The vulnerability of the Dr.Web Enterprise Security Suite, a antivirus software, allows a malicious individual to carry out XSS attacks.

The vulnerability of the Dr.Web Enterprise Security Suite anti-virus protection allows for XSS attacks due to insufficient validation of the user name in the web administrator’s login page. This means that before the user name is returned to the user, it may be compromised by a malicious actor...

WordPress Security Audit Log Plugin <= 2.4.3 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in the "/wp-security-audit-log.php" file. Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

kernel security and bug fix update

3.10.0-327.22.2.OL7 - Oracle Linux certificates Alexey Petrenko 3.10.0-327.22.2 - infiniband security: Restrict use of the write interface Don Dutile 1332553 1316685 CVE-2016-4565 3.10.0-327.22.1 - mm mmunotifier: fix memory corruption Jerome Glisse 1335727 1307042 - misc cxl: Increase timeout...

Red Hat Enterprise Linux shell command injection vulnerability

Red Hat Enterprise Linux RHEL is a Linux operating system maintained and distributed by Red Hat for business users. setroubleshoot is one of the troubleshooting tools. A shell command injection vulnerability exists in the setroubleshoot/auditdata.py file in RHEL version 7.2. An attacker can explo...

SQL Injection Vulnerability in minX Parameters of Zhongke Xinye Network Security Audit Platform

Zhongke Xinye Network Security Audit Platform is an Internet behavior analysis system. A SQL injection vulnerability exists in Zhongke Xinye Network Security Audit Platform due to the program not adequately filtering the minX parameter. An attacker is allowed to exploit the vulnerability to obtai...

Faraday v1.0.20 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday introduces a new concept - IPE Integrated Penetration-Test Environment a multiuser Penetration test IDE. Designed for distribution, indexation and analysis of the generated data during the process of a security audit. A brand new Faraday version is ready! Faraday v1.0.20 Community, Pro &...

OpenStack Keystone Design Vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration and Rackspace, Inc. in the U.S. OpenStack Keystone is one of the projects used for authentication, providing identity, token, directory, and policy services. A security vulnerability...

Airgeddon - A Multi-use Bash Script for Linux Systems to Audit Wireless Networks

Features Interface mode switcher Monitor-Managed. DoS over wireless networks with different methods. Assisted Handshake file capture. Cleaning and optimizing Handshake captured files. Offline password decrypt on WPA/WPA2 captured files dictionary and bruteforce. Compatibility with many Linux...

D-Link DAR-8000/DAR-7000系列上网行为审计网关 存在任意文件读取

No description provided by source...

Multiple vulnerabilities fixed in Aruba networks products

Multiple vulnerabilities have been discovered in various Aruba Networks products including Instant and ArubaOS access points, the Airwave management platform and the PAPI protocol that these systems mutually use. Some vulnerabilities have been fixed, others will be fixed in a future update, and f...

D-Link DAR-8000/DAR-7000系列上网行为审计网关 任意文件上传

No description provided by source...

Fedora 23 : dhcp-4.3.3-9.P1.fc23 (2016-c93d49faf3)

Security fix for CVE-2016-2774 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

emblog file upload vulnerability

emlog is the short form of "Every Memory Log", meaning: a little bit of memory. It is a PHP language and MySQL database based on open source, free, powerful personal or multi-person co-authored blog system blog. PHP and MySQL-based powerful blog and CMS site-building system . A security...

Rough Auditing Tool for Security (RATS) 2.3 - Crash (PoC)

Exploit Title: RATS 2.3 Crash POC Date: 25th April 2016 Exploit Author: David Silveiro Author Contact: twitter.com/davidsilveiro Website: Xino.co.uk Software Link: https://code.google.com/archive/p/rough-auditing-tool-for-security/downloads Version: RATS 2.3 Tested on: Ubuntu 14.04 LTS CVE : 0 da...

Struts2 Remote Command Execution Vulnerability in Investment Project Audit Management System

The Investment Project Audit Management System IPAMS is an audit management system. The product suffers from a Struts2 remote command execution vulnerability, which can be exploited by an attacker to remotely execute commands and thus gain server privileges...

IPv6 Validation Toolkit

The IPv6 framework is a robust set of modules and plugins that allow a user to audit an IPv6 enabled network. The built-in modules support enumeration of IPv6 features such as ICMPv6 and Multicast Listener Discovery MLD. In addition, the framework also supports enumeration of Upper Layer Protocol...

FruityWifi v2.4 - Wireless Network Auditing Tool

FruityWifi is a wireless network auditing tool. The application can be installed in any Debian based system adding the extra packages. Tested in Debian, Kali Linux, Kali Linux ARM Raspberry Pi, Raspbian Raspberry Pi, Pwnpi Raspberry Pi, Bugtraq. v2.4 Utils have been added replaces "ifconfig -a"...

D-Link DAR-8000/DAR-7000系列上网行为审计网关 任意sql语句执行

No description provided by source...

Trello: Payments informations are sent to the webhook when a team changes its visibility

If an attacker installed a webhook on an team, and the team subsequently changed it's visibility from private to public, the payload sent to the webhook to notify it of the visibility change could potentially have disclosed some information that the attacker shouldn't have had access to. For paid...

OracleVM 3.3 / 3.4 : openssh (OVMSA-2016-0038)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices 1245969 - CVE-2016-3115: missing sanitisation of input for X11 forwarding 1317816 - SSH2MSGDISCONNECT for user initiate...