CVE-2016-1019: A New Flash Exploit Included in Magnitude Exploit Kit

On April 2, security researcher @Kafeine at Proofpoint discovered a change to the Magnitude Exploit Kit. Thanks to their collaboration, we analyzed the sample and discovered that Magnitude EK was exploiting a previously unknown vulnerability in Adobe Flash Player CVE-2016-1019. The in-the-wild...

Rack-Bug - Debugging Toolbar For Rack Applications Implemented As Middleware

Rack::Bug adds a diagnostics toolbar to Rack apps. When enabled, it injects a floating div allowing exploration of logging, database queries, template rendering times, etc. Features Password-based security IP-based security Rack::Bug instrumentation/reporting is broken up into panels. Panels in...

globalresearch.ca XSS vulnerability

Vulnerable URL: http://www.globalresearch.ca/authors?query=/-///'/"/// /oNcliCk=alert //%0D%0A%0D%0A//...

Hackers behind Dyre Malware Busted in Police Raid

The world's most notorious financial hacking operation disrupted by Russian authorities in November, when they raided the offices associated with a Moscow-based film and production company named 25th Floor. According to the Russian authorities, 25th Floor was allegedly involved in distributing th...

LiteSpeed Web Server 5.1.0 HTTP Header Injection

Information -------------------- Advisory by Netsparker Name: HTTP Header Injection in LiteSpeed Web Server Affected Software : LiteSpeed Web Server Affected Versions: v5.1.0 and possibly below Vendor Homepage : https://www.litespeedtech.com/ Vulnerability Type : HTTP Header Injection Severity :...

WordPress Gallery Master 1.0.22 Cross Site Scripting

Exploit : For Exploiting This Vulnerability Install Testimonial Slider Plugin Then Create New SGallery In Gallery Title Input And Gallery Description Place Your JavaScript Code After Creating Gallery JavaScript Code Will Be Executed . Plugin Is Accessable By Authors , Administartors , Editors...

Article Script 1.00 SQL Injection

Exploit Title : Article Script SQL Injection Vulnerability Exploit Author : Linux Zone Research Team Vendor Homepage: http://articlesetup.com/ Google Dork : inurl:/article.php?id= intext:Powered By Article Marketing Software Link : http://www.ArticleSetup.com/downloads/ArticleSetup-Latest.zip Dat...

Zpanel - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/exploit/phpexe' require 'nokogiri' require 'uri' class Metasploit3 'Zpanel Remote Unauthenticated RCE', 'Description' = %q This modul...

DEBIAN-CVE-2015-5622

Cross-site scripting XSS vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.ph...

wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension

Ignacio R. Morelle reports: As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release announcements, a security vulnerability targeting add-on authors was found bug 23504 which allowed a malicious user to obtain add-on server passphrases from the client's .pbl files and transmit them over the...

Symphony CMS Cross-Site Scripting Vulnerability (CNVD-2015-03920)

Symphony CMS is a content management system CMS developed in PHP and MySQL. The system supports search engine optimization, module extensions and more. A cross-site scripting vulnerability exists in Symphony CMS version 2.6.2, which stems from the system/authors URI failing to adequately filter t...

CVE-2015-4661: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Symphony CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the sort parameter to system/authors...

Stegoloader Malware Uses Steganography to Hide Itself

Malware writers aren’t hesitant to do what it takes to protect a campaign and keep it hidden from detection technologies and security researchers. The group behind the Stegoloader malware, disclosed Monday by researchers at Dell SecureWorks, has taken to digital steganography to keep its...

phpMyAdmin 4.0.x, 4.1.x, 4.2.x - DoS

Exploit for php platform in category dos / poc ============= DESCRIPTION: ============= A vulnerability present in in phpMyAdmin 4.0.x before 4.0.10.7, 4.1. x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service resource consumption via a long password...

phpMyAdmin 4.0.x4.1.x4.2.x - Denial of Service

phpMyAdmin 4.0.x4.1.x4.2.x - Denial of Service ============= DESCRIPTION: ============= A vulnerability present in in phpMyAdmin 4.0.x before 4.0.10.7, 4.1. x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service resource consumption via a long password...

Drupal 7.34 - Denial of Service

Drupal 7.34 - Denial of Service ==================================================================== DESCRIPTION: ==================================================================== A vulnerability present in Drupal validuserpayload && printf "%s" 1..1000000 validuserpayload && echo -n "&op=Log...

WordPress Core < 4.0.1 - Denial of Service

==================================================================== DESCRIPTION: ==================================================================== A vulnerability present in Wordpress validuserpayload && printf "%s" 1..1000000 validuserpayload && echo -n "&op=Log in&formid=userlogin"...

Drupal < 7.34 - Denial of Service

==================================================================== DESCRIPTION: ==================================================================== A vulnerability present in Drupal validuserpayload && printf "%s" 1..1000000 validuserpayload && echo -n "&op=Log in&formid=userlogin"...

Angler Exploit Kit Adds New Flash Exploit

Exploit kit authors are nothing if not opportunistic, and they know a prime opportunity when they see one. Adobe Flash bugs fit that description nicely, and the people behind the Angler exploit kit already are exploiting one of the Flash bugs patched last week in the kit’s arsenal. This is a comm...

Ahrareandeysheh CMS Cross Site Scripting

@@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@...