PEAR XML_RPC 1.3.0 - Remote Code Execution

PEAR XMLRPC 1.3.0 - Remote Code Execution PEAR XMLRPC Remote Code Execution Vendor: The PEAR Group Product: PEAR XMLRPC Version: = 1.3.0 Website: http://pear.php.net/package/XMLRPC/ CVE: 17793 PACKETSTORM: 38393 Description: PEAR XMLRPC is a PHP implementation of the XML-RPC web RPC protocol, and...

Cyber UL Could Become Reality Under Leadership of Hacker Mudge

UPDATE–One of the longstanding problems in security–and the software industry in general–is the lack of any universally acknowledged authority on quality and reliability. But the industry moved one step closer to making such a clearinghouse a reality this week when Peiter Zatko, a longtime...

Koha 3.20.1 - Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities

Exploit Title: Koha Open Source ILS - Multiple XSS and XSRF Vulnerabilities Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research [email protected] Vendor Homepage: koha-community.or...

Microsoft Windows - ClientCopyImage Win32k (MS15-051) (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 'Windows ClientCopyImage Win32k Exploit', 'Description' = %q Thi...

Photoshop CC2014 Bridge CC 2014 - .gif Parsing Memory Corruption

Photoshop CC2014 Bridge CC 2014 - .gif Parsing Memory Corruption Application: Adobe Photoshop CC 2014 & Bridge CC 2014 Platforms: Windows Versions: The vulnerability is confirmed in version Photoshop CC 2014 and Bridge CC 2014. Secunia: PRL: 2015-07 Author: Francis Provencher Protek Research Lab’...

Paintshop Pro X7 - .gif Conversion Heap Memory Corruption LZWMinimumCodeSize (Denial of Service)

Paintshop Pro X7 - .gif Conversion Heap Memory Corruption LZWMinimumCodeSize Denial of Service Application: Paintshop Pro X7 GIF Conversion Heap Memory Corruption Vulnerabilities LZWMinimumCodeSize Platforms: Windows Versions: The vulnerability is confirmed in version Paintshop Prox X7, Other...

Paintshop Pro X7 - '.gif' Conversion Heap Memory Corruption 'LZWMinimumCodeSize' (Denial of Service)

Application: Paintshop Pro X7 GIF Conversion Heap Memory Corruption Vulnerabilities LZWMinimumCodeSize Platforms: Windows Versions: The vulnerability is confirmed in version Paintshop Prox X7, Other versions may also be affected. Secunia: PRL: 2015-06 Author: Francis Provencher Protek Research...

Photoshop CC2014 Bridge CC 2014 - .png Parsing Memory Corruption

Photoshop CC2014 Bridge CC 2014 - .png Parsing Memory Corruption Application: Adobe Photoshop CC 2014 & Bridge CC 2014 Platforms: Windows Versions: The vulnerability is confirmed in version Photoshop CC 2014 and Bridge CC 2014. Secunia: PRL: 2015-08 Author: Francis Provencher Protek Research Lab’...

SearchBlox 8.2 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Vendor: SearchBlox Software, Inc. Vulnerable Versions: 8.2 and probably prior Tested Version: 8.2 Advisory Publication: April 22, 2015 without technical details Vendor Notification: April 22, 2015 Vendor Patch: May 26, 2015 Public Disclosure:...

The Internet Scanner: ZMap

The Internet Scanner: ZMap ZMap is an open-source network scanner that enables researchers to easily perform Internet-wide network studies. With a single machine and a well provisioned network uplink, ZMap is capable of performing a complete scan of the IPv4 address space in under 45 minutes,...

Ebay Inc Magento #10 - Persistent Filename Vulnerability

Document Title: =============== Ebay Inc Magento 10 - Persistent Filename Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1458 Video: https://www.youtube.com/watch?v=WffsHd8pibE Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1457 EIBBP-31603...

Vesta Control Panel 0.9.8 OS Command Injection

Advisory ID: HTB23261 Product: Vesta Control Panel Vendor: http://vestacp.com Vulnerable Versions: 0.9.8 and probably prior Tested Version: 0.9.8 Advisory Publication: May 20, 2015 without technical details Vendor Notification: May 20, 2015 Vendor Patch: June 3, 2015 Public Disclosure: June 17,...

Google Launches Android Security Rewards For Nexus Devices

Google today announced that it has expanded the scope of its vulnerability rewards program to include the latest versions of its Nexus mobile devices, dangling thousands of dollars in front of researchers willing to hunt not only for vulnerabilities but also develop bypasses for native Android...

CVE-2015-4396

Multiple cross-site request forgery CSRF vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of users with the "kwresearch admin site keywords" permission for requests that 1 create, 2 delete, or 3 set priorities to...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of users with the "kwresearch admin site keywords" permission for requests that 1 create, 2 delete, or 3 set priorities to...

CVE-2015-4396

CVE-2015-4396 affects Drupal Keyword Research module (6.x-1.x) prior to 6.x-1.2. Root cause: CSRF vulnerabilities allow remote attackers to hijack the authentication of users with the kwak research admin site keywords permission, enabling actions that create, delete, or set priorities on keywords...

CVE-2015-4396

Multiple cross-site request forgery CSRF vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of users with the "kwresearch admin site keywords" permission for requests that 1 create, 2 delete, or 3 set priorities to...

Use-After-Free in PHP

Advisory ID: HTB23262 Product: PHP Vendor: PHP Group Vulnerable Versions: 5.6.9 and probably prior Tested Version: 5.6.9 Advisory Publication: May 20, 2015 without technical details Vendor Notification: May 20, 2015 Vendor Patch: June 2, 2015 Public Disclosure: June 10, 2015 Vulnerability Type: U...

PT-2015-16: Cross-site scripting in Rockwell Automation Micrologix 1100 and 1400 PLC

The specialists of the Positive Research center have detected a Cross-site scripting vulnerability in Rockwell Automation Micrologix 1100 and 1400 PLC. Cross-site scripting vulnerability in the web server on Allen-Bradly MicroLogix 1100 and 1400 devices allows remote attackers to inject arbitrary...

Bonita BPM 6.5.1 Directory Traversal / Open Redirect

Advisory ID: HTB23259 Product: Bonita BPM Vendor: Bonitasoft Vulnerable Versions: 6.5.1 and probably prior Tested Version: 6.5.1 Windows and Mac OS packages Advisory Publication: May 7, 2015 without technical details Vendor Notification: May 7, 2015 Vendor Patch: June 9, 2015 Public Disclosure:...