PokerAgent botnet stole over 16,000 Facebook credentials

PokerAgent botnet was discovered in 2012 by ESET Security Research Lab, which is a Trojan horse designed to harvest Facebook log-on credentials, also collecting information on credit card details linked to the Facebook account and Zynga Poker player stats. According to latest report, the botnet i...

nCircle patches PureCloud vulnerability scanner on Vulnerability-Lab report

The Vulnerability-Laboratory Research Team discovered persistent and client side POST Injection web vulnerability in the nCircle PureCloud cloud-based Vulnerability Scanner Application. The vulnerability allows an attacker to inject own malicious script code in the vulnerable module on applicatio...

Cross-Site Scripting (XSS) vulnerability in gpEasy

Advisory ID: HTB23137 Product: gpEasy Vendor: gpeasy Vulnerable Versions: 3.5.2 and probably prior Tested Version: 3.5.2 Vendor Notification: January 2, 2013 Vendor Patch: January 2, 2013 Public Disclosure: January 23, 2013 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference:...

Wordpress Developer Formatter CSRF Vulnerability

==================================================================================================================== Exploit Title: Wordpress Developer Formatter CSRF Vulnerability Date: 21/01/13 Author: Junaid Hussain - illSecure Research Group - Contact: [email protected] | Website:...

WordPress Plugin SolveMedia 1.1.0 - Cross-Site Request Forgery

WordPress Plugin SolveMedia 1.1.0 - Cross-Site Request Forgery Exploit Title: WordPress SolveMedia 1.1.0 CSRF Vulnerability Release Date: 24/01/13 Author: Junaid Hussain - illSecure Research Group - Contact: [email protected] | Website: http://illSecure.com Software Link:...

ImageCMS 4.0.0b - Multiple Vulnerabilities

ImageCMS 4.0.0b - Multiple Vulnerabilities Advisory ID: HTB23132 Product: ImageCMS Vendor: www.imagecms.net Vulnerable Versions: 4.0.0b and probably prior Tested Version: 4.0.0b Vendor Notification: December 5, 2012 Vendor Patch: January 16, 2013 Public Disclosure: January 23, 2013 Vulnerability...

RHEL 5 : JBoss EAP (RHSA-2011:0948)

Updated JBoss Enterprise Application Platform 5.1.1 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

RHEL 6 : JBoss Enterprise Application Platform 5.1.1 update (Important) (RHSA-2011:0946)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0946 advisory. JBoss Enterprise Application Platform is the market-leading platform for innovative and scalable Java applications. JBoss Enterprise Application...

RHEL 4 : evolution (RHSA-2008:0517)

Updated evolution packages that address a buffer overflow vulnerability are now available for Red Hat Enterprise Linux 4.5 Extended Update Support. This update has been rated as having critical security impact by the Red Hat Security Response Team. Evolution is the integrated collection of e-mail...

RHEL 4 : evolution (RHSA-2008:0178)

Updated evolution packages that fix a format string bug are now available for Red Hat Enterprise Linux 4.5 Extended Update Support. This update has been rated as having critical security impact by the Red Hat Security Response Team. Evolution is the GNOME collection of personal information...

Multiple Cross-Site Scripting (XSS) vulnerabilities in GetSimple CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in GetSimple CMS, which can be exploited to perform Cross-Site Scripting XSS attacks. The application has XSS filter, however it can be bypassed as demonstrated below. 1 Cross-Site Scripting XSS in GetSimple CMS:...

FortiMail IBE - Exception & Filter Bypass Vulnerability

Document Title: =============== FortiMail IBE - Exception & Filter Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=772 Download: http://www.vulnerability-lab.com/resources/videos/772.wmv View: http://www.youtube.com/watch?v=5d7cIaM80oY Advisory:...

WordPress Plugin Developer Formatter - Cross-Site Request Forgery

WordPress Plugin Developer Formatter - Cross-Site Request Forgery ==================================================================================================================== Exploit Title: Wordpress Developer Formatter CSRF Vulnerability Google Dork: inurl:devformatter/devformatter.php...

WordPress Plugin Developer Formatter - Cross-Site Request Forgery

==================================================================================================================== Exploit Title: Wordpress Developer Formatter CSRF Vulnerability Google Dork: inurl:devformatter/devformatter.php Date: 21/01/13 Author: Junaid Hussain - illSecure Research Group -...

Secunia Research: Oracle Outside In Technology Paradox Database Handling Buffer Overflow

====================================================================== Secunia Research 16/01/2013 - Oracle Outside In Technology Stream Filters - - Paradox Database Handling Buffer Overflow - ====================================================================== Table of Contents Affected...

Wordpress Developer Formatter CSRF Vulnerability

Wordpress Developer Formatter suffers from a cross site request forgery vulnerability which can be used to add persistent XSS into posts which could then lead to cookie stealing, malware distribution or even a defacement...

Secunia Research: Oracle Outside In Technology Paradox Database Handling Denial of Service

====================================================================== Secunia Research 16/01/2013 - Oracle Outside In Technology Stream Filters - - Paradox Database Handling Denial of Service - ====================================================================== Table of Contents Affected...

Red October Attackers Shutting Down C&C Infrastructure

It appears that the attackers behind the Red October cyberespionage campaign are taking their ball and going home. Since the attack came to light on Monday, the attackers have begun shutting down their infrastructure and the hosting providers and registrars involved with some of the...

SQL Injection Vulnerability in Wysija Newsletters WordPress Plugin

High-Tech Bridge Security Research Lab discovered vulnerability in Wysija Newsletters WordPress plugin, which can be exploited to perform SQL Injection attacks. 1 SQL Injections in Wysija Newsletters WordPress plugin: CVE-2013-1408 The vulnerabilities exist due to insufficient filtration of...

Cross-Site Scripting (XSS) Vulnerability in CommentLuv WordPress Plugin

High-Tech Bridge Security Research Lab discovered vulnerability in CommentLuv WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in CommentLuv wordpress plugin: CVE-2013-1409 The vulnerability exists due to insufficient filtration of...