X (Formerly Twitter): Bypassing Digits bridge origin validation

Hi, I would like to report an issue in the bridge proxy in Digits which allows attacker to retrieve the OAuth credential data of an application victims authorized. Detail In the Digits Web SDK, the method getLoginStatus can be used to retrieve the OAuth credential data of an application if the us...

Remote Code Execution in Exponent

High-Tech Bridge Security Research Lab discovered critical vulnerability in Exponent CMS, which can be exploited to inject and execute arbitrary PHP code on the vulnerable system with the privileges of the web server. The vulnerability resides within "/install/index.php" script, when handling...

Credit Card Magstripe Spoofer: MagSpoof

MagSpoof is a device that can spoof/emulate any magnetic stripe or credit card. It can work “wirelessly”, even on standard magstripe/credit card readers, by generating a strong electromagnetic field that emulates a traditional magnetic stripe card. MagSpoof does not enable you to use credit cards...

orion.extfeedbackform Bitrix Module 2.1.2 CSRF / SQL Injection

Advisory ID: HTB23280 Product: orion.extfeedbackform Bitrix module Vendor: www.orion-soft.ru Vulnerable Versions: 2.1.2 and probably prior Tested Version: 2.1.2 Advisory Publication: November 18, 2015 without technical details Vendor Notification: November 18, 2015 Vendor Patch: December 11, 2015...

Zen Cart 1.5.4 Local File Inclusion Vulnerability

Zen Cart version 1.5.4 suffers from a local file inclusion vulnerability. Product: Zen Cart Vendor: Zen Ventures, LLC Vulnerable Versions: 1.5.4 Tested Version: 1.5.4 Advisory Publication: November 25, 2015 without technical details Vendor Notification: November 25, 2015 Vendor Patch: November 26...

Bitrix bitrix.mpbuilder Module 1.0.10 - Local File Inclusion

Bitrix bitrix.mpbuilder Module 1.0.10 - Local File Inclusion Advisory ID: HTB23281 Product: bitrix.mpbuilder Bitrix module Vendor: www.1c-bitrix.ru Vulnerable Versions: 1.0.10 and probably prior Tested Version: 1.0.10 Advisory Publication: November 18, 2015 without technical details Vendor...

Bitrix bitrix.xscan Module 1.0.3 - Directory Traversal

Bitrix bitrix.xscan Module 1.0.3 - Directory Traversal Advisory ID: HTB23278 Product: bitrix.xscan Bitrix module Vendor: Bitrix Vulnerable Versions: 1.0.3 and probably prior Tested Version: 1.0.3 Advisory Publication: November 18, 2015 without technical details Vendor Notification: November 18,...

Bitrix bitrix.mpbuilder Module 1.0.10 - Local File Inclusion

Advisory ID: HTB23281 Product: bitrix.mpbuilder Bitrix module Vendor: www.1c-bitrix.ru Vulnerable Versions: 1.0.10 and probably prior Tested Version: 1.0.10 Advisory Publication: November 18, 2015 without technical details Vendor Notification: November 18, 2015 Vendor Patch: November 25, 2015...

Bitrix bitrix.xscan Module 1.0.3 - Directory Traversal

Advisory ID: HTB23278 Product: bitrix.xscan Bitrix module Vendor: Bitrix Vulnerable Versions: 1.0.3 and probably prior Tested Version: 1.0.3 Advisory Publication: November 18, 2015 without technical details Vendor Notification: November 18, 2015 Vendor Patch: November 24, 2015 Public Disclosure:...

bitrix.scan Bitrix 1.0.3 Path Traversal Vulnerability

bitrix.mpbuilder Bitrix module version 1.0.10 suffers from a local file inclusion vulnerability. Product: bitrix.mpbuilder Bitrix module Vendor: www.1c-bitrix.ru Vulnerable Versions: 1.0.10 and probably prior Tested Version: 1.0.10 Advisory Publication: November 18, 2015 without technical details...

bitrix.mpbuilder Bitrix 1.0.10 Local File Inclusion

Advisory ID: HTB23281 Product: bitrix.mpbuilder Bitrix module Vendor: www.1c-bitrix.ru Vulnerable Versions: 1.0.10 and probably prior Tested Version: 1.0.10 Advisory Publication: November 18, 2015 without technical details Vendor Notification: November 18, 2015 Vendor Patch: November 25, 2015...

bitrix.scan Bitrix 1.0.3 Path Traversal Vulnerability

bitrix.scan Bitrix module version 1.0.3 suffers from a path traversal vulnerability. Product: bitrix.xscan Bitrix module Vendor: Bitrix Vulnerable Versions: 1.0.3 and probably prior Tested Version: 1.0.3 Advisory Publication: November 18, 2015 without technical details Vendor Notification: Novemb...

WordPress Calls To Action 2.4.3 Cross Site Scripting Vulnerability

WordPress Calls to Action plugin version 2.4.3 suffers from a cross site scripting vulnerability. Product: Calls to Action WordPress plugin Vendor: InboundNow Vulnerable Versions: 2.4.3 and probably prior Tested Version: 2.4.3 Advisory Publication: October 7, 2015 without technical details Vendor...

WordPress Gwolle Guestbook 1.5.3 Remote File Inclusion Vulnerability

WordPress Gwolle Guestbook plugin version 1.5.3 suffers from a remote file inclusion vulnerability. Product: Gwolle Guestbook WordPress Plugin Vendor: Marcel Pol Vulnerable Versions: 1.5.3 and probably prior Tested Version: 1.5.3 Advisory Publication: October 14, 2015 without technical details...

WordPress Role Scoper 1.3.66 Cross Site Scripting Vulnerability

WordPress Role Scoper plugin version 1.3.66 suffers from a cross site scripting vulnerability. Product: Role Scoper WordPress plugin Vendor: Kevin Behrens Vulnerable Versions: 1.3.66 and probably prior Tested Version: 1.3.66 Advisory Publication: October 29, 2015 without technical details Vendor...

WordPress Ultimate Member 1.3.28 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Product: Ultimate Member WordPress plugin Vendor: Ultimate Member Vulnerable Versions: 1.3.28 and probably prior Tested Version: 1.3.28 Advisory Publication: October 29, 2015 without technical details Vendor Notification: October 29, 2015 Vend...

WordPress Gwolle Guestbook 1.5.3 Remote File Inclusion

Advisory ID: HTB23275 Product: Gwolle Guestbook WordPress Plugin Vendor: Marcel Pol Vulnerable Versions: 1.5.3 and probably prior Tested Version: 1.5.3 Advisory Publication: October 14, 2015 without technical details Vendor Notification: October 14, 2015 Vendor Patch: October 16, 2015 Public...

WordPress Ultimate Member 1.3.28 Cross Site Scripting

Advisory ID: HTB23277 Product: Ultimate Member WordPress plugin Vendor: Ultimate Member Vulnerable Versions: 1.3.28 and probably prior Tested Version: 1.3.28 Advisory Publication: October 29, 2015 without technical details Vendor Notification: October 29, 2015 Vendor Patch: October 31, 2015 Publi...

WordPress Calls To Action 2.4.3 Cross Site Scripting

Advisory ID: HTB23274 Product: Calls to Action WordPress plugin Vendor: InboundNow Vulnerable Versions: 2.4.3 and probably prior Tested Version: 2.4.3 Advisory Publication: October 7, 2015 without technical details Vendor Notification: October 7, 2015 Vendor Patch: October 27, 2015 Public...

Apache Cordova Android Random Value Generation Improperly Vulnerability

Apache Cordova Android is an open source project after contributing to Apache , the core code from PhoneGap , is the core engine that drives PhoneGap , providing enabling mobile applications to JavaScript access to native device functionality , such as the camera , microphone and so on . Apache...