CVE-2013-0125

Cross-site scripting XSS vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter...

C2 WebResource - 'File' Cross-Site Scripting

source: https://www.securityfocus.com/bid/58838/info C2 WebResource is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the contex...

C2 WebResource - File Cross-Site Scripting

C2 WebResource - File Cross-Site Scripting source: https://www.securityfocus.com/bid/58838/info C2 WebResource is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

Researchers Uncover 'TeamSpy' Attack Campaign Against Government, Research Targets

Researchers have uncovered a long-term cyber-espionage campaign that used a combination of legitimate software packages and commodity malware tools to target a variety of heavy industry, government intelligence agencies and political activists. Known as the TeamSpy crew because of its affinity fo...

Israeli Government Websites Targeted in Watering Hole Attack

A new watering hole attack has been reported, this one targeting two government-related websites based in Israel that have been injected with malware exploiting a six-month-old vulnerability in Internet Explorer. The two sites, ict.org.il and herzliyaconference.org, are related to Israel’s first...

Spear Phishing Campaigns Use Fake Mandiant APT1 Report as Lure

People looking to download and read the Mandiant report on Chinese government attacks on U.S. infrastructure should look carefully at the name of the file before opening it. Researchers say that there are at least two different spear-phishing attacks going on right now that are using rigged copie...

Phuse Web / Element C2 / Cox Web Design SQL Injection

Exploit Title : Phuse Web Sql Injection Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://www.phusewebdesign.co.uk/ Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows Server - win7 Dork : intext:"Site by Phuse W...

Element C2 SQL Injection

---------------------------------------------------------------- Element C2 SQL Injection ---------------------------------------------------------------- Exploit Title: Element C2 SQL Injection Author: Hack Center Security Team Discovered By : Net.W0lf Software Link: www.elementc2.com Impact :...

Unfixed XSS vulnerability at c2.com

Security researcher Sony, has submitted on 09/02/2012 a cross-site-scripting XSS vulnerability affecting c2.com, which at the time of submission ranked 38577 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/08/2012. It is currently unfixed. I...

Microsoft SQL Server Configuration Enumerator

This module will perform a series of configuration audits and security checks against a Microsoft SQL Server database. For this module to work, valid administrative user credentials must be supplied. This module requires Metasploit: https://metasploit.com/download Current source:...

FreeBSD : xerces-c2 -- Attribute blowup denial-of-service (76301302-1d59-11d9-814e-0001020eed82)

Amit Klein reports about Xerces-C++ : An attacker can craft a malicious XML document, which uses XML attributes in a way that inflicts a denial of service condition on the target machine XML parser. The result of this attack is that the XML parser consumes all the CPU. %NASLMINLEVEL 70300 C Tenab...

FreeBSD Ports: xerces-c2

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: xerces-c2

The remote host is missing an update to the system as announced in the referenced advisory. VID 76301302-1d59-11d9-814e-0001020eed82 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

[SECURITY] Fedora 8 Update: cups-1.3.6-2.fc8

The Common UNIX Printing System provides a portable printing layer for UNIX=C2=AE operating systems. It has been developed by Easy Software Produc ts to promote a standard printing solution for all UNIX vendors and users. CUPS provides the System V and Berkeley command-line interfaces...

Solaris Runtime Linker - Exploit Detection

This is a demonstration of exploit detection using the Solaris implementation of C2 Auditing BSM to detect the system has been compromised. Of course , it helps to be logging locally as well to a secure central log server or protected media. This was tested on an unpatched Solaris 10 Sparc system...

FreeBSD : xerces-c2 -- Attribute blowup denial-of-service (205)

The following package needs to be updated: xerces-c2 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg763013021d5911d9814e0001020eed82.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...