CVE-2014-7954 MTP path traversal vulnerability in Android

MTP path traversal vulnerability in Android 4.4 ----------------------------------------------- doSendObjectInfo method of the MtpServer class implemented in frameworks/av/media/mtp/MtpServer.cpp does not validate the name parameter of the incoming MTP packet at all. It is possible to upload file...

ADB Backup Traversal / File Overwrite

ADB backup archive path traversal file overwrite ------------------------------------------------ Using adb one can create a backup of his/her Android device and store it on the PC. The backup archive is based on the tar file format. By modifying tar headers to contain ../../ like patterns it is...

CVE-2014-7951 adb backup archive path traversal file overwrite

ADB backup archive path traversal file overwrite ------------------------------------------------ Using adb one can create a backup of his/her Android device and store it on the PC. The backup archive is based on the tar file format. By modifying tar headers to contain ../../ like patterns it is...

PayPal Inc - (Merchant Search) CS Cross Site Vulnerability

Document Title: =============== PayPal Inc - Merchant Search CS Cross Site Vulnerability References: =========== Video: http://www.vulnerability-lab.com/getcontent.php?id=1454 View: https://www.youtube.com/watch?v=v5egy9VBs0 Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1453...

PayPal Inc - (Merchant Search) CS Cross Site Vulnerability

Document Title: =============== PayPal Inc - Merchant Search CS Cross Site Vulnerability References: =========== Video: http://www.vulnerability-lab.com/getcontent.php?id=1454 View: https://www.youtube.com/watch?v=v5egy9VBs0 Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1453...

Oracle - Outside-In .DOCX File Parsing Memory Corruption

Oracle - Outside-In .DOCX File Parsing Memory Corruption Title: Oracle Outside-In DOCX File Parsing Memory Corruption Platforms: Windows CVE: Secunia: PRL: 2015-04 Author: Francis Provencher Protek Research Lab’s Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2...

Oracle - Outside-In '.DOCX' File Parsing Memory Corruption

Title: Oracle Outside-In DOCX File Parsing Memory Corruption Platforms: Windows CVE: Secunia: PRL: 2015-04 Author: Francis Provencher Protek Research Lab’s Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2 Report Timeline 3 Technical details 4 POC ==============...

WordPress MiwoFTP Plugin 1.0.5 CSRF Arbitrary File Deletion Exploit

Summary MiwoFTP is a smart, fast and lightweight file manager plugin that operates from the back-end of WordPress. Description Input passed to the 'selitems' parameter is not properly sanitised before being used to delete files. This can be exploited to delete files with the permissions of the we...

Coordinated Takedown Puts End to Simda Botnet

The Simda botnet, known for spreading banking malware and dropping a backdoor on hundreds of thousands of machines worldwide, was taken down last Thursday in a collaborative effort between international law enforcement bodies and private security and technology companies. Fourteen command and...

Balero CMS v0.7.2 Multiple Blind SQL Injection Vulnerabilities

Summary Balero CMS is an open source project that can help you manage the page of your company with just a few guided steps, minimizing the costs that many companies make to have your advertising medium and/or portal. Description The application suffers from multiple blind SQL injection...

Balero CMS v0.7.2 Multiple JS/HTML Injection Vulnerabilities

Summary Balero CMS is an open source project that can help you manage the page of your company with just a few guided steps, minimizing the costs that many companies make to have your advertising medium and/or portal. Description Input passed to the 'content' POST parameter and the cookie 'counte...

Joomla Spider Random Article Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Joomla Spider Random Article Component SQL Injection vulnerability Author : Jagriti Sahu AKA Incredible Vendor Link : http://demo.web-dorado.com/spider-random-article.html Date : 22/03/2015 Discovered at : IndiShell Lab Love to...

WordPress Plugin Business Intelligence - SQL Injection (Metasploit)

Exploit Title : Wordpress Plugin 'Business Intelligence' Remote SQL Injection vulnerability Author : Jagriti Sahu AKA Incredible Vendor Link : https://www.wpbusinessintelligence.com Download Link : https://downloads.wordpress.org/plugin/wp-business-intelligence-lite.1.6.1.zip Date : 1/04/2015...

WordPress Business Intelligence Lite 1.6.1 SQL Injection

Exploit Title : Wordpress Plugin 'Business Intelligence' Remote SQL Injection vulnerability Author : Jagriti Sahu AKA Incredible Vendor Link : https://www.wpbusinessintelligence.com Download Link : https://downloads.wordpress.org/plugin/wp-business-intelligence-lite.1.6.1.zip Date : 1/04/2015...

Vulnerability: CVE-2 0 1 5-0 9 3 2-vulnerability warning-the black bar safety net

ANTLabs is a very popular gateway device. It is usually installed in hotels, conference centres and other places for guests to provide WIFI service. It is usually tied in a room for billing purposes. If you are in a hotel Use it, then you should be especially familiar with such devices...

Joomla Spider FAQ Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Joomla Spider FAQ component SQL Injection vulnerability Author : Manish Kishan Tanwar AKA error1046 Vendor Link : http://demo.web-dorado.com/spider-faq.html Date : 21/03/2015 Discovered at : IndiShell Lab Love to : zero cool,Te...

pfSense 2.2 - Multiple Vulnerabilities

Advisory ID: HTB23251 Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5, 2015 Public Disclosure: March 25, 2015...

Joomla Spider Random Article SQL Injection

Exploit Title : Joomla Spider Random Article Component SQL Injection vulnerability Author : Jagriti Sahu AKA Incredible Vendor Link : http://demo.web-dorado.com/spider-random-article.html Date : 22/03/2015 Discovered at : IndiShell Lab Love to : error1046 ^^ ,Team IndiShell,Codebreaker ICA...

Joomla Random Article SQL Injection

Exploit Title : Joomla Random Article Component SQL Injection vulnerability Author : Jagriti Sahu AKA Incredible Vendor Link : http://demo.web-dorado.com Date : 23/03/2015 Discovered at : IndiShell Lab Love to : error1046 ^^ ,Team IndiShell,Codebreaker ICA ,Subhi,Mrudu,Hary,Kavi ^^...

Joomla Spider FAQ SQL Injection

Exploit Title : Joomla Spider FAQ component SQL Injection vulnerability Author : Manish Kishan Tanwar AKA error1046 Vendor Link : http://demo.web-dorado.com/spider-faq.html Date : 21/03/2015 Discovered at : IndiShell Lab Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Incredible,Kisha...