phpwiki 1.5.4 - Cross Site Scripting / Local File Inclusion Vulnerabilities

Exploit for php platform in category web applications Title: phpwiki 1.5.4 - Cross Site Scripting / Local File Inclusion Date: 29.08.15 Vendor: sourceforge.net/projects/phpwiki/ Affected versions: = 1.5.4 current Tested on: Apache2.2 / PHP5 / Deb32 Author: Smash Contact: smash at devilteam.pl 1/...

Details Surface on Patched Sandbox Violation Vulnerability in iOS

Apple patched an issue last week in iOS that could have allowed attackers to bypass the third-party app-sandbox protection mechanism on devices and read arbitrary managed preferences via a special app. The issue, which was present in versions of iOS prior to 8.4.1, stems from a vulnerability with...

CVE-2015-5749

The Sandboxprofiles component in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app...

CVE-2015-3793

CFPreferences in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app...

Design/Logic Flaw

CFPreferences in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app...

Code injection

Apple OS X before 10.10.5 does not properly restrict access to the Date & Time preferences pane, which allows local users to spoof the time by visiting this pane...

CVE-2015-3757

CVE-2015-3757 affects Apple OS X up to macOS Yosemite, specifically OS X before 10.10.5. The Date & Time preference pane could be accessed locally to spoof system time, enabling a local user to alter time settings via that pane. Connected sources confirm this is addressed by Apple’s OS X 10.10.5 ...

CVE-2015-3757

Apple OS X before 10.10.5 does not properly restrict access to the Date & Time preferences pane, which allows local users to spoof the time by visiting this pane...

thunderbird security update

31.7.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 31.7.0-1 - Update to 31.7.0...

Apple Mac OS X Rootpipe Hidden Backdoor API Patch

UPDATE: Apple patched the so-called Rootpipe backdoor in OS X, but only in current versions of Yosemite. According to the researcher who found the vulnerability, Apple told him that it would not backport the fix to 10.9.x and older. The vulnerability, located in the OS X Admin framework, was...

CVE-2014-2027

eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the 1 addrfields or 2 trans parameter to addressbook/csvimport.php, 3 calfields or 4 trans parameter to calendar/csvimport.php, 5...

Phabricator: XSS with Time-of-Day Format

Go to your user preferences - Put the following into Time-of-Day Format with the quote: '' - Open a repository diffusion - XSS-Popup The repository file-overview is the only place where I could see the XSS so far. Because it's a user own preference, it is not easy to actually do something...

Beehive Forum Cross-Site Scripting Vulnerability

Beehive Forum is a set of Web forum software based on PHP and MySQL. The software provides text filtering, user rights management and e-mail notification. A cross-site scripting vulnerability exists in the editprefs.php script in Beehive Forum version 1.4.4, which stems from the program's failure...

CVE-2015-1453

The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences...

Hardcoded credentials

The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences...

CVE-2015-1453

CVE-2015-1453 affects Fortinet FortiClient for Android 5.2.3.091, where the qm class uses a hardcoded encryption key (FoRtInEt!AnDrOiD). This enables an attacker to decrypt data stored in Shared Preferences and potentially obtain passwords or other sensitive data. The available sources describe t...

CVE-2015-1453

The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences...

OS X Spotlight vulnerability will reveal the IP address and other system details-vulnerability warning-the black bar safety net

! OS X mail users using the OS X Spotlight search function, it will display in the search results message. Spotlight ignores mail the application to the remote content of the prohibited load, and the remote mail file as the search process is loaded. When Spotlight finished loading can track The...

Zoner-Photo-Studio-15-Build-3

Exploit Title: Zoner Photo Studio v15 Build 3 Zps.exe Registry Value Parsing Local Buffer Overflow Version: 15 Build 3, Build 2 Date: 2012-11-09 Author: Julien Ahrens from struct import pack file="poc.reg" junk1="\xCC" 2136 nseh="\xeb\x06\x90\x90" eip=pack'L',0x0C7D8F13 JMP DWORD PTR SS:EBP-18 -...

CVE-2013-4754

Multiple cross-site scripting XSS vulnerabilities in Owl Intranet Knowledgebase 1.10 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Search field to browse.php or 2 the Title field to prefs.php...