Security in a serious way [THN] - eZine Issue 014

Document Title: =============== Security in a serious way THN - eZine Issue 014 References: =========== Download: http://www.vulnerability-lab.com/resources/documents/780.pdf Original: magazine.hackinthebox.org/issues/THN-September2012.pdf Release Date: ============= 2012-11-26 Vulnerability...

Security in a serious way [THN] - eZine Issue 014

Document Title: =============== Security in a serious way THN - eZine Issue 014 References: =========== Download: https://www.vulnerability-lab.com/resources/documents/780.pdf Original: magazine.hackinthebox.org/issues/THN-September2012.pdf Release Date: ============= 2012-11-26 Vulnerability...

PRADO PHP Framework 3.2.0 Arbitrary File Read Vulnerability

Summary PRADO is a component-based and event-driven programming framework for developing Web applications in PHP 5. PRADO stands for PHP Rapid Application Development Object-oriented. Description Input passed to the 'sr' parameter in 'functionaltests.php' is not properly sanitised before being us...

Paypal BBP #2 - Persistent Listing Web Vulnerability

Document Title: =============== Paypal BBP 2 - Persistent Listing Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=634 Release Date: ============= 2012-11-25 Vulnerability Laboratory ID VL-ID: ==================================== 634...

WordPress Plugin Facebook Survey 1.0 - SQL Injection

WordPress Plugin Facebook Survey 1.0 - SQL Injection Title: ====== Wordpress Facebook Survey v1 - SQL Injection Vulnerability Date: ===== 2012-11-18 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=766 VL-ID: ===== 766 Common Vulnerability Scoring System:...

SonicWALL CDP 5040 6.x - Multiple Vulnerabilities

Title: ====== SonicWALL CDP 5040 v6.x - Multiple Web Vulnerabilities Date: ===== 2012-11-19 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=549 VL-ID: ===== 549 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...

LAN.FS Messenger 2.4 - Command Execution

LAN.FS Messenger 2.4 - Command Execution Title: ====== LAN.FS Messenger v2.4 - Command Execution Vulnerability Date: ===== 2012-11-14 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=760 VL-ID: ===== 760 Common Vulnerability Scoring System:...

Multiple Vulnerabilities in Smartphone Pentest Framework (SPF)

Advisory ID: HTB23123 Product: Smartphone Pentest Framework SPF Vendor: Bulb Security LLC Vulnerable Versions: v0.1.2 and probably prior Tested Version: v0.1.2 Vendor Notification: October 24, 2012 Public Disclosure: November 14, 2012 Vulnerability Type: OS Command Injection CWE-78, SQL Injection...

Skype Account Service - Reset (Session) Vulnerability

Document Title: =============== Skype Account Service - Reset Session Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=765 Download: http://www.vulnerability-lab.com/resources/videos/765.wmv View: http://www.youtube.com/watch?v=RPTEaJftNw0 Advisory:...

Stolen NASA Laptop Puts 'Large Number' of Employees at Risk

NASA has enacted new policies to protect employee and other sensitive information after a laptop was stolen from an employee’s locked vehicle, exposing records of personal information on a “large number” of NASA employees. The laptop was not protected by whole disk encryption, NASA officials said...

IrfanView - .TIF Image Decompression Buffer Overflow

IrfanView - .TIF Image Decompression Buffer Overflow Application: IrfanView TIF Image Decompression Buffer Overflow Vulnerability Plateform: Windows Version: The vulnerabilities are confirmed in version 4.33. Other versions may also be affected. Exploitation: Remote code execution Secunia Number:...

Cross-Site Request Forgery (CSRF) in CMS Made Simple

Advisory ID: HTB23121 Product: CMS Made Simple Vendor: cmsmadesimple.org Vulnerable Versions: 1.11.2 and probably prior Tested Version: 1.11.2 Vendor Notification: October 17, 2012 Public Disclosure: November 7, 2012 Vulnerability Type: Cross-Site Request Forgery CWE-352 CVE Reference:...

Eugene Kaspersky Chats With Facebook Users About Malware, Cybercrime and Piracy

Hi, folks! For the last two weeks each and every fan of official Kaspersky Lab Facebook pages worldwide had the chance to ask our CEO, Eugene Kaspersky, anything at all and we must say that some of our fans took this literally: Thank you for the hundreds of great questions! There’s nothing more...

OrangeHRM 2.7.1-rc.1 Cross Site Request Forgery / SQL Injection

Advisory ID: HTB23119 Product: OrangeHRM Vendor: OrangeHRM Inc. Vulnerable Versions: 2.7.1-rc.1 and probably prior Tested Version: 2.7.1-rc.1 Vendor Notification: October 10, 2012 Public Disclosure: October 31, 2012 Vulnerability Type: SQL Injection CWE-89 CVE Reference: CVE-2012-5367 CVSSv2 Base...

NetCat CMS v5.0.1 - Multiple Web Vulnerabilities

Title: ====== NetCat CMS v5.0.1 - Multiple Web Vulnerabilities Date: ===== 2012-10-31 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=738 VL-ID: ===== 738 Common Vulnerability Scoring System: ==================================== 2.5 Introduction: ============= Vendor...

PG Dating Pro v1.0 CMS - Multiple Web Vulnerabilities

Title: ====== PG Dating Pro v1.0 CMS - Multiple Web Vulnerabilities Date: ===== 2012-10-29 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=736 VL-ID: ===== 736 Common Vulnerability Scoring System: ==================================== 8.5 Introduction: =============...

Multiple vulnerabilities in dotProject

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in dotProject, which can be exploited to perform SQL injection and cross-site scripting XSS attacks. 1 SQL Injection in dotProject: CVE-2012-5701 High-Tech Bridge Security Research Lab has discovered multiple SQL injection...

NASA Jet Propulsion Laboratory Vulnerable to Cross Site Scripting (XSS)

Yesterday, we report about the security breach in US Government computers belongs to NASA restricted area website and Hacker dump out the complete source code and files from server of the website. Today another hacker claim a quick XSS Cross site scripting Vulnerability in NASA's Jet Propulsion...

NASA Tri-Agency Climate Education (TrACE) 1.0 XSS

NASA Tri-Agency Climate Education TrACE v1.0 Multiple XSS Vulnerabilities Vendor: NASA Product web page: http://www.nasa.gov Affected version: 1.0 Summary: The Tri-Agency Climate Education TrACE Catalog provides search and browse access to a catalog of educational products and resources. TrACE...

NASA Tri-Agency Climate Education (TrACE) v1.0 SQL Injection Vulnerability

Summary The Tri-Agency Climate Education TrACE Catalog provides search and browse access to a catalog of educational products and resources. TrACE focuses on climate education resources that have been developed by initiatives funded through NASA, NOAA, and NSF, comprising a tri-agency collaborati...