JVN#20812625: Advance-Flow vulnerable to SQL injection

Advance-Flow provided by OSK Co., LTD contains an issue in processing input data, which may result in SQL injection. Impact A user may obtain or alter information on the database. Solution Do not use Advance-Flow The developer has stated that the support of Advance-Flow has been discontinued thus...

EFF Releases Open Wireless Router Firmware

The EFF is working on an open wireless router firmware that’s designed to be a secure and flexible alternative to the existing software that runs on home and small business routers, much of which is notoriously insecure. The Open Wireless Router project, which the organization announced at the HO...

InterTech Co 1.0 - SQL Injection

No description provided by source. ------------------------------------------------------ ./SEC-R1Z / / / / /\ \ |/ / \ \ / / / / | | / | | / / \ / / / / | || / | | / / \ \ \ \2010 | \ | | / / / \ /\ / ||\ \ ||/ \ R.I.P MichaelJackson !!!!! ------------------------------------------------------ ?...

IRIX 6.5.x Performance Co-Pilot Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4642/info Performance Co-Pilot PCP is a set of services to support system-level performance monitoring developed by SGI. It has traditionally been an IRIX product, however SGI has made it open source and it is now availab...

SGI Performance Co-Pilot 2.1.x/2.2 pmpost Symbolic Link Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2887/info Performance Co-Pilot PCP is a set of services to support system-level performance monitoring developed by SGI. It has traditionally been an IRIX product, however SGI has made it open source and it is now availab...

Vulnerability in OpenSSL - SSL/TLS MITM vulnerability

An attacker can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle MITM attack where the attacker can decrypt and modify traffic from the attacked client and server. Found by KIKUCHI Masashi Lepidum Co. Ltd...

Alleged BlackShades Malware Co-Author pleads not Guilty

A Swedish man accused of being involved in the creation of the malicious software used to infect over half a million systems in more than dozens of countries, has pleaded not guilty in New York on Thursday to computer hacking charges brought against him. Alex Yucel, 24, who is the co-author of th...

CVE-2013-4598

The Groups, Communities and Co GCC module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permission, which allows remote attackers to access the configuration pages via unspecified vectors...

Aleph 500 Cross Site Scripting

Greetings: a ALEPH500 Integrated library management system Cross Site Scripting£»CVE-ID is CVE-2014-3718. Aleph 500, fully meet the industry standard, is an art class perfect librarysolution, the Ex Libris to pursue the essence of philosophy is flexible and easy to use. Ex Libris is the world...

JVN#55438786: Content Provider in CamiApp for Android fails to restrict access permissions

The Content Provider in CamiApp for Android provided by KOKUYO S&T Co.,Ltd. contains an issue where access permissions are not restricted. Impact If a user of the affected product uses another malicious Android application, information stored in the database may be obtained or altered. Solution...

JVN#17849447: EC-CUBE vulnerable to information alteration

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information alteration vulnerability. Impact User's information may be altered by other user who visits the shopping site. Solution Apply the update or the patch Apply the update or the patch...

Small ants local portal system sql injection vulnerability-vulnerability warning-the black bar safety net

public/ajax. aspx? action=addcomparebuild&cname=sqlinject Official recruitment demoxiaomayico and select top 1 name from demoxiaomayico. dbo. sysobjects where xtype=CHAR8 50– and select top 1 username from Antadmin0– The account and select top 1 password from Antadmin0– The password hash They say...

FileMaster SY-IT 3.1 LFI / Shell Upload

Document Title: =============== FileMaster SY-IT v3.1 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1170 Release Date: ============= 2013-12-16 Vulnerability Laboratory ID VL-ID: ====================================...

FileMaster SY-IT v3.1 iOS - Multiple Web Vulnerabilities

Document Title: =============== FileMaster SY-IT v3.1 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1170 Release Date: ============= 2013-12-15 Vulnerability Laboratory ID VL-ID: ====================================...

FileMaster SY-IT v3.1 iOS - Multiple Web Vulnerabilities

Document Title: =============== FileMaster SY-IT v3.1 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1170 Release Date: ============= 2013-12-15 Vulnerability Laboratory ID VL-ID: ====================================...

CO-TRAVELER : NSA's Cellphone Location Tracking Tool gathering 5 Billion records a day

Believe it or not, but the National Security Agency NSA is gathering nearly 5 billion records a day on mobile phone locations around the world. Snowden released documents that show that the NSA is tracking cell phone locations the world over as well as map the relationships of the mobile phone us...

JVN#61077110: EC-CUBE vulnerable to information disclosure

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in processing the output of error logs, which may lead to information disclosure. Impact A user who visits the shopping site may view the information managed by the website owner...

JVN#06377589: EC-CUBE vulnerable to cross-site scripting

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Apply the update or the patch Apply the update or the patch according to the...

TVT TD-2308SS-B DVR contains a directory traversal vulnerability

Overview TVT TD-2308SS-B DVR and possibly other models contain a directory traversal vulnerability CWE-22. Description CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' TVT TD-2308SS-B DVR and possibly other models running firmware version 3.2.0.P-3520A-00 conta...

Opolis.eu Secure Mail Blind SQL Injection / XSS / CSRF / DoS

Opolis.eu suffers from cross site request forgery, cross site scripting, denial of service, and remote blind SQL injection vulnerabilities. The vendor has not responded to the researchers reports of these issues...