Microsoft Windows MSHTA.EXE .HTA File XML Injection Vulnerability

Microsoft Windows MSHTA.EXE .HTA File XML Injection Vulnerability Vendor www.microsoft.com Product Windows MSHTA.EXE .HTA File An HTML Application HTA is a Microsoft Windows program whose source code consists of HTML, Dynamic HTML, and one or more scripting languages supported by Internet Explore...

Microsoft Windows CONTACT - Remote Code Execution Exploit

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-INSUFFECIENT-UI-WARNING-WEBSITE-LINK-ARBITRARY-CODE-EXECUTION.txt + ISR: ApparitionSec...

A week in security (December 10 – 16)

Last week on Labs, we took a look at some new Mac malware, a collection of various scraped data dumps, the protection of power grids, and how bad actors are using SMB vulnerabilities. Other cybersecurity news Millions affected by Facebook photo API bug: An issue granted third-party apps more acce...

Steamed Hams

but it's a Metasploit Module Module Options msf use exploit/multi/hams/steamed msf undefinedsteamed show actions ...actions... msf undefinedsteamed set ACTION msf undefinedsteamed show options ...show and set options... msf undefinedsteamed run This module requires Metasploit:...

Adobe: Parameter tampering can result in product price manipulation

Parameters set during the shopping cart checkout workflow are vulnerable to tampering. By intercepting POST requests and manipulating the XML payload, product prices could be set to arbitrary values. P.O.C Video URL: https://youtu.be/3VMlV7jyzg...

wordpress -- multiple vulnerabilities

WordPress versions 4.7.2 and earlier are affected by six security issues. Cross-site scripting XSS via media file metadata. Control characters can trick redirect URL validation. Unintended files can be deleted by administrators using the plugin deletion functionality. Cross-site scripting XSS via...

london.ctvnews.ca XSS vulnerability

Vulnerable URL: http://london.ctvnews.ca/video/'"--! Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check london.ctvnews.ca SSL connection:| Grade: B Coordinated...

biqle.com XSS vulnerability

Vulnerable URL: https://biqle.com/video/%3C/title%3E%3Cscript%3E1;X%3DFunction"","%5C141%5C154%5C145%5C162%5C164XSSPOSED";X%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

CVE-2016-4603

Web Media in Apple iOS before 9.3.3 allows attackers to bypass the Private Browsing protection mechanism and obtain sensitive video URL information by leveraging Safari View Controller misbehavior...

CVE-2016-4603: Undefined Security Weakness

Web Media in Apple iOS before 9.3.3 allows attackers to bypass the Private Browsing protection mechanism and obtain sensitive video URL information by leveraging Safari View Controller misbehavior...

telerama.ec XSS vulnerability

Vulnerable URL: http://www.telerama.ec/videos?v=zuttsr" Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 14:14 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1211025 Google Pagerank| 5 VIP website status:| No...

packers.com XSS vulnerability

Vulnerable URL: http://www.packers.com/media-center/videos/Favres-Greatest-Games-Beats-Bears-on-Bad-Ankle/cd785f70-7abe-4515-8fa4-51160cbaa921%22%3E%3Cbody%20onload=alert'XSSPOSED'%3E Details: Description| Value ---|--- Patched:| Yes, at 10.08.2015 Latest check for patch:| 10.08.2015 01:22 GMT...