upgraded. This fixes some security issues. For more information, see:...

Directory Traversal Vulnerability in Frigate 3 FTP Client

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Frigate 3 built-in FTP client which could be exploited to execute arbitrary code on vulnerable system. 1 Directory Traversal Vulnerability in Frigate 3 FTP Client: CVE-2010-3097 The vulnerability exists due to insufficient...

Cross-site Request Forgery (CSRF) in Open blog

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Open blog which could be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery vulnerabilities in Open blog: CVE-2010-3025 1.1 The vulnerability exists due to insufficient validati...

Inside the Black Energy 2 Botnet

By Dmitry Tarakanov Cybercriminals use a variety of bots to conduct DDoS attacks on Internet servers. One of the most popular tools is called Black Energy. To date, Kaspersky Lab has identified and implemented detection for over 4,000 modifications of this malicious program. In mid-2008 malware...

Rogue AV Live Tech Support

This is a recording of a live chat session with the technical support agent associated with a rogue AV program. The session was recorded by Nicolas Brulez, a security analyst at Kaspersky Lab.The video is best viewed in full-screen mode...

Corel WordPerfect Office X5 15.0.0.357 (wpd) Remote Buffer Preoccupation PoC

Summary Corel® WordPerfect® Office X5 – Standard Edition is the essential office suite for word processing, spreadsheets, presentations and email. Chosen over Microsoft® Office by millions of longtime users, it integrates the latest productivity software with the best of the Web. Work faster and...

Corel WordPerfect Office X5 15.0.0.357 - 'wpd' Buffer Overflow (PoC)

/ - Title: Corel WordPerfect Office X5 15.0.0.357 wpd Remote Buffer Preoccupation PoC - Vendor: Corel Corporation - Product Web Page: http://www.corel.com - Version Tested: 15.0.0.357 Standard Edition - Summary: Corel® WordPerfect® Office X5 – Standard Edition is the essential office suite for wo...

Corel WordPerfect Office X5 15.0.0.357 - wpd Buffer Overflow (PoC)

Corel WordPerfect Office X5 15.0.0.357 - wpd Buffer Overflow PoC / - Title: Corel WordPerfect Office X5 15.0.0.357 wpd Remote Buffer Preoccupation PoC - Vendor: Corel Corporation - Product Web Page: http://www.corel.com - Version Tested: 15.0.0.357 Standard Edition - Summary: Corel® WordPerfect®...

Corel Presentations X5 15.0.0.357 - 'shw' Buffer Preoccupation (PoC)

Title: Corel Presentations X5 15.0.0.357 shw Remote Buffer Preoccupation PoC - Vendor: Corel Corporation - Product Web Page: http://www.corel.com - Version Tested: 15.0.0.357 Standard Edition -Summary: Strengthen your visual impact. Create compelling slideshows, proposals, demonstrations and...

Multiple Cross-site Scripting (XSS) Vulnerabilities in Spitfire

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Spitfire which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in Spitfire 1.1 The vulnerability exists due to input sanitation error in the "cmsid" and...

Xplico 0.5.7 (add.ctp) Remote XSS Vulnerability

Summary The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email POP, IMAP, and SMTP protocols, all HTTP contents, each VoIP call SIP, FTP, TFTP, and so on. Xplico isn’t a network protocol analyzer...

Adobe Reader 9.3.2 Memory Corruption / Denial Of Service

/ Title: Adobe Reader 9.3.2 CoolType.dll Remote Memory Corruption / DoS Vulnerability Summary: Adobe Reader software is the global standard for electronic document sharing. It is the only PDF file viewer that can open and interact with all PDF documents. Use Adobe Reader to view, search, digitall...

Jose Nazario on Politically Motivated DDoS Attacks (Part 3)

In the third part of his talk on politically motivated DDoS attacks at the recent Kaspersky Lab Security Analyst Summit, Jose Nazario of Arbor Networks discusses the tactics and motivations for these attacks...