UBUNTU-CVE-2015-8768

click/install.py in click does not require files in package filesystem tarballs to start with ./ dot slash, which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone...

Code injection

click/install.py in click does not require files in package filesystem tarballs to start with ./ dot slash, which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone...

CVE-2015-8768

The CVE concerns the Python-based Click package (install.py) where file names in tarballs are not required to start with ./, enabling a crafted package to bypass checks and install an alternate security policy, potentially elevating privileges. Affected component: click/install.py; context mentio...

CVE-2015-8768

click/install.py in click does not require files in package filesystem tarballs to start with ./ dot slash, which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone...

CVE-2015-8768: Undefined Security Weakness

click/install.py in click does not require files in package filesystem tarballs to start with ./ dot slash, which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone...

Locky Ransomware, Kovter Click-Fraud Malware Spreading in Same Campaigns

Researchers at Microsoft’s Malware Protection Center have spotted malicious email campaigns using .lnk attachments to spread Locky ransomware and the Kovter click-fraud Trojan, the first time criminals have simultaneously distributed both pieces of malware. According to Microsoft, the .lnk file n...

CVE-2016-8911

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attac...

CVE-2016-8911

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attac...

Design/Logic Flaw

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attac...

CVE-2016-8911: Undefined Security Weakness

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attac...

Yelp: Click jacking in delete image of user in Yelp

Hello, Problem I found that https://www.yelp.com/userphotos/photoid/remove is vulnerable to click-jacking because of missing X-Frame-Options on this page which allows an attacker to send the victim the POC sent with the report to the user to remove his profile picture POC Click You've been...

FiercePhish - A Full-Fledged Phishing Framework To Manage All Phishing Engagements

FiercePhish is a full-fledged phishing framework to manage all phishing engagements. It allows you to track separate phishing campaigns, schedule sending of emails, and much more. The features will continue to be expanded and will include website spoofing, click tracking, and extensive notificati...

Google to Block .js Attachments in Gmail

Spammers and cybercriminals have revived email-based attacks in the last year, giving new life to macro-based malware hidden in Word documents, and with greater intensity of late, .js files that run JavaScript on infected clients, largely to download malware from an attacker’s site. Google...

My Click Counter Authentication Bypass Vulnerability

My Click Counter is a PHP-based click counter that can also be used as a download counter. An authentication bypass vulnerability exists in the administrator login page of My Click Counter version 1.0, which can be exploited by attackers to gain administrator privileges...

openSUSE: Security Advisory for roundcubemail (openSUSE-SU-2016:3309-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

My Click Counter 1.0 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications x Type: Admin login bypass via SQLi x Vendor: http://software.friendsinwar.com/ x Script Name: My Click Counter x Script Version: 1.0 x Script DL: http://software.friendsinwar.com/downloads.php?catid=2&fileid=15 x Author: AnarchyAngel AKA Adam...

My Click Counter 1.0 - Authentication Bypass

My Click Counter 1.0 - Authentication Bypass x Type: Admin login bypass via SQLi x Vendor: http://software.friendsinwar.com/ x Script Name: My Click Counter x Script Version: 1.0 x Script DL: http://software.friendsinwar.com/downloads.php?catid=2&fileid=15 x Author: AnarchyAngel AKA Adam x Mail :...

openSUSE Security Update : roundcubemail (openSUSE-2016-1533)

This update for roundcubemail fixes the following issues : - A maliciously crafted email could cause untrusted code to be executed cross site scripting using $lt;area href=javascript:... boo982003, CVE-2016-5103 - Avoid HTML styles that could cause potential click jacking boo1001856 - A malicious...

My Click Counter 1.0 - Authentication Bypass

x Type: Admin login bypass via SQLi x Vendor: http://software.friendsinwar.com/ x Script Name: My Click Counter x Script Version: 1.0 x Script DL: http://software.friendsinwar.com/downloads.php?catid=2&fileid=15 x Author: AnarchyAngel AKA Adam x Mail : anarchydotang31@gmaildotcom Navigate to...

Security update for roundcubemail (important)

This update for roundcubemail fixes the following issues: - A maliciously crafted email could cause untrusted code to be executed cross site scripting using $lt;area href=javascript:... boo982003, CVE-2016-5103 - Avoid HTML styles that could cause potential click jacking boo1001856 - A maliciousl...