TestLink Open Source Test Management < 1.9.16 - Remote Code Execution Vulnerability

Exploit for php platform in category remote exploits Title: TestLink Open Source Test Management comment out skip-networking as well as bind-addre...

Weblication CMS Core & Grid v12.6.24 - XSS Vulnerabilities

Document Title: =============== Weblication CMS Core & Grid v12.6.24 - XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2121 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13002 CVE-ID: ======= CVE-2018-13002 Release Date:...

Flight Sim Lab installed Chrome passwords stealer in piracy check tool

By Waqas Flight Simulator Lab is caught secretly installing a software which This is a post from HackRead.com Read the original post: Flight Sim Lab installed Chrome passwords stealer in piracy check tool...

AEF CMS v1.0.9 - (PM) Persistent Cross Site Vulnerability

Document Title: =============== AEF CMS v1.0.9 - PM Persistent Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2123 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13000 CVE-ID: ======= CVE-2018-13000 Release Date:...

Unicode Technique Used to Deliver Cryptomining Malware Through Telegram

Attackers are using the time-tested right-to-left override technique to deliver cryptomining malware through the popular Telegram messaging application, say researchers. The right-to-left RLO technique uses Unicode to hide malicious file names and trick users into executing what appear to be beni...

LogicalDOC Enterprise 7.7.4 Multiple Directory Traversal Vulnerabilities

Summary LogicalDOC is a free document management system that is designed to handle and share documents within an organization. LogicalDOC is a content repository, with Lucene indexing, Activiti workflow, and a set of automatic import procedures. Description The application suffers from multiple...

LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness

Summary LogicalDOC is a free document management system that is designed to handle and share documents within an organization. LogicalDOC is a content repository, with Lucene indexing, Activiti workflow, and a set of automatic import procedures. Description The weakness is caused due to the...

LogicalDOC Enterprise 7.7.4 Reflected Cross-Site Scripting Vulnerabilities

Summary LogicalDOC is a free document management system that is designed to handle and share documents within an organization. LogicalDOC is a content repository, with Lucene indexing, Activiti workflow, and a set of automatic import procedures. Description LogicalDOC suffers from multiple...

[slackware-security] Slackware 14.2 kernel

New kernel packages are available for Slackware 14.2 to mitigate the speculative side channel attack known as Spectre variant 2. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/linux-4.4.115/: Upgraded. This kernel includes full retpoline mitigation for the Spectre varian...

Kaspersky Secure Mail Gateway Cross-Site Scripting Vulnerability

Kaspersky Secure Mail Gateway is an email security solution from Russia's Kaspersky Lab. The program is able to automatically filter spam, phishing sites and various malicious attachments. A cross-site scripting vulnerability exists in Kaspersky Secure Mail Gateway version 1.1. A remote attacker...

Banknotes Misproduction security & biometric weakness

Document Title: =============== Banknotes Misproduction security & biometric weakness References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2106 Video: https://www.youtube.com/watch?v=ORbU8fyhkgY Advisory: https://www.vulnerability-lab.com/getcontent.php?id=2105 Vulnerabilit...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-thunderbird-52.6.0-i586-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...

Potent Skygofree Malware Packs ‘Never-Before-Seen’ Features

Researchers have identified a powerful new Android malware strain called Skygofree capable of eavesdropping on WhatsApp messages, siphoning private data off phones and allowing adversaries to open reverse shell modules on targeted devices, giving attackers ultimate remote control. Researchers sai...

metasploit-framework

This is an exploit module for the Metasploit Framework, a penetration testing tool. The module is designed to exploit a vulnerability in a specific target, but the target is not specified in the provided code. The module is written in Ruby and uses the Metasploit framework to interact with the...

Wickr Inc - App Clock & Message Deletion Glitch P2

Document Title: =============== Wickr Inc - App Clock & Message Deletion Glitch P2 References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2107 Document: https://www.vulnerability-lab.com/resources/documents/2107.rar Vulnerability Magazine:...

Wickr Inc Bug Bounty Program - Zero Day Vulnerabilities

Document Title: =============== Wickr Inc Bug Bounty Program - Zero Day Vulnerabilities References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2055 Playlist: https://www.youtube.com/playlist?list=PL2hnNNM3yw-3svLm9UdSzvlVVZcx5DxV Videos:...

KLA11168 Multiple vulnerabilities in Microsoft SQL Server

Multiple information disclosure vulnerabilities have been found in Microsoft SQL Server. Malicious user can exploit these vulnerabilities to obtain sensitive information. These vulnerabilities can be exploited remotelly via speculative execution side-channel attack to obtain sensetive information...

Icyphoenix 2.2.0.105 - Multiple SQL Injection Vulnerabilities

Document Title: =============== Icyphoenix 2.2.0.105 - Multiple SQL Injection Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2006 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5697 CVE-ID: ======= CVE-2018-5697 Release Date:...

Telesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution

Summary We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G LTE wireless communication based LTE router product. Description The router suffers from authenticated arbitrary system command execution. The application interface allows users to perform certain actions via HTTP requests without...

Telesquare SKT LTE Router SDT-CS3B1 WebDAV HTTP Methods Arbitrary File Events

Summary We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G LTE wireless communication based LTE router product. Description WebDAV is enabled with directory listing and dangerous HTTP methods allowed: PROPFIND, DELETE, MKCOL, PUT, MOVE, COPY, PROPPATCH, LOCK and UNLOCK. The HTTP PUT metho...