SQL Injection in InstantCMS

High-Tech Bridge Security Research Lab discovered blind SQL injection vulnerability in InstantCMS, which can be exploited to perform SQL Injection attacks, alter SQL requests and compromise vulnerable application. 1 SQL Injection in InstantCMS: CVE-2013-6839 The vulnerability exists due to...

SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 8491)

Mozilla Firefox has been updated to the 17.0.10ESR release, which fixes various bugs and security issues : - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory...

Surveillance Infrastructure Showing Signs of Decay

Buried underneath the ever-growing pile of information about the mass surveillance methods of the NSA is a small but significant undercurrent of change that’s being driven by the anger and resentment of the large tech companies that the agency has used as tools in its collection programs. The...

Zikula 1.3.5 Build 20 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Product: Zikula Application Framework Vendor: Zikula Software Foundation Vulnerable Versions: 1.3.5 build 20 and probably prior Tested Version: 1.3.5 build 20 Advisory Publication: October 16, 2013 without technical details Vendor Notification...

appRain 3.0.2 - Blind SQL Injection

Advisory ID: HTB23177 Product: appRain Vendor: appRain Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: October 9, 2013 without technical details Vendor Notification: October 9, 2013 Public Disclosure: November 6, 2013 Vulnerability Type: SQL Injection...

appRain 3.0.2 SQL Injection

Advisory ID: HTB23177 Product: appRain Vendor: appRain Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: October 9, 2013 without technical details Vendor Notification: October 9, 2013 Public Disclosure: November 6, 2013 Vulnerability Type: SQL Injection...

Apple Says It Has 'Never Received an Order Under Section 215'

In a new report detailing the number and kind of requests for user information it’s gotten from various governments, Apple said it has never received a request for information under Section 215 of the USA PATROT Act and would likely fight one if it ever came. The company also disclosed that it ha...

Yahoo Formally Launches Bug Bounty Program

As promised, Yahoo formally kicked off its bug bounty program late last week, aiming to correct what many in the security industry viewed as misstep after it handed out a paltry $12.50 credit to a researcher for discovering a cross-site scripting error. The company caught flak when in September...

Use-after-free when updating offline cache — Mozilla

Security researcher Byoungyoung Lee of Georgia Tech Information Security Center GTISC used the Address Sanitizer tool to discover a use-after-free during state change events while updating the offline cache. This leads to a potentially exploitable crash...

Cross-Site Scripting (XSS) in GuppY

Advisory ID: HTB23176 Product: GuppY Vendor: GuppY Vulnerable Versions: 4.6.26 and probably prior Tested Version: 4.6.26 Advisory Publication: October 2, 2013 without technical details Vendor Notification: October 2, 2013 Vendor Patch: October 12, 2013 Public Disclosure: October 23, 2013...

GuppY 4.6.26 Cross Site Scripting

Advisory ID: HTB23176 Product: GuppY Vendor: GuppY Vulnerable Versions: 4.6.26 and probably prior Tested Version: 4.6.26 Advisory Publication: October 2, 2013 without technical details Vendor Notification: October 2, 2013 Vendor Patch: October 12, 2013 Public Disclosure: October 23, 2013...

Microweber 0.8 Arbitrary File Deletion

Advisory ID: HTB23175 Product: Microweber Vendor: Microweber Vulnerable Versions: 0.8 and probably prior Tested Version: 0.8 Advisory Publication: September 25, 2013 without technical details Vendor Notification: September 25, 2013 Vendor Patch: September 26, 2013 Public Disclosure: October 16,...

Cross-Site Scripting (XSS) in Feng Office

Advisory ID: HTB23174 Product: Feng Office Vendor: Secure Data SRL Vulnerable Versions: 2.3.2-rc and probably prior Tested Version: 2.3.2-rc Advisory Publication: September 18, 2013 without technical details Vendor Notification: September 18, 2013 Public Disclosure: October 9, 2013 Vulnerability...

Feng Office 2.3.2-rc Cross Site Scripting Vulnerability

Feng Office version 2.3.2-rc suffers from a cross site scripting vulnerability. Advisory ID: HTB23174 Product: Feng Office Vendor: Secure Data SRL Vulnerable Versions: 2.3.2-rc and probably prior Tested Version: 2.3.2-rc Advisory Publication: September 18, 2013 without technical details Vendor...

Yahoo Revamps Bug Bounty Vulnerability Rewards Program

Yahoo has promised to put the finishing touches on a new vulnerability reporting and rewards policy by Halloween after finding itself in the throes of a mini scandal this week over two $12.50 Yahoo company store discount codes handed out to one researcher in thanks for turning in a pair of...

Cross-Site Scripting (XSS) in WikkaWiki

Advisory ID: HTB23170 Product: WikkaWiki Vendor: Wikka Development Team Vulnerable Versions: 1.3.4 and probably prior Tested Version: 1.3.4 Vendor Notification: August 21, 2013 Vendor Patch: August 31, 2013 Public Disclosure: September 11, 2013 Vulnerability Type: Cross-Site Scripting CWE-79 CVE...

GLPI 0.84.1 - Multiple Vulnerabilities

GLPI 0.84.1 - Multiple Vulnerabilities Advisory ID: HTB23173 Product: GLPI Vendor: INDEPNET Vulnerable Versions: 0.84.1 and probably prior Tested Version: 0.84.1 Advisory Publication: September 11, 2013 without technical details Vendor Notification: September 11, 2013 Vendor Patch: September 12,...

GLPI 0.84.1 - Multiple Vulnerabilities

GLPI version 0.84.1 suffers from improper access control bypass and PHP code injection vulnerabilities. Product: GLPI Vendor: INDEPNET Vulnerable Versions: 0.84.1 and probably prior Tested Version: 0.84.1 Advisory Publication: September 11, 2013 without technical details Vendor Notification:...

Gnew 2013.1 - Multiple Vulnerabilities

Gnew version 2013.1 suffers from file inclusion and remote SQL injection vulnerabilities. Product: Gnew Vulnerable Versions: 2013.1 and probably prior Tested Version: 2013.1 Advisory Publication: August 28, 2013 without technical details Vendor Notification: August 28, 2013 Public Disclosure:...

Multiple Vulnerabilities in Gnew

Advisory ID: HTB23171 Product: Gnew Vendor: Raoul Proenca Vulnerable Versions: 2013.1 and probably prior Tested Version: 2013.1 Advisory Publication: August 28, 2013 without technical details Vendor Notification: August 28, 2013 Public Disclosure: October 2, 2013 Vulnerability Type: PHP File...