KLA10803 VMware Workstation 10.x end of life

VMware announced the end of support for VMware Workstation 10.x. Users should immediately make transition to VMware Workstation 11.x or later Original advisories https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/support/product-lifecycle-matrix.pdf Related products...

Weak Password Vulnerability in Government Website Management System of E-Tron Networks

E-Tron web government website management system is a system for government Internet access system, government website system customization services. A weak password vulnerability exists in part of the back-end of the NetGov ad management system. An attacker can utilize the vulnerability to log in...

Threat Outbreak Alert RuleID17312: Email Messages Distributing Malicious Software on August 12, 2015

Medium Alert ID: 40418 First Published: 2015 August 12 14:05 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17312 may contain the following files: Name |...

Discuz 前台回帖 存储型 DOM XSS

产生原因： JS原生取ELEMENT中HTML内容的方法，会将服务端转义过的单双引号实体编码进行反转。 代码分析： 这里有payload: align="onmouseover="alert1, 那么就从payload开始往回看漏洞是怎么产生的 align="onmouseover="alert1 回帖之后payload显示如上述所示, 跟进 管理员/版主 编辑帖子时的操作 var editorid = 'e'; var textobj = $editorid + 'textarea'; 这里得到textobj = 'etextarea' /static/js/common.js...

Important: Red Hat Security Advisory: java-1.5.0-ibm security update

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

CVE-2015-4289

Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.02049 allows remote head-end systems to write to arbitrary files via a crafted configuration attribute, aka Bug ID CSCut93920...

Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability

A vulnerability in the connection establishment process of Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, remote attacker to write or overwrite files in the active user's context. The vulnerability is due to insufficient input validation. An unauthenticated, remote attack...

[SECURITY] [DSA 3314-1] typo3-src end of life

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3314-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 23, 2015 https://www.debian.org/security/faq -...

DSA-3314-1 typo3-sec - end of life

Bulletin has no description...

System: multiple XSS flaws

Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System Agent and End Entity pages. An attacker could use these flaws to perform a cross-site scripting XSS attack against victims using the Certificate System's web interface...

curl: URL request injection vulnerability in parseurlandfillconn()

It was discovered that the libcurl library failed to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl access a specially crafted URL via an HTTP proxy could use this flaw to inject additional headers to the request or construct...

WordPress Front End Repository Manager Plugin <= 1.1 - Arbitrary File Upload

Because of this vulnerability, users can upload malicious executable scripts. Solution Update the plugin...

UK to ban WhatsApp, iMessage and Snapchat Under New Laws

If you rely on messaging apps to remain in contact with your family members and friends, then you may have to switch back to old-fashioned text messaging service in matter of weeks due to a new law currently going through Parliament. WhatsApp and Facebook Messenger to Ban in UK The popular...

Veeam Backup & Replication Upgrade Paths

Tenants of Veeam Cloud Service Providers If your Veeam Backup & Replication installation is connected to a Veeam Cloud Service Provider, contact your Service Provider before upgrading to ensure that the intended upgrade will not break compatibility. A tenant cannot be on a newer version of Veeam...

WordPress Albo Pretorio Online 3.2 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Albo Pretorio Online 3.2 Multiple Vulnerabilities Google Dork: inurl:/?action=visatto Date: 09/06/2015 Exploit Author: Alessandro Cingolani Vendor Homepage: http://plugin.sisviluppo.info/ Software Link:...

Mao10cms最新版前台注入(有条件限制)

简要描述： Mao10cms最新版前台注入 详细说明： Mao10cms用户量不小，2015-06-25更新的V3.5.2，今天来学习一下吧 这个注入问题出现在模板文件中，有多个地方引用这个模板，这里说3个漏洞，是这个问题文件中存在多个注入点引用这个出问题的文件。 问题文件在/theme/default/article/single.php,看代码 ;" " 无关代码 看到文件...

Mao10cms最新版前台注入2枚打包

简要描述： Mao10cms最新版前台注入2枚打包，可出任意数据 详细说明： Mao10cms用户量不小，2015-06-25更新的V3.5.2，今天来学习一下吧 两个注入点，分别存在在于application/common/common/function.php/mctitle方法和application/common/common/function.php/mcseo中。注入产生的原因都是id没有过滤，这两个注入点前台可直接注入出数据。这里以application/common/common/function.php/mctitle为例进行说明。...

Wordpress Front-end Editor File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Wordpress Front-end Editor File Upload', 'Description' = %q The Wordpress Front-end Editor plugin contains an authenticated file...

I2P - The Invisible Internet Project

I2P is an anonymous network, exposing a simple layer that applications can use to anonymously and securely send messages to each other. The network itself is strictly message based a la IP, but there is a library available to allow reliable streaming communication on top of it a la TCP. All...

Facebook Adds PGP Encryption Feature to Email

Facebook announced early Monday that the social network is in the process of adopting OpenPGP encryption and that it will give privacy conscious users the ability to post their public keys on their profile. The feature, which is gradually rolling out to users today, should better lock down messag...