Moderate: Red Hat Security Advisory: JBoss Operations Network 3.1.1 update

JBoss Operations Network 3.1.1, which fixes one security issue, several bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base scor...

6 Million Virgin Mobile users vulnerable to Hackers

Virgin Mobile customers beware: Your phone number is the key to your personal information. According to independent developer Kevin Burke, who warned Virgin Mobile USA customers about a glaring security hole in the phone company's account login protocol said, "If you are one of the six million...

Moderate: Red Hat Security Advisory: JBoss Enterprise Data Services Platform 5.3.0 update

JBoss Enterprise Data Services Platform 5.3.0 roll up patch 1, which fixes one security issue and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVS...

The company's customer information and tracking management system CITMS 3.0 injection and upload vulnerabilities-vulnerability warning-the black bar safety net

Management system part of the function is as follows: （１）online add, modify, delete administrators （２）online add, modify, delete customer records, supporting HTML, etc.. （３）the front Desk recorded with the tracking function.． As well as the track record and the number of clicks on the display...

NeoBill CMS 0.8 Alpha - Multiple Vulnerabilities

Title: ====== NeoBill CMS v0.8 Alpha - Multiple Web Vulnerabilities Date: ===== 2012-08-18 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=685 VL-ID: ===== 685 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...

Microsoft Changes Mind; Will Patch Flash on IE 10 Before Windows 8 Ships

Microsoft has reversed course and said it will patch a serious Adobe Flash vulnerability in Windows 8 and Internet Explorer 10 before the new Microsoft OS ships Oct. 26. Microsoft had previously said it would wait until after the ship date to update Flash, which is integrated into the browser...

Kayako Fusion 4.40.1148 Cross Site Scripting

Advisory ID: HTB23095 Product: Kayako Fusion Vendor: Kayako Vulnerable Versions: 4.40.1148 and probably prior Tested Version: 4.40.1148 Vendor Notification: June 6, 2012 Public Disclosure: September 5, 2012 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2012-3233 CVSSv2 Base...

CVE-2011-5109

Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the SearchField parameter in a search action to 1 categorylist.php, 2 Copyofcalendarlist.php, 3 customerstatisticslist.php, 4 customerlist.php, and 5...

xt:Commerce <= v3.04 SP2.1 Time Based Blind SQL Injection

Exploit for php platform in category web applications +---------------------------------+ | xt:Commerce = v3.04 SP2.1 | | commerce:SEO = v2.1 CE | | Gambio = v2.0.10 SP1.4 | | Time Based Blind SQL Injection | +---------------------------------+ Author.............: Ralf Zimmermann...

ShopperPress v2.7 Wordpress - Cross Site Vulnerabilities

Document Title: =============== ShopperPress v2.7 Wordpress - Cross Site Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=670 Release Date: ============= 2012-08-01 Vulnerability Laboratory ID VL-ID: ==================================== 67...

Millions of Mobile Phone Users' Data Leaked in South Korea Scam

Two men have been arrested in South Korea for allegedly leaking the information of almost nine million of the nation’s mobile phone users, including details of the users’ monthly plans, according to a report issued by the Korea National Police Agency’s KNPA Cyber Terror Response Center CTRC over...

4XP Critical SQL Injection Vulnerability Exposed

zSecure team has recently discovered a critical SQL Injection Vulnerability in the web portal of 4XP, a leading online forex broker having more than 1 lakh customer base. Financial transactions are carried on the broker's paltform on daily basis including but not limited to Credit Card...

Avaya IP Office Customer Call Reporter code execution

It's possible to upload executable files via ImageUpload.ashx...

Distimo Monitor 6.0 - Multiple Cross Site Vulnerabilities

Document Title: =============== Distimo Monitor 6.0 - Multiple Cross Site Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=631 Release Date: ============= 2012-07-04 Vulnerability Laboratory ID VL-ID: ==================================== 6...

CVE-2012-3811

Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code by uploading an...

CVE-2012-3811

CVE-2012-3811 affects Avaya IP Office Customer Call Reporter (CCR) ImageUpload.ashx, where an unrestricted file upload allows remote code execution by uploading an executable and accessing it directly. Affected: CCR 7.0 up to 7.0.5.8 Q1 2012 Maintenance Release and 8.0 up to 8.0.9.13 Q1 2012 Main...

CVE-2012-3811

Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code by uploading an...

Avaya IP Office Customer Call Reporter ImageUpload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Avaya IP Office Customer Call Reporter. Authentication is not required to exploit this vulnerability. The specific flaw exists because Avaya IP Office Customer Call Reporter allows unauthenticated...

Avaya IP Office Customer Call Reporter ImageUpload.ashx Remote Command Execution

This module exploits an authentication bypass vulnerability on Avaya IP Office Customer Call Reporter, which allows a remote user to upload arbitrary files through the ImageUpload.ashx component. It can be abused to upload and execute arbitrary ASP .NET code. The vulnerability has been tested...

FTC Sues Wyndham Over Breaches Linked to $10m In Fraud

UPDATE: The U.S. Federal Trade Commission has fined Wyndham Hotels for a string of data breaches that resulted in information on hundreds of thousands of customers being lost to cyber criminals. An FTC complaint, filed on June 26, 2012, asks for “permanent injunctive relief” against Wyndham for...