CVE-2011-5110

Multiple SQL injection vulnerabilities in Blogs Manager 1.101 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to 1 authorslist.php, 2 blogslist.php, 3 categorylist.php, 4 commentslist.php, 5 policylist.php, 6 ratelist.php, 7...

CVE-2012-4294: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the channelisedfillsdhg707format function in epan/dissectors/packet-erf.c in the ERF dissector in Wireshark 1.8.x before 1.8.2 allows remote attackers to execute arbitrary code via a large speed aka rate value...

New OpFake Android Malware Entices Users With Opera Mini Browser

There is a new variant of the OpFake mobile malware making the rounds, and this version comes bundled with a version of the legitimate Opera Mini mobile browser. The malware targets Android phones and steals money from victims by sending SMS messages without the user’s knowledge to premium-rate...

RHEL 6 : rsyslog (RHSA-2012:0796)

Updated rsyslog packages that fix one security issue, multiple bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which...

Moderate: Red Hat Security Advisory: rsyslog security, bug fix, and enhancement update

Updated rsyslog packages that fix one security issue, multiple bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which...

Foncy is Dead, Long Live Mania

In the middle of January 2012 Foncy was updated: it started to spread together with an IRC bot and a root exploit. But the end of the Foncy story was very close because in February two suspected authors of this malware were arrested in Paris: you can read the story here in French and here in...

Verizon: Hacktivists Steal Most Data In 2011

It can be hard to parse the results of the Verizon Data Breach Investigation Report DBIR, what with the shifts from year to year in the sources of breach data collected. Last year’s report, if you recall, found a stunning drop in incidents of data theft in 2010, even as tracking sites like...

Bravenet Web Services Cross Site Scripting

Exploit Title: Bravenet Web Services Cross Site Scripting Date: 29.02.2012 Author: Sony Software Link: bravenet.com/ Google Dorks: inurl:calendar/day.php?usernum= or inurl: http://pub22.bravenet.com or what you want Web Browser : Mozilla Firefox Blog : http://st2tea.blogspot.com PoC:...

Apache 2.4 Comes Out, Major update after 6 years

Apache 2.4 Comes Out, Major update after 6 years The Apache Software Foundation officially released the Apache 2.4 today as the first major update to this leading open-source web-server in more than a half-decade. Apache 2.4 is slated to deliver superior performance to its 2.2 predecessor and...

Fake Angry Birds Game spreading Malware from Android Market

Fake Angry Birds Game spreading Malware from Android Market From last week premium rate SMS Trojans surfaced in the Android Market. Google has pulled 22 apps that are masquerading as legitimate versions of popular games like Angry Birds and Cut the Rope. Security researchers have discovered a way...

More Apps Pulled From Android Market Over Hidden SMS Functionality

There has been another round of malicious apps discovered in the official Android Market, with this wave containing hidden functionality to send SMS messages to premium-rate numbers. The apps, which Google has pulled from the Market already, are counterfeit versions of popular games, including...

Duqu Analysis and Detection Tool by NSS Labs

Duqu Analysis and Detection Tool by NSS Labs NSS Labs has built a new, free tool that detects known and newly created Duqu drivers that have infiltrated systems, thus allowing security experts to further analyze the "functionality, capabilities and ultimate purpose of DuQu.". The Tool is availabl...

SA-CONTRIB-2011-045 - Rate module Cross Site Scripting

The Rate module provides flexible rate widgets. These widgets are refreshed via AJAX after voting. The AJAX callback does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert...

QR codes - Next way for Android Malware

Once a user scans the QR code, the code redirects them to a site that will install a Trojan on their Android smart phones. Kaspersky's SecureList blog has a report of a malicious QR code on a web site which when scanned directs the user to a URL; the linked site doesn't have a file matching the...

QR Codes Found Sending Users to Site Containing Android Trojan

QR codes have been showing up everywhere in the last few months, from magazine ads to the sides of buses to, oddly, billboards. And now they’ve shown up on the list of ways that attackers are delivering malware to victims, with the emergence of a new Android-based Trojan that is hiding on malicio...

Hackers Push Sipvicious VoIP Tools In Malicious Attacks

Researchers at NSS Labs claim that they’ve spotted attacks that use Sipvicious, a common auditing tool for Voice over IP VoIP networks as part of malicious attacks aimed at taking control of vulnerable VoIP servers. The attacks are apparently aimed at taking control of VoIP servers to place...

WordPress Crawl Rate Tracker 2.0.2 SQL Injection

Exploit Title: WordPress Crawl Rate Tracker plugin wpdb-getresults"SELECT DATEFROMUNIXTIMEvisittime visitdate,robotname,COUNT total FROM $this-sbtrackingtable WHERE visittime = '$start' AND visittime trackingbotreportchartdata;...

WordPress Crawl Rate Tracker Plugin <= 2.0.2 - SQL Injection

Crawl Rate Tracker plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...

WordPress Crawl Rate Tracker plugin <= 2.0.2 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Crawl Rate Tracker plugin wpdb-getresults"SELECT DATEFROMUNIXTIMEvisittime visitdate,robotname,COUNT total FROM $this-sbtrackingtable WHERE visittime = '$start' AND visittime trackingbotreportchartdata; 0day.today...

WordPress Plugin Crawl Rate Tracker 2.0.2 - SQL Injection

Exploit Title: WordPress Crawl Rate Tracker plugin wpdb-getresults"SELECT DATEFROMUNIXTIMEvisittime visitdate,robotname,COUNT total FROM $this-sbtrackingtable WHERE visittime = '$start' AND visittime trackingbotreportchartdata;...