Yogurt Social Network 3.2 rc1 Module for XOOPS seutubo.php uid Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/30618/info Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code ...

Hosting Controller <= 0.6.1 HotFix 2.1 Change Credit Limit Exploit

No description provided by source. Hi, I'm Soroush Dalili from GSG GrayHatz Security Group. Title: Hosting controller program have a security bug in AccountActions.asp that an authenticated user can change his/her credit and buy some services! Version: 6.1 HotFix 2.1 and older Developer url:...

Samba nttrans Reply - Integer Overflow Vulnerability

No description provided by source. Exploitation: samba nttrans reply integer overflow / \ / \ | || | | | \ / / . || | | | / | / / | || || //\ // / | CVE-2013-4124 samba integer overflow in nttrans reply reading ealist vulnerable samba daemon has a integer overflow to cause remote dos by...

Phabricator: Abusing daemon logs for Privilege escalation under certain scenarios

Setup Needed + A normal user account + A momentary disruption of mail services Replication steps + Login as normal user + Wait for momentary disruption of mail services + Use Password Reset Link for admin mail address + BOOM!!! + You can see the password reset link in the daemon logs because of...

openSUSE Security Update : nagstamon (openSUSE-SU-2013:1235-1)

update to 0.9.10 : + added fullscreen option + added Thruk support + added CheckMK cookie-based auth + added new Centreon autologin option + added configurable default sort order + added filter for hosts in hard/soft state for Nagios, Icinga, Opsview and Centreon + added $STATUS-INFO$ variable...

openSUSE Security Update : colord (openSUSE-2011-57)

Update to version 0.1.15 : + This release fixes an important security bug: CVE-2011-4349. + New Features : - Add a native driver for the Hughski ColorHug hardware - Export cd-math as three projects are now using it + Bugfixes : - Documentation fixes and improvements - Do not crash the daemon if...

Slack: Remote file Inclusion - RFI in upload

Hello, Everysite has a RFI vulnerability. Everysite i.e .slack.com is having this vulnerability. Proof of concept / Steps to Reproduce : ================================= 1. Sign in to your account on slack eg. I signed in https://pran3hiva.slack.com 2. Now, go to 'Change photo'. i.e...

openssl multi-threaded multi-domain EXP, support for custom ports, save the binary file to save space-bug warning-the black bar safety net

!/ usr/bin/python Quick and dirty demonstration of CVE-2 0 1 4-0 1 6 0 by Jared Stafford [email protected] The author disclaims copyright to this source code. Multi process and bin dump version by [email protected] import sys import struct import socket import time import select impo...

DIR-605L Disclosure / Bypass

DIR-605L Hardware version Ax, firmware 1.14 has two severe security bug: 1. The login password is printed out in clear text in the "Current Network Setting" page just after login "Device Info" section. 2. The router can be controlled using a crafted URL GET request, even without login e.g. use an...

kernel security, bug fix, and enhancement update

kernel 2.6.18-371.8.1 - virt HID: memory corruption flaw drivers/usb/input/hid-core.c Jacob Tanenbaum 1032996 1032999 CVE-2013-2888 - virt HID: memory corruption flaw in drivers/hv/hid-core.c Jacob Tanenbaum 1032996 1032999 CVE-2013-2888 - scsi lpfc: Fix task management commands having a fixed...

ECE Projects Cross Site Scripting

ECE Projects XSS Cross-site Scripting Security Vulnerabilities Exploit Title: ECE Projects XSS Cross-site Scripting Security Vulnerabilities Vendor: ECE Projektmanagement G.m.b.H. & Co. KG ECE Product: ECE Projects Vulnerable Versions: Tested Version: Advisory Publication: April 01, 2015 Latest...

postgresql: SET ROLE without ADMIN OPTION allows adding and removing group members

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command...

Github Remote Command Execution

GitHub RCE by Environment variable injection Bug Bounty writeup Disclaimer: I'll keep this really short but I hope you'll get the key points. GitHub blogged a while ago about some internal tool called gerve: https://github.com/blog/530-how-we-made-github-fast Upon git+sshing to github.com gerve...

Confluence Administrator Can Add Himself to System Administrator Group

I have found what I believe to be a security bug in Confluence that should be fixed. We have System Administrator function from the Confluence Administrator Group, and created a new Group called System Administrators see attachment. The purpose was to give our Tech Writers the ability to access t...

Confluence Administrator Can Add Himself to System Administrator Group

I have found what I believe to be a security bug in Confluence that should be fixed. We have System Administrator function from the Confluence Administrator Group, and created a new Group called System Administrators see attachment. The purpose was to give our Tech Writers the ability to access t...

CVE-2012-1095

osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted 1 build log or 2 build status that contains an escape sequence for a terminal emulator...

Fedora 19 : nss-3.15.4-1.fc19 / nss-softokn-3.15.4-1.fc19 / nss-util-3.15.4-1.fc19 (2014-1100)

Update of the nss, nss-softokn, and nss-util packages to nss-3.15.4, a patch release for NSS 3.15 which includes the following security-relevant bug : CVE-2013-1740 When false start is enabled, libssl will sometimes return unencrypted, unauthenticated data from PRRecv For further details refer to...

CVE-2013-1853

Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local users to obtain sensitive information by reading the database...

CVE-2013-7281

The dgramrecvmsg function in net/ieee802154/dgram.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a 1 recvfrom, 2...

FreeBSD : gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack (2e5715f8-67f7-11e3-9811-b499baab0cbe)

Werner Koch reports : CVE-2013-4576 has been assigned to this security bug. The paper describes two attacks. The first attack allows to distinguish keys: An attacker is able to notice which key is currently used for decryption. This is in general not a problem but may be used to reveal the...