7195 matches found
Flexera AdminStudio LaunchProcess Function ActiveX Control Remote Command Execution
The remote host has the Flexera AdminStudio LaunchHelp ActiveX control installed. The control is affected by a remote command execution vulnerability that can be triggered by sending a directory traversal string to the 'LaunchProcess' function. By tricking a victim into visiting a specially craft...
Omnistar Mailer - Multiple SQL Injections / HTML Injection Vulnerabilities
source: https://www.securityfocus.com/bid/55760/info Omnistar Mailer is prone to multiple SQL-injection vulnerabilities and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow an attacker to compromise the application,...
Multiple vulnerabilities in IFOBS
Hello 3APA3A! I want to warn you about Brute Force and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks. These are the first 38 vulnerabilities in IFOBS: 2 BF and 36 XSS...
BF and XSS vulnerabilities in IFOBS
Hello 3APA3A! I want to warn you about Brute Force and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks. These are the next 36 vulnerabilities in IFOBS: 2 BF and 34 XSS in...
php file include vulnerability solution-exploits warning-the black bar safety net
Now the program code is written more and more strange, it is a file that contains the code you can write 2 ways: require the include Be the first to say require if error then terminate the output and include if error then continue execution. If a website Management User write in auth. php, and...
Large-Scale Water Holing Attack Campaigns Hitting Key Targets
A new APT-style espionage campaign launched this summer targeting organizations tied to financial services, government agencies and the defense industry used a technique dubbed water holing to entice victims and silently redirect them to sites hosting zero-day exploits. Researchers at RSA Securit...
SAP NetWeaver HTTP - Partial HTTP POST requests DoS
Application: SAP Versions Affected: SAP Netweaver 7.02/7.3, probably others Vendor URL: http://www.sap.com Bugs: Denial of Service Exploits: YES Reported: 25.09.2012 Vendor response: 26.09.2012 Date of Public Advisory: 17.10.2014 Reference: SAP Security Note 1986725 Author: Alexey Tyurin ERPScan...
IFOBS Cross Site Request Forgery / Cross Site Scripting Vulnerability
Exploit for php platform in category web applications Hello list! I want to warn you about Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks...
IFOBS Cross Site Request Forgery / Cross Site Scripting
Hello list! I want to warn you about Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks. These are the next 35 vulnerabilities in IFOBS: 1 CSRF...
Microsoft Releases Out-Of-Band IE Zero-Day Patch
As expected, Microsoft today released a cumulative update for Internet Explorer addressing the zero-day vulnerability in the browser being actively exploited in the wild. Security Update MS 12-063 patches not only the critical remote-execution zero-day, but four other vulnerabilities privately...
Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)
The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components : - Apache - BIND - CoreText - Data Security - ImageIO - Installer - International Components for Unicode - Kernel - Mail - PHP ...
SAP NetWeaver HTTPd - Partial HTTP POST requests DoS
Application: SAP Versions Affected: SAP Netweaver 7.02/7.3, probably others Vendor URL: http://www.sap.com Bugs: Denial of Service Exploits: YES Reported: 19.09.2012 Vendor response: 20.09.2012 Date of Public Advisory: 17.10.2014 Reference: SAP Security Note 1966655 Author: Alexey Tyurin ERPScan...
Researcher Finds Three New Exploits Targeting Latest IE Zero-Day
A researcher at AlienVault has discovered three new servers delivering exploits targeting the latest zero-day vulnerability in Internet Explorer. Jamie Blasco, AlienVault Labs manager, said the one of the servers is delivering a new malware payload, and all of them appear to be targeting defense...
VUPEN - Mozilla Firefox "nsHTMLEditRules" Remote Use-after-free (CVE-2012-3958 / MFSA 2012-58)
VUPEN Security Research - Mozilla Firefox "nsHTMLEditRules" Remote Use-after-free CVE-2012-3958 / MFSA 2012-58 Website : http://www.vupen.com/english/research.php Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Mozilla Firefox is a free and open source web browser and...
Latest IE Zero-Day Flaw Tied to Nitro Hackers and Recent Java Zero-Day Exploits
Security experts are warning enterprise and consumer users to stay away from Internet Explorer until Microsoft issues a patch for a new zero-day vulnerability in the browser. Active exploits have been discovered in the wild and are being linked to Nitro, the same group of hackers from China who...
Tool Scans for RTF Files Spreading Malware in Targeted Attacks
Exploits embedded inside Microsoft Office documents such as Word, PDFs and Excel spreadsheets have been at the core of many targeted attacks during the past 24 months. Detection of these attack methods is improving and nimble hackers are recognizing the need for new avenues into enterprise...
BlackHole Exploit Kit 2.0 released with more latest Exploits
According to release announcement on Pastebin by unknown developers in a Russian-language BlackHole Exploit Kit 2.0 released with more latest Exploits. BlackHole is one of the most dominant exploit toolkits currently available in the underground market. It enables attackers to exploit security...
Early Windows 8 Users to Remain Vulnerable to Flash Exploits Until October
While Windows 8 won’t officially be released until Oct. 26, according to reports over the weekend, the operating system already has a handful of Flash holes that could open the system up to exploits by attackers. The problem stems from the system’s browser, Internet Explorer 10, that’s coming wit...
Mandrake Linux Security Advisory : tmpwatch (MDKSA-2000:056)
Previous versions of tmpwatch contained a local denial of service and root exploits. This is due to using the fork command to recursively process subdirectories which would allow a local user to perform a denial of service attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...
Mandrake Linux Security Advisory : glibc (MDKSA-2000:045-1)
A bug was discovered in ld.so that could allow local users to obtain root privileges. The dynamic loader, ld.so, is responsible for making shared libraries available within a program at run-time. Normally, a user is allowed to load additional shared libraries when executing a program; they can be...