SA114 : GNU C Library (glibc) Remote Code Execution February 2016

SUMMARY Blue Coat products using an affected version of the GNU C Library glibc are susceptible to a remote execution attack. A remote attacker can send a crafted DNS response to the glibc DNS resolver and cause the resolver to crash or execute arbitrary code. AFFECTED PRODUCTS The following...

sklep.zoolandia.pl XSS vulnerability

Open Bug Bounty ID: OBB-129179 Description| Value ---|--- Affected Website:| sklep.zoolandia.pl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Mozilla Firefox for Android < 42.0 Multiple Vulnerabilities

Binary data 9019.prm...

WordPress SEO Rank Reporter Plugin <= 2.2.2 - Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can inject html or JS code. Vulnerable parameters are "keyworditem" and "entryurl". Solution Update the plugin...

WordPress SEO Rank Reporter Plugin <= 2.2.2 - Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can inject html or JS code. Vulnerable parameters are "keyworditem" and "entryurl". Solution Update the plugin...

SEO Rank Reporter <= 2.2.2 - Authenticated Reflected Cross-Site Scripting (XSS)

The seo-rank-reporter WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...

CVE-2015-7190: Exposure of Sensitive Information to an Unauthorized Actor

The Search feature in Mozilla Firefox before 42.0 on Android through 4.4 supports search-engine URL registration through an intent and can access this URL in a privileged context in conjunction with the crash reporter, which allows attackers to read log files and visit file: URLs of HTML document...

Imgur: Persistent XSS in https://p.imgur.com/albumview.gif and http://p.imgur.com/imageview.gif / post statistics

In p.imgur.com/albumview.gif, a post paramater could be set containing html and javascript. This was not escaped properly and the code would be executed. The reporter used the following example URLs as a proof of concept https://p.imgur.com/albumview.gif?a=F78FO&r=https://community.imgur.com/aler...

VuFind 1.0 Cross Site Scripting

VuFind 1.0 Web Application Reflected XSS Cross-site Scripting 0-Day Bug Security Issue Exploit Title: VuFind Results? &lookfor parameter Reflected XSS Web Security Vulnerability Product: VuFind Vendor: VuFind Vulnerable Versions: 1.0 Tested Version: 1.0 Advisory Publication: September 20, 2015...

Dennis Fisher On Security, Journalism, and the Origins of Threatpost

Ryan Naraine hijacks the podcast to talk with Dennis Fisher about the origins of Threatpost, his time as a security reporter, the changes in the industry, and what’s next on the horizon.​ Download: lastdigitalundergroundever.mp3 Music by Chris Gonsalves...

PhotoPost PHP 4.8c Cross Site Scripting

PhotoPost PHP 4.8c Cookie Based Stored XSS Cross-site Scripting Web Application 0-Day Bug Exploit Title: PhotoPost PHP utmz Cookie Stored XSS Web Security Vulnerability Product: PhotoPost PHP Vendor: PhotoPost Vulnerable Versions: 4.8c 4.8.6 4.8.5 4.8.2 3.1.1 vB3 Tested Version: 4.8c vB3 Advisory...

ManageEngine Exchange Reporter Plus 4.7 SQL Injection

Arbitrary SQL statement execution in ManageEngine Exchange Reporter Plus RunQuery.jsp Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

phpwind 8.7 Open Redirect

phpwind v8.7 Unvalidated Redirects and Forwards Web Security Vulnerabilities Exploit Title: phpwind v8.7 goto.php? &url Parameter Open Redirect Security Vulnerabilities Product: phpwind Vendor: phpwind Vulnerable Versions: v8.7 Tested Version: v8.7 Advisory Publication: May 24, 2015 Latest Update...

Apport/Abrt Local Privilege Vulnerability

Apport is the crash report service on ubuntu, that is, when a program crashes the pop-up program that sends an error report. ABRT is an automated bug detection and reporting tool. Apport/Abrt is vulnerable to a local privilege exploit. An attacker can exploit the vulnerability to gain root...

Lizard Squad's DDoS Site Runs on Hacked Home Routers

The distributed denial of service attacks that crippled both Xbox Live and the PlayStation Network PSN shortly after the holidays came at the hands of a botnet largely comprised of hacked home routers. The botnet is managed by Lizard Squad, the group of hackers that took credit for knocking the...

PT-2019-6855

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.13 Description An access control issue allows users with "Reporter" permissions to change the status of any issue to "New". Recommendations For versions prior to 1.2.13, update to version 1.2.13 or later to resol...

Veeam ONE Reporter\Business View installation fails

Challenge Veeam ONE installation\upgrade fails on the Reporter\Business View site deployment step. Cause Antivirus software may prevent applications from making changes to IIS, which is used by Veeam Reporter and Business View components to deploy their sites. Solution Disable antivirus software ...

Veeam ONE 7.0 Patch 2 Release Notes

Challenge Release Notes for Veeam ONE 7.0 Patch 2. Cause Please confirm you are running Veeam ONE 7 or Veeam ONE 7R2 prior to installing this update. You can check this under Help | About in Veeam ONE Monitor Client, the build number should be 7.0.0.xxx. After upgrading, your version build will b...

BurpSentintel - GUI Burp Plugin to ease discovering of security holes in web applications

A plugin for Burp Intercepting Proxy, to aid and ease the identification of vulnerabilities in web applications. Searching for vulnerabilities in web applications can be a tedious task. Most of the time consists of inserting magic chars into parameters, and looking for suspicious output. Sentinel...

NFR Agent FSFUI Record File Upload RCE

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...