Orbit Open Ad Server 1.1.0 SQL Injection Vulnerability

Orbit Open Ad Server version 1.1.0 suffers from a remote SQL injection vulnerability. Product: Orbit Open Ad Server Vendor: OrbitScripts, LLC Vulnerable Versions: 1.1.0 and probably prior Tested Version: 1.1.0 Advisory Publication: March 19, 2014 without technical details Vendor Notification: Mar...

Orbit Open Ad Server 1.1.0 SQL Injection

Advisory ID: HTB23208 Product: Orbit Open Ad Server Vendor: OrbitScripts, LLC Vulnerable Versions: 1.1.0 and probably prior Tested Version: 1.1.0 Advisory Publication: March 19, 2014 without technical details Vendor Notification: March 19, 2014 Vendor Patch: March 21, 2014 Public Disclosure: Apri...

Researchers Uncover Interesting Browser-Based Botnet

Security researchers discovered an odd DDoS attack against several sites recently that relied on a persistent cross-site scripting vulnerability in a major video Web site and hijacked users’ browsers in order to flood the site with traffic. The attack on the unnamed site involved the use of...

Researchers explained How ANGRY BIRDS Sharing Your Personal Data

We are already aware about the fact that most probably every mobile app is collecting our data in one or the other form. Thanks to Edward Snowden, who provided the secret documents that revealed that the world's most popular Smartphone applications, including gaming apps such as Angry Birds, are...

WhiteHat Releases Aviator Browser for Windows

The privacy and anonymity of users’ online communications has been at the forefront of many discussions in the tech community and the general public in the last year as more and more information has leaked out about the NSA’s methods and how the agency collects vast amounts of user data. Keeping...

SQL Injection in Orbit Open Ad Server

High-Tech Bridge Security Research Lab discovered vulnerability in Orbit Open Ad Server, which can be exploited to perform SQL Injection attacks, alter SQL requests to database of vulnerable application and potentially gain control over the vulnerable website. 1 SQL Injection in Orbit Open Ad...

Android Browser and WebView addJavascriptInterface Code Execution

This Metasploit module exploits a privilege escalation issue in Android versions prior 4.2's WebView component that arises when untrusted Javascript code is executed by a WebView that has one or more Interfaces added to it. The untrusted Javascript code can call into the Java Reflection APIs...

AINS function.inc.php path Parameter PHP Code Execution - Ver2 (CVE-2007-0570)

A code execution vulnerability has been reported in Johannes Gijsbers Ad Fundum Integratable News Script AINS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Security Vulnerabilities in Apache Cordova / PhoneGap

The following email was sent to Apache Cordova/PhoneGap on 12/13/2013, and again on 1/17/2014. As there has been no response, we are re-posting it here to alert the general public of the inherent vulnerabilities in Apache Cordova/PhoneGap. Dear PhoneGap contributors, PhoneGap’s domain whitelistin...

InMobi Ad SDK javaScript绑定不安全WebView内容加载漏洞

InMobi Ad SDK是一款广告软件开发包。 InMobi Ad SDK不正确使用JavaScript绑定并通过HTTP来加载WebView内容，允许可通过中间人攻击的攻击者调用某些Java方法，如应用程序使用的SDK拥有'CALLPHONE'权限的话，可未经用户同意调用任意电话号码。 0 InMobi Ad SDK 3.6.2 InMobi Ad SDK 4.0.2 InMobi Ad SDK 4.0.3已经修复该漏洞，建议用户下载更新： http://www.inmobi.com/products/sdk/...

Moderate: Red Hat Security Advisory: jasperreports-server-pro security, bug fix, and enhancement update

An updated jasperreports-server-pro package that fixes two security issues, several bugs, and adds various enhancements is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CVE-2013-7292

VASCO IDENTIKEY Authentication Server IAS 3.4.x allows remote authenticated users to bypass Active Directory AD authentication by entering only a DIGIPASS one-time password, instead of the intended combination of this one-time password and a multiple-time AD password...

CVE-2013-7292

CVE-2013-7292 affects VASCO IDENTIKEY Authentication Server (IAS) 3.4.x. An authenticated remote user can bypass Active Directory authentication by supplying only a DIGIPASS one-time password instead of the required OTP plus a multi-factor AD password. The available sources consistently describe ...

Mac OS X Flashback Trojan is still alive, recently infected 22,000 Apple machines

The Flashback Trojan, the most sophisticated piece of malware that infected over 600,000 Apple's Macs systems back in April, 2012 is still alive and has infected about 22,000 machines recently, according to the researchers from Intego. For a refresh, Flashback Trojan was first discovered in...

Cross-Site Scripting (XSS) in Ad-minister Wordpress plugin

Advisory ID: HTB23187 Product: Ad-minister Wordpress plugin Vendor: henrikmelin, kalstrom Vulnerable Versions: 0.6 and probably prior Tested Version: 0.6 Advisory Publication: December 5, 2013 without technical details Vendor Notification: December 5, 2013 Public Disclosure: December 26, 2013...

VMware Security Updates for vCenter Server (VMSA-2013-0006)

VMware has updated vCenter Server to address multiple security vulnerabilities. OpenVAS Vulnerability Test $Id: gbvcenterVMSA-2013-0006.nasl 6637 2017-07-10 09:58:13Z teissa $ VMware Security Updates for vCenter Server VMSA-2013-0006 Authors: Michael Meyer Copyright: Copyright c 2014 Greenbone...

Yahoo Ad Network abused to redirect users to malicious websites serving Magnitude Exploit Kit

Internet advertisement networks provide hackers with an effective venue for targeting wide range computers through malicious advertisements. Previously it was reported by some security researchers that Yahoo's online advertising Network is one of the top ad networks were being abused to spread...

CVE-2013-6993

Cross-site scripting XSS vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php...

CVE-2013-6993

Cross-site scripting XSS vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php...