XSS and CS vulnerabilities in Dotclear

Hello 3APA3A! These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. CMS Dotclear has three vulnerable flash-files: swfupload.swf, playerflv.swf and playermp3.swf. File swfupload.swf it's Swfupload. I've wrote about vulnerabilities in Swfupload in November 2012...

ZeroClipboard XSS vulnerabilities

Exploit for php platform in category web applications These are Cross-Site Scripting vulnerabilities in ZeroClipboard. Last week I've made my research of these vulnerabilities and informed all developers previous and current of ZeroClipboard. When I've downloaded ZeroClipboard in September 2011,...

ZeroClipboard 1.0.7 Cross Site Scripting

Hello list! These are Cross-Site Scripting vulnerabilities in ZeroClipboard. Last week I've made my research of these vulnerabilities and informed all developers previous and current of ZeroClipboard. When I've downloaded ZeroClipboard in September 2011, when I was writing my article Attacks via...

XSS vulnerability in swfupload in WordPress

Hello 3APA3A! I will draw your attention to XSS vulnerability in swfupload in WordPress. In April there was announced Cross-Site Scripting vulnerability in swfupload.swf in WordPress CVE-2012-3414. It was fixed in WordPress 3.3.2. At that time there was no detailed information about it. Last week...

Exploit Released for Internet Explorer zero-day attacks : CVE-2012-4969

Microsoft has confirmed reports that a zero-day vulnerability in its Internet Explorer browser is being actively attacked in the wild. Four active exploits of a zero-day vulnerability in the browser exists. Microsoft will push out an out-of-cycle Windows patch to temporarily fix the critical...

MSXML Exploit Surfaces in Black Hole Kit

Attackers really like exploit kits because they offer users the ease of point-and-click exploitation, lots of potential targets and don’t require a huge amount of technical knowledge to use. Attackers also enjoy Microsoft vulnerabilities, especially unpatched ones, because of the massive installe...

Attackers Targeting MSXML Flaw With Malicious Flash Files

The unpatched vulnerability in Internet Explorer’s MSXML component that Microsoft warned users about earlier this month is being used in attacks that employ malicious Flash files. Researchers say that the attacks are taking the form of drive-by downloads launched from compromised legitimate sites...

Vulnerabilities in plugins for MODx CMS, XOOPS, uCoz, Magento and DSP CMS

Hello 3APA3A! Besides tens millions of vulnerable web sites with affected flash files and vulnerable multiple plugins for different engines, which I've wrote about earlier, there are a lot of other vulnerable plugins. Here are new ones some of them are vulnerable to two XSS holes. There are...

SuSE 10 Security Update : flash-player (ZYPP Patch Number 7477)

Specially crafted Flash files could be exploited to execute arbitrary code. CVE-2011-0611 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid57189;...

flash-plugin: multiple arbitrary code execution flaws (APSB-11-21)

Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via...

Vulnerability in multiple themes for Drupal

Hello list! The endless saga continue. After informing about a lot of vulnerable plugins and widgets with this swf-file, here is information about multiple vulnerable themes ;-. I want to warn you about Cross-Site Scripting vulnerability in multiple themes for Drupal. And a lot of other themes fo...

WP-Cumulus Variants Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting vulnerability in multiple plugins for different engines it's combinations of my two publications which I've made last week at my site. In plugins for RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion,...

SuSE Update for flash-player SUSE-SA:2011:018

Check for the Version of flash-player OpenVAS Vulnerability Test SuSE Update for flash-player SUSE-SA:2011:018 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

sfWpCumulusPlugin For Symphony Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting vulnerability in plugin sfWpCumulusPlugin for symfony. ------------------------- Affected products: ------------------------- Vulnerable are all versions of sfWpCumulusPlugin. ---------- Details: ---------- This XSS is similar to XSS...

B-Cumulus Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting vulnerability in b-cumulus. It's widget for Blogger, which is also using at separate sites. SecurityVulns ID: 11353. ------------------------- Affected products: ------------------------- Vulnerable are all versions of b-cumulus. ---------...

Stuxnet Media Storm Now Feeding SEO Attacks?

How do you know when a computer virus has officially jumped the fence to become a media sensation? Probably when scammers start using popular interest in it as bait for their own malware. So it is with the Stuxnet worm, which was identified in July, but has become the focus of intense media...

Joomla 3D User Cloud Cross Site Scripting

Hello Bugtraq! I want to warn you about security vulnerability in module 3D user cloud for Joomla. ----------------------------- Advisory: Vulnerability in 3D user cloud for Joomla ----------------------------- URL: http://websecurity.com.ua/4198/ ----------------------------- Affected product: a...

Cumulus Widget For BlogEngine.NET Cross Site Scripting

Hello Full-Disclosure! I want to warn you about security vulnerability in widget Cumulus for BlogEngine.NET. ----------------------------- Advisory: Vulnerability in widget Cumulus for BlogEngine.NET ----------------------------- URL: http://websecurity.com.ua/4184/ -----------------------------...

Joomla 3D Cloud Cross Site Scripting

Hello Bugtraq! I want to warn you about Cross-Site Scripting vulnerability in 3D Cloud mod3dcloud plugin for Joomla. Which I found and disclosed at 22.01.2010. It is similar to XSS vulnerability in JVClouds3D for Joomla http://websecurity.com.ua/3839/. About millions of flash files tagcloud.swf...

Cross-Site Scripting vulnerability in Blogumus

Hello 3APA3A! I want to warn you about Cross-Site Scripting vulnerability in Blogumus for Blogger It is similar to XSS vulnerability in WP-Cumulus http://websecurity.com.ua/3665/, because it's using tagcloud.swf made by author of WP-Cumulus. About millions of flash files tagcloud.swf which are...