Sophos UTM 525 Full Guard Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2016-009 Product: Sophos UTM 525 Full Guard Vendor: Sophos Affected Versions: 9.352-6, 94988 Tested Versions: 9.352-6, 94988 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Vendor...

Vulnerability in OpenSSL - Divide-and-conquer session key recovery in SSLv2

This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. s2srvr.c did not enforce that clear-key-length is 0 for non-export ciphers. If clear-key bytes are present for these ciphers, they displace...

NetUSB - Kernel Stack Buffer Overflow

NetUSB - Kernel Stack Buffer Overflow !/usr/bin/env python -- coding: utf-8 -- Exploit Title: NetUSB Kernel Stack Buffer Overflow Date: 9/10/15 Exploit Author: Adrian Ruiz Bermudo Vendor Homepage: http://www.kcodes.com/ Version: Multiple:...

[SYSS-2015-039] CSRF in OpenText Secure MFT

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-039 Product: Secure MFT Vendor: http://www.opentext.com Affected Versions: 2013 R3, 2014 R1/R2, 2015 R1 Tested Versions: 2014 R2 SP4 Vulnerability Type: Cross-Site Request Forgery CWE-352 Risk Level: Medium Solution Status:...

Secure MFT Cross Site Request Forgery

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-039 Product: Secure MFT Vendor: http://www.opentext.com Affected Versions: 2013 R3, 2014 R1/R2, 2015 R1 Tested Versions: 2014 R2 SP4 Vulnerability Type: Cross-Site Request Forgery CWE-352 Risk Level: Medium Solution Status:...

SA-CONTRIB-2015-014 - Wishlist - Multiple vulnerabilities

The Wishlist module enables authorized users to create wishlist nodes which describe items they would like for a special occasion. Also, it allows users to indicate their intention to purchase items for other users. The module fails to sanitize user input in log messages, leading to a Cross Site...

WordPress DZS-VideoGallery Cross Site Scripting

Exploit Title : Wordpress dzs-videogallery plugin Cross site scripting Vulnerability Exploit Author : Adrian Vendor Homepage : http://digitalzoomstudio.net/ Google Dork : inurl:/wp-content/plugins/dzs-videogallery Date : 2014/01/25 Tested on : Windows 8 , Linux...

[Full-disclosure] Magnolia CMS multiple access control vulnerabilities

Subject: ====== Multiple access control vulnerabilities in Magnolia CMS, Community and Enterprise editions CVE ID: ====== CVE-2013-4621 Summary: ======== A non-admin user such as default users eric / peter can access and execute multiple administrative functionalities of the CMS by accessing...

Magnolia CMS 4.5.8 Access Bypass

Subject: ====== Multiple access control vulnerabilities in Magnolia CMS, Community and Enterprise editions CVE ID: ======= CVE-2013-4621 Summary: ======== A non-admin user such as default users eric / peter can access and execute multiple administrative functionalities of the CMS by accessing...

Adrian Stone on BlackBerry Security, Privacy and the Challenges of BYOD

Dennis Fisher talks with Adrian Stone, the head of security response at BlackBerry, about the new security model in BlackBerry 10, the partition between private and work data and the challenges of dealing with app developers who might not know a whole lot about security or privacy. Download:...

Andy Steingruebl and Adrian Stone

Andy Steingruebl, left, senior manager, customer and ecosystem security at PayPal, and Adrian Stone, director of security response at BlackBerry, discussed the difficulty of dealing with targeted attacks in the enterprise. “Incident response is the key,” Stone said...

IShang CMS 5.0 / 7.0 SQL Injection

Exploit Title : IShang CMS Login Page Bypass Vulnerability Exploit Author : Adrian Vendor Homepage : http://www.ishang.net/ Google Dork : Use Your Brain Date: 2013/12/28 Tested On : Win8 Software Link : http://www.ishang.net/ Version : 7.0 / 5.0 1 http://site.com/path/admin/ 2...

Derbycon 2011 Videos talks

Derbycon 2011 Videos Talks The idea behind DerbyCon was developed by Dave Kennedy ReL1K, Martin Bos PureHate, and Adrian Crenshaw Irongeek. Their motivation stemmed from a desire to see more of the old-style talks and events of the conventions of the past. DerbyCon was hosted by some specialized...

HP Data Protector (HP-UX) - Remote Shell

HP Data Protector HP-UX - Remote Shell !/bin/bash Exploit Title: HP Data Protector Remote Shell for HPUX Date: 2011-08-02 Author: Adrian Puente Z. Software Link:http://www8.hp.com/us/en/software/software- product.html?compURI=tcm:245-936920&pageTitle=data-protector Version: 0.9 Tested on: HPUX CV...

Top 5 best criminal computer hackers of all time

These hackers are the ones that you've seen in shackles arrested for cybercrimes when they were just getting out of puberty. Some have done it for financial gain others just for fun. 1. Kevin Mitnick. Mitnick is perhaps synonymous with Hacker. The Department of Justice still refers to him as "the...

Former Hacker Lamo Treated for Asperger's

Last month Adrian Lamo, a man once hunted by the FBI, did something contrary to his nature. He picked up a payphone outside a Northern California supermarket and called the cops. Read the full article. Wired...

Rich Mogull and Mike Rothman on Security Research and Metrics

Dennis Fisher talks with Rich Mogull, Mike Rothman, David Mortman and Adrian Lane about the merger of Securosis and Security Incite, the need for better metrics in security and improving security research. Podcast audio courtesy of sykboy65 Subscribe to the Digital Underground podcast on...

Joomla Component Fantasytournament SQL Injection Vulnerabilities

No description provided by source. Joomla Component Fantasytournament Multiple SQL Injection Vulnerabilities Vulnerability found by: H!tm@N Contact: khghitmanatgmaildotcom Site: www.khg-crew.ws Greetz: boom3rang, KHG, urtan, warning, chs, redc00de - -=Kosova Hackers Group=- ScriptName: "Joomla"...

Joomla Fantasytournament SQL Injection

Joomla Component Fantasytournament Multiple SQL Injection Vulnerabilities Vulnerability found by: Valon Kerolli Contact: valonatitshqip.com Site: www.itshqip.com ScriptName: "Joomla" Component: "Fantasytournament comfantasytournament" Version: "2009.1.5" Date: "01/01/2009" Author: "Adrian Gray"...

Joomla Component Fantasytournament SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications ================================================================ Joomla Component Fantasytournament SQL Injection Vulnerabilities ================================================================ Joomla Component Fantasytournament Multiple...