Atlassian JIRA v6.0.3 Arbitrary HTML/Script Execution Vulnerability

Summary JIRA is an issue tracking project management software for teams planning, building, and launching great products. Description JIRA suffers from a reflected XSS issue due to a failure to properly sanitize user-supplied input to the 'name' GET parameter in the 'deleteuserconfirm.jsp' script...

PuTTY SSH handshake heap overflow

PuTTY SSH handshake heap overflow CVE-2013-4852 Description: PuTTY versions 0.62 and earlier - as well as all software that integrates these versions of PuTTY - are vulnerable to an integer overflow leading to heap overflow during the SSH handshake before authentication, caused by improper bounds...

Microsoft Yammer SN - oAuth Bypass Token Vulnerability

Document Title: =============== Microsoft Yammer SN - oAuth Bypass Token Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1043 View: http://www.youtube.com/watch?v=SwxWNvmOsU4 Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1003 Microsoft...

Facebook Bug Bounty - Canvas & Web URL Filter Bypass

Document Title: =============== Facebook Bug Bounty - Canvas & Web URL Filter Bypass References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1036 View: http://www.youtube.com/watch?v=Pw24BsLHYk Release Date: ============= 2013-07-28 Vulnerability Laboratory ID VL-ID:...

Windu CMS 2.2 Multiple Persistent Cross-Site Scripting Vulnerabilities

Summary Windu CMS is a simple, lightweight and fun-to-use website content management software. Description Multiple stored XSS vulnerabilities exist when parsing user input to the 'name' and 'username' POST parameters. Attackers can exploit these weaknesses to execute arbitrary HTML and script co...

ePhoto Transfer 1.2.1 iOS - Multiple Vulnerabilities

ePhoto Transfer 1.2.1 iOS - Multiple Vulnerabilities Title: ====== ePhoto Transfer v1.2.1 iOS - Multiple Web Vulnerabilities Date: ===== 2013-07-17 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1017 VL-ID: ===== 1017 Common Vulnerability Scoring System:...

Multiple Vulnerabilities in BigTree CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in BigTree CMS, which can be exploited to perform SQL injection, Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF attacks. A remote attacker can add, modify or delete information in application's database and...

Dell Kace 1000 SMA 5.4.70402 - Persistent Cross-Site Scripting

Title: ====== Dell Kace 1000 SMA v5.4.70402 - Persistent Vulnerabilities Date: ===== 2013-07-16 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=833 VL-ID: ===== 833 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...

Operation Troy espionage campaign : Hackers steal South Korean military secrets

McAfee Lab researchers issued a report on the large scale cyber attacks against South Korea that appear to be linked to hackers also specialized in cyber espionage. The attackers behind these recent attacks against South Korean infrastructure are skilled professionals and they designed a...

Facebook Bug Bounty #8 - Multiple Vulnerabilities

Document Title: =============== Facebook Bug Bounty 8 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=993 Release Date: ============= 2013-07-06 Vulnerability Laboratory ID VL-ID: ==================================== 993 Common...

Kasseler CMS 2 r1223 - Multiple Vulnerabilities

Kasseler CMS 2 r1223 - Multiple Vulnerabilities Advisory ID: HTB23158 Product: Kasseler CMS Vendor: Kasseler CMS Vulnerable Versions: 2 r1223 and probably prior Tested Version: 2 r1223 Vendor Notification: May 29, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type...

Kasseler CMS 2 r1223 CSRF / XSS / SQL Injection Vulnerabilities

Kasseler CMS version 2 r1223 suffers from cross site request forgery, cross site scripting, and remote SQL injection vulnerabilities. Vendor: Kasseler CMS Vulnerable Versions: 2 r1223 and probably prior Tested Version: 2 r1223 Vendor Notification: May 29, 2013 Vendor Patch: June 28, 2013 Public...

Kasseler CMS 2 r1223 CSRF / XSS / SQL Injection

Advisory ID: HTB23158 Product: Kasseler CMS Vendor: Kasseler CMS Vulnerable Versions: 2 r1223 and probably prior Tested Version: 2 r1223 Vendor Notification: May 29, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting...

MSN Hotmail - Password Reset (Session) Web Vulnerability

Document Title: =============== MSN Hotmail - Password Reset Session Web Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=994 Video: https://www.youtube.com/watch?v=INq6CirLgt0 Release Date: ============= 2013-06-29 Vulnerability Laboratory ID VL-ID:...

MSN Hotmail - Password Reset (Session) Web Vulnerability

Document Title: =============== MSN Hotmail - Password Reset Session Web Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=994 Video: https://www.youtube.com/watch?v=INq6CirLgt0 Release Date: ============= 2013-06-29 Vulnerability Laboratory ID VL-ID:...

AVAST Internet Security Suite - Persistent Vulnerabilities

Document Title: =============== AVAST Internet Security Suite - Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=969 Release Date: ============= 2013-06-26 Vulnerability Laboratory ID VL-ID: ====================================...

GLPI 0.83.7 Parameter Traversal Arbitrary File Access Vulnerability

GLPI version 0.83.7 suffers from a parameter traversal vulnerability that allows for arbitrary file access. GLPI v0.83.7 itemtype Parameter Traversal Arbitrary File Access Exploit Vendor: INDEPNET Development Team Product web page: http://www.glpi-project.org Affected version: 0.83.7 Summary: GLP...

GLPI 0.83.7 Parameter Traversal Arbitrary File Access

GLPI v0.83.7 itemtype Parameter Traversal Arbitrary File Access Exploit Vendor: INDEPNET Development Team Product web page: http://www.glpi-project.org Affected version: 0.83.7 Summary: GLPI, an initialism for Gestionnaire libre de parc informatique Free Management of Computer Equipment, was...

Multiple XSS Vulnerabilities in Jahia xCM

High-Tech Bridge Security Research Lab discovered multiple XSS vulnerabilities in Jahia xCM, which can be exploited to perform cross-site scripting attacks against administrator of vulnerable application. 1 Multiple Cross-Site Scripting XSS Vulnerabilites in Jahia xCM: CVE-2013-4624 1.1 The...

Surveillance malware targets 350 high profile victims in 40 countries

A global cyber espionage campaign affecting over 350 high profile victims in 40 countries, appears to be the work of Chinese hackers using a Surveillance malware called "NetTraveler". Kaspersky Lab’s team of experts published a new research report about NetTraveler, which is a family of malicious...