BlinkSale Bug Bounty #2 - Cross Site Scripting Vulnerability

Document Title: =============== BlinkSale Bug Bounty 2 - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1448 Release Date: ============= 2015-09-28 Vulnerability Laboratory ID VL-ID: ===================================...

NodeBB v0.8.2 - Client Side Cross Site Web Vulnerability

Document Title: =============== NodeBB v0.8.2 - Client Side Cross Site Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1608 Release Date: ============= 2015-09-24 Vulnerability Laboratory ID VL-ID: ====================================...

NodeBB v0.8.2 - Client Side Cross Site Web Vulnerability

Document Title: =============== NodeBB v0.8.2 - Client Side Cross Site Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1608 Release Date: ============= 2015-09-23 Vulnerability Laboratory ID VL-ID: ====================================...

mbedTLS/PolarSSL -- multiple vulnerabilities

ARM Limited reports: Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach for PKCS1 v1.5 signatures. These releases include countermeasures against that attack. Fabian Foerg of Gotham Digital Science found a possible client-side NULL pointer dereference, using the AFL Fuzzer. This...

Yahoo Bug Bounty #32 - Cross Site Request Forgery bulkImport Web Vulnerability

A client-side cross site scripting web vulnerability has been discovered in the official Yahoo online service web-application. The vulnerability allows remote attacker to manipulate client-side web-application to browser request to compromise session data. The vulnerability is located in the...

Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure

Posted by Mateusz Jurczyk of Google Project Zero In the previous series of posts parts 1 2 3 4, we discussed the exploitation process of a serious “blend” vulnerability CVE-2015-0093 / CVE-2015-3052, which was special in that it provided the attacker with an extremely powerful primitive arbitrary...

Yahoo Gemini Cross Site Request Forgery

Document Title: =============== Yahoo Bug Bounty 32 - CSRF bulkImport Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1552 Release Date: ============= 2015-09-03 Vulnerability Laboratory ID VL-ID: ==================================== 15...

ZyXEL ZyWALL USG client side authorization config disclosure

Details ======= Product: ZyXEL USG Unified Security Gateway appliances ZyWALL USG-20 ZyWALL USG-20W ZyWALL USG-50 ZyWALL USG-100 ZyWALL USG-200 ZyWALL USG-300 ZyWALL USG-1000 ZyWALL USG-1050 ZyWALL USG-2000 Possibly other ZLD-based products Affected Versions: Firmware Releases before April 25, 20...

Yahoo Bug Bounty #32 - CSRF bulkImport Web Vulnerability

Document Title: =============== Yahoo Bug Bounty 32 - CSRF bulkImport Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1552 Release Date: ============= 2015-09-03 Vulnerability Laboratory ID VL-ID: ==================================== 15...

Yahoo Bug Bounty #32 - CSRF bulkImport Web Vulnerability

Document Title: =============== Yahoo Bug Bounty 32 - CSRF bulkImport Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1552 Release Date: ============= 2015-09-03 Vulnerability Laboratory ID VL-ID: ==================================== 15...

Basware Banking Denial of Service Vulnerability

Basware Banking Maksuliikenne is a suite of software from the Finnish company Basware that establishes connections with banks to manage their own finances. A security vulnerability exists in Basware Banking version 8.90.07 and earlier, which arises from the program's reliance on the client to...

AirDroid ID - Client Side JSONP Callback Vulnerability

Document Title: =============== AirDroid ID - Client Side JSONP Callback Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1544 Release Date: ============= 2015-07-10 Vulnerability Laboratory ID VL-ID: ==================================== 154...

UBNT Bug Bounty #1 - Client Side Cross Site Scripting Vulnerability

Document Title: =============== UBNT Bug Bounty 1 - Client Side Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1465 52988 Release Date: ============= 2015-08-17 Vulnerability Laboratory ID VL-ID:...

UBNT Bug Bounty #1 - CS Cross Site Scripting Vulnerability

Document Title: =============== UBNT Bug Bounty 1 - CS Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1465 52988 Release Date: ============= 2015-08-17 Vulnerability Laboratory ID VL-ID:...

libgadu: Multiple vulnerabilities

Background libgadu is a library that implements the client side of the Gadu-Gadu protocol. Description libgadu contains multiple vulnerabilities: X.509 certificates are not properly validated CVE-2013-4488 A integer overflow error could lead to a buffer overflow CVE-2013-6487 Malformed responses...

Microsoft System Center Operations Manager Cross-Site Scripting Vulnerability

Microsoft System Center Operations Manager is a Microsoft architecture for effective monitoring and management of IT environments, providing views of operational status, performance information, and generating alerts based on availability, performance, configuration, or security conditions. A...

Apple Support - Permission Exception Web Vulnerability

Document Title: =============== Apple Support - Permission Exception Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1531 Apple ID: 624514370 Release Date: ============= 2015-08-13 Vulnerability Laboratory ID VL-ID:...

foreman: the _session_id cookie is issued without the Secure flag

It was found that Foreman did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie...

Apple Consultants - Client Side Cross Site Vulnerability

Document Title: =============== Apple Consultants - Client Side Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1533 Apple ID: 624519287 Release Date: ============= 2015-08-12 Vulnerability Laboratory ID VL-ID:...

Apple Consultants - Client Side Cross Site Vulnerability

Document Title: =============== Apple Consultants - Client Side Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1533 Apple ID: 624519287 Release Date: ============= 2015-08-11 Vulnerability Laboratory ID VL-ID:...