CVE-2012-3385

WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors...

Malware Magazine [THN] - eZine Issue 012

Document Title: =============== Malware Magazine THN - eZine Issue 012 References: =========== Download: http://www.vulnerability-lab.com/resources/documents/618.pdf Original: http://news.thehackernews.com/THN-June2012.pdf Article: http://www.vulnerability-lab.com/getcontent.php?id=618 Release...

CVE-2012-2156

Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...

Plume CMS 1.2.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities

Plume CMS 1.2.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : PlumeCMS = 1.2.4 Multiple Persistent XSS Date : 04-04-2012 Author : Ivano...

Skype 5.8 & 5.5 - Corruption & Persistent Vulnerability

Document Title: =============== Skype 5.8 & 5.5 - Corruption & Persistent Vulnerability References: =========== Download: http://www.vulnerability-lab.com/resources/videos/447.wmv View: http://www.youtube.com/watch?v=zQWgD-YzN-4 Release Date: ============= 2012-03-28 Vulnerability Laboratory ID...

CVE-2012-0976

Cross-site scripting XSS vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party information...

sudo 1.8.3p1 Format String

Phenoelit Advisory Authors joernchen Phenoelit Group http://www.phenoelit.de Affected Products sudo 1.8.0 - 1.8.3p1 http://sudo.ws Vendor communication 2012-01-24 Send vulnerability details to sudo maintainer 2012-01-24 Maintainer is embarrased 2012-01-27 Asking maintainer how the fixing goes...

The Cloud Security Rules Book - Technology is your friends & Enemy

The Cloud Security Rules Book - Technology is your friends & Enemy Well-known security experts decipher the most challenging aspect of cloud computing-security. The Cloud Security Rules book is available on Amazon.com and selected book stores from October 2011. According to Description available...

How the Duqu Authors May Have Erred

Duqu has been called the spawn of Stuxnet, or maybe some sort of stepchild or second cousin. That initial analysis came from some similarities in the code of the two attack tools, and now that researchers have had more time to pull Duqu apart and see how it works, it seems more and more likely th...

Costin Raiu on Duqu, Stuxnet and Targeted Attacks

Dennis Fisher talks with malware researcher Costin Raiu about the investigation into Duqu, the likelihood that it was written by the same team as Stuxnet, whether a government is behind its development and what mistakes the authors made. Podcast audio courtesy of sykboy65 Subscribe to the Digital...

phpWebSite 1.7.1 - mod.php SQL Injection

phpWebSite 1.7.1 - mod.php SQL Injection source: https://www.securityfocus.com/bid/49354/info phpWebSite is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromis...

Apple Updates XProtect to Detect Mac Trojan

Apple released an update today for its built-in, malware protection platform, XProtect, in response to the emergence of Mac-targeting trojan that hijacks Google searches, according to an article posted on Softpedia. Once the trojan has installed itself on a user’s machine, it starts adding fake...

WordPress <= 3.1.2 - Multiple Unspecified Remote vulnerabilities

Because of these vulnerabilities, the attackers can determine usernames of non-authors via canonical redirects. Solution Update WordPress...

DroidDream Again Appears in Android Market Apps

For Android users, the refrain must be getting a little tiresome: Researchers have found another batch of apps in the Android Market that were infected with malware. Once again, it was the DroidDream malware family causing the trouble, but this time, it was just a handful of apps and they were on...

Web Browser - Remote Exploitation Session

Document Title: =============== Web Browser - Remote Exploitation Session References: =========== Download: http://www.vulnerability-lab.com/resources/videos/14.wmv View: http://www.youtube.com/watch?v=zSFJw9PMHU Release Date: ============= 2011-06-18 Vulnerability Laboratory ID VL-ID:...

PhoenixCMS 1.7.0 Module(Web_Links) Blind SQL Injection

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Movie Player v4.82 0Day Buffer overflow/DOS Exploit

Exploit for windows platform in category dos / poc !/usr/bin/python +Exploit Title: Movie Player v4.82 0Day Buffer overflow/DOS Exploit +Software Link: http://www.movieplay.org/download.php +Software : Movie Player +Version : v4.82 +Tested On : WIN-XP SP3 + Date : 31.03.2011 + Hour : 3:37 PM...

MPlayer Lite r33064 - .m3u Local Overflow (SEH)

MPlayer Lite r33064 - .m3u Local Overflow SEH !/usr/bin/perl +Exploit Title: Exploit Buffer Overflow MsplayerSEH +Date: 19\03\2011 +Author: C4SS!0 and h1ch4m +Software Link: http://sourceforge.net/projects/mplayer-ww/files/MPlayerRelease/Revision%2033064/mplayerliter33064.7z/download +Version: Li...

Android Targeted by Two New Spyware Programs

Two new spyware programs, SW.SecurePhone and SW.Quieting, are targeting users of Android devices, mainly in the U.S., and could lead to serious data compromises, according to new research from NetQin Mobile. These programs are collecting all of the data saved on the phone’s SD card. This data...