Centreon 2.6.1 Command Injection Vulnerability

Summary Centreon is the choice of some of the world's largest companies and mission-critical organizations for real-time IT performance monitoring and diagnostics management. Description The POST parameter 'persistant' which serves for making a new service run in the background is not properly...

Centreon 2.6.1 Unrestricted File Upload Vulnerability

Summary Centreon is the choice of some of the world's largest companies and mission-critical organizations for real-time IT performance monitoring and diagnostics management. Description The vulnerability is caused due to the improper verification of uploaded files via the 'filename' POST...

Mango Automation 2.6.0 Unprotected Debug Log View Vulnerability

Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description Mango Automation suffers from...

Mango Automation 2.6.0 CSRF Arbitrary Command Execution Exploit

Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description The POST parameter 'c0-param0...

Joomla Spider Random Article Component - SQL Injection

Exploit Title : Joomla Spider Random Article Component SQL Injection vulnerability Author : Jagriti Sahu AKA Incredible Vendor Link : http://demo.web-dorado.com/spider-random-article.html Date : 22/03/2015 Discovered at : IndiShell Lab Love to : error1046 ^^ ,Team IndiShell,Codebreaker ICA...

iTop 2.1.0-2127 Cross Site Scripting Vulnerability

iTop version 2.1.0-2127 suffers from a cross site scripting vulnerability. Product: iTop Vendor: Combodo SARL Vulnerable Versions: 2.1.0-2127 and probably prior Tested Version: 2.1.0-2127 Advisory Publication: July 29, 2015 without technical details Vendor Notification: July 29, 2015 Vendor Patch...

SMF (Simple Machine Forum) 2.0.10 Remote Memory Exfiltration

!/usr/bin/python -- coding: iso-8859-15 -- Title: SMF Simple Machine Forum Filippo Roncari Truel Lab http://lab.truel.it Requirements: SMF = 2.0.10 PHP = 5.6.11 / 5.5.27 / 5.4.43 Advisories: TL-2015-PHP04 http://lab.truel.it/d/advisories/TL-2015-PHP04.txt TL-2015-PHP06...

SMF (Simple Machine Forum) 2.0.10 - Remote Memory Exfiltration

!/usr/bin/python -- coding: iso-8859-15 -- Title: SMF Simple Machine Forum Filippo Roncari Truel Lab http://lab.truel.it Requirements: SMF = 2.0.10 PHP = 5.6.11 / 5.5.27 / 5.4.43 Advisories: TL-2015-PHP04 http://lab.truel.it/d/advisories/TL-2015-PHP04.txt TL-2015-PHP06...

iTop 2.1.0-2127 Cross Site Scripting

Advisory ID: HTB23268 Product: iTop Vendor: Combodo SARL Vulnerable Versions: 2.1.0-2127 and probably prior Tested Version: 2.1.0-2127 Advisory Publication: July 29, 2015 without technical details Vendor Notification: July 29, 2015 Vendor Patch: July 30, 2015 Public Disclosure: September 23, 2015...

My.WiFi USB Drive v1.0 iOS - File Upload Web Vulnerability

Document Title: =============== My.WiFi USB Drive v1.0 iOS - File Upload Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1589 Release Date: ============= 2015-09-23 Vulnerability Laboratory ID VL-ID: ====================================...

Adobe Patches 23 Vulnerabilities in Flash Player

Adobe has released a Flash Player update that addresses 23 critical vulnerabilities in the software, many which can lead to code execution. Version 18.0.0.231 and earlier of Flash Player for Windows and Mac, Microsoft Edge and Internet Explorer 11 in Windows 10, and Internet Explorer 10 and 11, a...

Changes in Experimental Support for XenApp and Multiple GPUs

What are Experimental Features? This article covers a product configuration or procedure for which Citrix does not currently offer support. Use of this configuration should only be used in a lab or test environment and not with production deployments. Experimental features are occasionally releas...

ATM (Cash Machine) - Default Password Setup Vulnerability

Document Title: =============== ATM Cash Machine - Default Password Setup Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1596 Video: https://www.youtube.com/watch?v=v9pSMz96FlU Release Date: ============= 2015-09-11 Vulnerability Laboratory ID VL-ID:...

Spotify - CSRF Privilege Escalation Vulnerability

Document Title: =============== Spotify - CSRF Privilege Escalation Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1594 Video: https://www.youtube.com/watch?v=1qjz0rC6Zy0 Release Date: ============= 2015-09-04 Vulnerability Laboratory ID VL-ID:...

New Versions of Carbanak Banking Malware Seen Hitting Targets in U.S. and Europe

New variants of the notorious Carbanak Trojan have surfaced in Europe and the United States, and researchers say that the malware now has its own proprietary communications protocol and the samples seen so far have been digitally signed. Carbanak has been in use for several years, and researchers...

PayPal - Mobile Security Approval Auth Bypass Vulnerability

Document Title: =============== PayPal - Mobile Security Approval Auth Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1485 Video: https://www.youtube.com/watch?v=Gzq8TD2Co9Y Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1486 Release...

Cerb 7.0.3 - Cross-Site Request Forgery

Advisory ID: HTB23269 Product: Cerb Vendor: Webgroup Media LLC Vulnerable Versions: 7.0.3 and probably prior Tested Version: 7.0.3 Advisory Publication: August 12, 2015 without technical details Vendor Notification: August 12, 2015 Vendor Patch: August 14, 2015 Public Disclosure: September 2, 201...

Cerb 7.0.3 Cross Site Request Forgery Vulnerability

Cerb version 7.0.3 suffers from a cross site request forgery vulnerability. Product: Cerb Vendor: Webgroup Media LLC Vulnerable Versions: 7.0.3 and probably prior Tested Version: 7.0.3 Advisory Publication: August 12, 2015 without technical details Vendor Notification: August 12, 2015 Vendor Patc...

Cerb 7.0.3 Cross Site Request Forgery

Advisory ID: HTB23269 Product: Cerb Vendor: Webgroup Media LLC Vulnerable Versions: 7.0.3 and probably prior Tested Version: 7.0.3 Advisory Publication: August 12, 2015 without technical details Vendor Notification: August 12, 2015 Vendor Patch: August 14, 2015 Public Disclosure: September 2, 201...

Encryption, Lock Mechanism Vulnerabilities Plague Lock App AppLock

Multiple weaknesses exist in AppLock, a popular lock application for Android devices that boasts more than 100 million users. A researcher is claiming that the app, which is supposed to securely store photos, videos and other apps, doesn’t really use encryption to do so, it simply hides the files...