SIDA University System SQL Injection

Author: K053 Vendor : SIDA Version: All below 1389 are vulberable ==================================================================================== Note: Seems vendor patched this vulnerability in newest update 1389 so we decide to public it now. Maybe more in future ;...

Top 3rd Party Apps Ignoring Windows Security: Report

Many of the most widely used third-party software applications for Microsoft Windows do not take advantage of two major lines of defense built into the operating system that can help block attacks from hackers and viruses, according to research released today. Read the full article. KrebsonSecuri...

Secunia Research: Adobe Reader GIF Image Parsing Array-Indexing Vulnerability

====================================================================== Secunia Research 30/06/2010 - Adobe Reader GIF Image Parsing Array-Indexing Vulnerability - ====================================================================== Table of Contents Affected...

SIDA University System - SQL Injection

SIDA University System - SQL Injection Author: K053 Vendor : SIDA Version: All below 1389 are vulberable ==================================================================================== Note: Seems vendor patched this vulnerability in newest update 1389 so we decide to public it now. Maybe mo...

Secunia Research: TaskFreak "password" SQL Injection Vulnerability

====================================================================== Secunia Research 29/06/2010 - TaskFreak "password" SQL Injection Vulnerability - ====================================================================== Table of Contents Affected...

ActiveCollab 2.3.0 Directory Traversal / Local File Inclusion

============================================================ PAINSEC SECURITY RESEARCH GROUP SECURITY ADVISORY 2010-001 - Original release date: June 24th, 2010 - Discovered by: Jose Carlos de Arriba dade at painsec dot com - Severity: 10/10 Base CVSS Score...

2DayBiz Job Site Script - SQL Injection

2DayBiz Job Site Script - SQL Injection $------------------------------------------------------------------------------------------------------------------- $ 2daybiz Job site Script SQL injection $ Author : Sangteamtham $ Home : Hcegroup.net $ Download...

ActiveCollab 2.3.0 - Local File Inclusion / Directory Traversal

============================================================ PAINSEC SECURITY RESEARCH GROUP SECURITY ADVISORY 2010-001 - Original release date: June 24th, 2010 - Discovered by: Jose Carlos de Arriba dade at painsec dot com - Severity: 10/10 Base CVSS Score...

Malware Rises With Smartphone Adoption

Researchers are closely watching the rise of malware on Internet-enabled mobile devices. New mobile malware boasts a broad range of functionality, including the capability to download other malicious files, detect internet connections or establish new ones, undertake URL redirection and carry out...

Multiple Vulnerabilities in DBHcms

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in DBHcms which could be exploited to perform cross-site scripting and SQL injection attacks. 1 Cross-site scripting XSS vulnerabilities in DBHcms 1.1 The vulnerability exists due to input sanitation error in the...

Cross-site Scripting (XSS) Vulnerabilities in CruxCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in CruxCMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in CruxCMS: CVE-2008-0700 The vulnerability exists due to input sanitation error in the "search"...

VUPEN Security Research - Adobe Flash Player "newclass" Invalid Pointer Vulnerability (CVE-2010-2173)

VUPEN Security Research - Adobe Flash Player "newclass" Invalid Pointer Vulnerability CVE-2010-2173 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Adobe Flash Player is a cross-platform browser-based application runtime that delivers uncompromised viewing of...

VUPEN Security Research - Adobe Flash Player GIF/JPEG Data Parsing Heap Overflow Vulnerabilities (CVE-2010-2167)

VUPEN Security Research - Adobe Flash Player GIF/JPEG Data Parsing Heap Overflow Vulnerabilities CVE-2010-2167 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Adobe Flash Player is a cross-platform browser-based application runtime that delivers uncompromised viewin...

The Pitfalls of Website Vulnerability Research and Disclosure

Vulnerability disclosure is in the spotlight again. First it was Tavis Ormandy disclosing a vulnerability in Microsoft Windows before Microsoft had a fix available. Now a group called Goatse Security has disclosed a vulnerability in an AT&T website that affects Apple iPad 3G owners. The Wall Stre...

Winplot 2010 - Buffer Overflow (PoC)

/ DISCLAIMER THIS PROGRAM IS NOT INTENDED TO BE USED ON OTHER COMPUTERS AND IT IS DESTINED FOR PERSONAL RESEARCH ONLY!!!! The programs are provided as is without any guarantees or warranty. The author is not responsible for any damage or losses of any kind caused by the use or misuse of the...

Joomla Components com_image SQL Injection Vulnerability

Exploit for php platform in category web applications ======================================================= Joomla Components comimage SQL Injection Vulnerability ======================================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1 0 0...

SQL Injection Vulnerability in TomatoCMS

High-Tech Bridge SA Security Research Lab has discovered vulnerability in TomatoCMS which could be exploited to execute arbitrary SQL commands in applications database. 1 SQL injection vulnerability in TomatoCMS An input validation error exists in the "q" parameter in /news/search. A remote...

Collabtive 0.6.3 - Multiple Vulnerabilities

Collabtive 0.6.3 - Multiple Vulnerabilities !/usr/bin/perl use LWP::UserAgent; use HTTP::Request::Common qwPOST; use HTTP::Cookies; use Getopt::Long; '/ -.- ------------------oOO------OOo----------------- | | | / / / / | | / / / / / / / / / / / | | // // / / / // / // / // | | ///,// /./,/,...

Unfixed Script Insertion vulnerability at rapi.nl

Security researcher Killer-TR, has submitted on 06/10/2010 a Script Insertion vulnerability affecting rapi.nl, which at the time of submission ranked 5970364 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/12/2011. It is currently unfixed. I...

Cross-site Scripting (XSS) Vulnerability in ForumCMS

High-Tech Bridge SA Security Research Lab has discovered vulnerability in ForumCMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in ForumCMS The vulnerability exists due to input sanitation error in the "keyword" parameter in...