MTP Image Gallery 1.0 (title) Remote Script Insertion Vulnerability

Summary MTP Image Gallery offers more control, better uploading and enhanced performance. With MTP Image Gallery you can easily create and maintain albums of photos via an intuitive, web interface. Description MTP Image Gallery suffers from a stored XSS vulnerability when parsing user input to th...

MTP Poll 1.0 Multiple Remote Script Insertion Vulnerabilities

Summary More than poll is a polling system with a powerful administration tool. It features: multiple pools, templates, unlimited options, IP Logging, cookie support, and more. Description MTP Poll script suffers from multiple stored cross-site scripting vulnerabilities. The issues are triggered...

MTP Guestbook 1.0 Multiple Remote Script Insertion Vulnerabilities

Summary MTP Guestbook allows you to put a guestbook on your website. Your visitors can sign it and leave a message. The entries can be edited and deleted in the admin area. Description MTP Guestbook script suffers from multiple stored cross-site scripting vulnerabilities. The issues are triggered...

NBC Website Hacked, Leading Visitors to Citadel Banking Malware

Another day, another media company hacked. This time it’s NBC which has fallen to victim hackers on the heels of compromises of the New York Times and Wall Street Journal websites. Various experts have confirmed that NBC’s website is compromised and leading visitors to the dangerous Citadel banki...

Air Transfer 1.2.0 Local File Inclusion

Title: ====== Air Transfer v1.2.0 iPad iPhone - File Include Vulnerability Date: ===== 2013-02-14 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=849 VL-ID: ===== 849 Common Vulnerability Scoring System: ==================================== 6.3 Introduction: ===========...

Piwigo 2.4.6 (install.php) Remote Arbitrary File Read/Delete Vulnerability

Summary Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures. Description Input passed to the 'dl' parameter in 'install.php' script is not properly sanitised before being used to get the contents of a resource or delet...

OpenEMR 4.1.1 Shell Upload

Exploit for php platform in category web applications ?php / OpenEMR 4.1.1 ofcuploadimage.php Arbitrary File Upload Vulnerability Vendor: OpenEMR Product web page: http://www.open-emr.org Affected version: 4.1.1 Summary: OpenEMR is a Free and Open Source electronic health records and medical...

Apple iOS 6.1 - 2x PassCode Bypass Vulnerabilities

Document Title: =============== Apple iOS 6.1 - 2x PassCode Bypass Vulnerabilities References: =========== http://www.vulnerability-lab.com/getcontent.php?id=874 Advisory: http://www.vulnerability-lab.com/getcontent.php?id=875 View: http://www.youtube.com/watch?v=oKOj0GMf810 Release Date:...

Adobe Investigating Reports of Reader Zero-Day Exploit

UPDATE-Attackers are using malicious PDFs posing as an application for an international travel visa to exploit a zero-day vulnerability in Adobe Reader and Acrobat, a researcher at FireEye told Threatpost today. The exploit is the first to escape the sandbox included in Reader X and above. Zheng...

OpenEMR 4.1.1 (ofc_upload_image.php) Arbitrary File Upload Vulnerability

Summary OpenEMR is a Free and Open Source electronic health records and medical practice management application that can run on Windows, Linux, Mac OS X, and many other platforms. Description The vulnerability is caused due to the improper verification of uploaded files in...

AbanteCart 1.1.3 (index.php) Multiple Reflected XSS Vulnerabilities

Summary AbanteCart is a free PHP based eCommerce solution for merchants to provide ability creating online business and sell products online quick and efficient. Description AbanteCart suffers from multiple reflected cross-site scripting vulnerabilities. The issues are triggered when input passed...

Sonicwall Scrutinizer v9.5.2 - SQL Injection Vulnerability

Document Title: =============== Sonicwall Scrutinizer v9.5.2 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=789 9984: Investigate Vulnerability Lab issues this ticket included tracking the creation of our DBI shim to error ...

OpenEMR 4.1.1 - ofc_upload_image.php Arbitrary File Upload

OpenEMR 4.1.1 - ofcuploadimage.php Arbitrary File Upload ?php / OpenEMR 4.1.1 ofcuploadimage.php Arbitrary File Upload Vulnerability Vendor: OpenEMR Product web page: http://www.open-emr.org Affected version: 4.1.1 Summary: OpenEMR is a Free and Open Source electronic health records and medical...

OpenEMR 4.1.1 Shell Upload

?php / OpenEMR 4.1.1 ofcuploadimage.php Arbitrary File Upload Vulnerability Vendor: OpenEMR Product web page: http://www.open-emr.org Affected version: 4.1.1 Summary: OpenEMR is a Free and Open Source electronic health records and medical practice management application that can run on Windows,...

WordPress Wysija Newsletters 2.2 SQL Injection

Advisory ID: HTB23140 Product: Wysija Newsletters WordPress plugin Vendor: Wysija Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Vendor Notification: January 16, 2013 Vendor Patch: January 18, 2013 Public Disclosure: February 6, 2013 Vulnerability Type: SQL Injection CWE-89 CVE...

More from the Kaspersky Lab/Threatpost Security Analyst Summit

Chris Soghoian on Wireless Carriers and Android Security Partial Disclosure Leaves Adobe Reader Zero-Day Story in Limbo Wireless Carriers Put on Notice About Providing Regular Android Security Updates How the RSA Attackers Swung and Missed at Lockheed Martin Scenes from SAS 2012 SAS2013 on Twitte...

Kaspersky Lab Malware Researcher Denis Maslennikov

Denis Maslennikov gave a talk on mobile malware, specifically the mobile components of FinFisher...

At The Ritz-Carlton, San Juan, Puerto Rico

Held annually, this year’s Security Analyst Summit, as always aims to foster conversation and collaboration between Kaspersky Lab researchers and global law enforcement agencies, CERTs and other cyber-crime fighters...

Chris Soghoian on Wireless Carriers and Android Security

youtube http://www.youtube.com/watch?v=EzoACtJk3sI&hl=enUS&version=3 Chris Soghoian of the ACLU discusses the looming crisis of mobile security caused by the failure of mobile carriers to push Android updates to users at the Kaspersky Lab Security Analyst Summit Monday...

Android malware with ability to install Backdoor on Computers

Kaspersky Lab has revealed a new type of malware that can infect your computer when connected smartphone or tablet. Two such application, Super Clean and DroidCleaner found in Google Play android market. These two are actually same application, just released with two different names. These...