Electronic Arts Origin Client 9.5.5 Multiple Privilege Escalation Vulnerabilities

Summary Origin formerly EA Download Manager EADM is digital distribution software from Electronic Arts that allows users to purchase games on the internet for PC and mobile platforms, and download them with the Origin client formerly EA Download Manager, EA Downloader and EA Link. Description The...

Ramnit Botnet Shut Down

The Ramnit botnet, a favorite among thieves dabbling in financial fraud for its frequent updates, has been shut down in a joint effort spearheaded by Europol’s European Cybercrime Centre EC3. In a statement today, EC3 said investigators from across Europe, along with Microsoft, AnubisNetworks and...

Alienware Command Center 2.8.8.0 Local Privilege Escalation

Summary Alienware Command Center is a software program developed by Alienware. The most common release is 2.8.8.0, with over 98% of all installations currently using this version. During setup, the program creates a startup registration point in Windows in order to automatically start when any us...

Realtek 11n Wireless LAN Utility Privilege Escalation

Summary Realtek 11n Wireless LAN utility is deployed and used by realtek alfa cards and more in order to help diagnose and view wireless card properties. Description The application suffers from an unquoted search path issue impacting the Realtek Service 'Realtek11nSU' and 'Realtek11nCU' for...

Costin Raiu on the Equation Group APT

CANCUN–Dennis Fisher talks with Costin Raiu of the Kaspersky Lab GReAT team about the researcher behind the Equation Group campaign, the group’s capabilities and why they seem to have gone dark now. READ Massive Decades Long Cyberespionage Campaign Uncovered READ Inside nls933w.dll, the Equation...

Facebook CSRF / Session Manipulation

Document Title: =============== Facebook Bug Bounty 23 - Session ID & CSRF Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1432 Facebook Security ID: 10202805822321483 Video: https://www.youtube.com/watch?v=SAr2AGLrBkQ Vulnerability Magazin...

u5CMS 3.9.3 Multiple SQL Injection Vulnerabilities

Summary u5CMS is a little, handy Content Management System for medium-sized websites, conference / congress / submission administration, review processes, personalized serial mails, PayPal payments and online surveys based on PHP and MySQL and Apache. Description Input passed via multiple...

u5CMS 3.9.3 (thumb.php) Local File Inclusion Vulnerability

Summary u5CMS is a little, handy Content Management System for medium-sized websites, conference / congress / submission administration, review processes, personalized serial mails, PayPal payments and online surveys based on PHP and MySQL and Apache. Description u5CMS suffers from an authenticat...

T Mobile Internet Manager - DLL Hijacking (mfc71enudll)

Document Title: =============== T Mobile Internet Manager - DLL Hijacking mfc71enudll References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1434 Video: https://www.youtube.com/watch?v=C3PjVOxWvvw Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1427 Release Date:...

Army Research Lab Releases Dshell Forensics Framework

The U.S. Army has released to open source an internal forensics analysis framework that the Army Research Lab has been using for some time. The framework, known as Dshell, is a Python tool that runs on Linux and its designed to help analysts investigate compromises within their environments. The...

Connection Disclosed Between Regin, Five Eyes Malware Platform

Researchers at Kaspersky Lab have discovered shared code and functionality between the Regin malware platform and a similar platform described in a newly disclosed set of Edward Snowden documents 10 days ago by Germany’s Der Spiegel. The link, found in a keylogger called QWERTY allegedly used by...

Barracuda Networks Cloud Series - Filter Bypass

Barracuda Networks Cloud Series - Filter Bypass Document Title: =============== Barracuda Networks Cloud Series - Filter Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=754 Barracuda Networks Security ID BNSEC: 731 Release Date:...

ecommerceMajor SQL Injection Vulnerability

ecommerceMajor suffers from remote SQL injection vulnerabilities. Exploit Title : ecommercemajor ecommerce CMS SQL Injection and Authentication bypass Author : Manish Kishan Tanwar Home page Link : https://github.com/xlinkerz/ecommerceMajor Date : 22/01/2015 Discovered at : IndiShell Lab Love to ...

ecommerceMajor SQL Injection

Exploit Title : ecommercemajor ecommerce CMS SQL Injection and Authentication bypass Author : Manish Kishan Tanwar Home page Link : https://github.com/xlinkerz/ecommerceMajor Date : 22/01/2015 Discovered at : IndiShell Lab Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,jagriti,Kishan...

Regin Cyberespionage Malware Platform Modules Disclosed

The Regin malware platform used to steal secrets from government agencies, banks and GSM network operators caught the attention of security experts who called it one of the most advanced attack platforms that has been studied, surpassing Flame, Duqu, even Stuxnet. Researchers at Kaspersky Lab sai...

PhotoSync 1.1.3 Android - Command Inject Vulnerability

Document Title: =============== PhotoSync 1.1.3 Android - Command Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1410 Release Date: ============= 2015-01-21 Vulnerability Laboratory ID VL-ID: ==================================== 141...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 14.1 and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mozilla-thunderbird-31.4.0-i486-1slack14.1.txz: Upgraded. This release contains security fixes and improvements. For more...

django-badgify-lab (0.1.5), django-codenerix (1.0.0) +3 more potentially affected by CVE-2014-9601 via pillow (>=2.0.0, <=2.6.1)

pillow PYPI version =2.0.0, =1.0.0, =1.0.2 - groupyapi 0.7.1 - planadversity 1.0.2 Source cves: CVE-2014-9601 Source advisory: OSV:PYSEC-2015-16...

django-badgify-lab (0.1.5), django-codenerix (1.0.0) +3 more potentially affected by CVE-2014-9601 via pillow (>=2.0.0, <=2.6.1)

pillow PYPI version =2.0.0, =1.0.0, =1.0.2 - groupyapi 0.7.1 - planadversity 1.0.2 Source cves: CVE-2014-9601 Source advisory: MEND:CVE-2014-9601...

Banana Dance Wiki CMS b2.x - Multiple Web Vulnerabilities

Document Title: =============== Banana Dance Wiki CMS b2.x - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1407 Release Date: ============= 2015-01-16 Vulnerability Laboratory ID VL-ID: ====================================...