Snowfox CMS v1.0 CSRF Add Admin Exploit

Summary Snowfox is an open source Content Management System CMS that allows your website users to create and share content based on permission configurations. Description Snowfox CMS suffers from a cross-site request forgery vulnerabilities. The application allows users to perform certain actions...

Joomla Eventbooking Cross Site Scripting

Exploit Title : Joomla comeventbooking component XSS vulnerability Author : Jagriti Sahu AKA incredible Download Link : https://github.com/Jasonudoo/platform/tree/master/components/comeventbooking Date : 13/11/2014 Discovered at : IndiShell Lab Love to : Surbhi, Mrudula and Harry Discovered At :...

Croogo 2.0.0 - Arbitrary PHP Code Execution Exploit

No description provided by source. !/usr/bin/env python Croogo 2.0.0 Arbitrary PHP Code Execution Exploit Vendor: Fahad Ibnay Heylaal Product web page: http://www.croogo.org Affected version: 2.0.0 Summary: Croogo is a free, open source, content management system for PHP, released under The MIT...

CorelDRAW X7 CDR File (CdrTxt.dll) Off-By-One Stack Corruption Vulnerability

Summary CorelDRAW is one of the image-creating programs in a suite of graphic arts software used by professional artists, educators, students, businesses and the general public. The CorelDRAW Graphics Suite X7, which includes CorelDRAW, is sold as stand-alone software and as a cloud-based...

PayPal Inc - Filter Bypass & Profile Code Execution

Document Title: =============== PayPal Inc - Filter Bypass & Profile Code Execution References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1275 Video: https://www.youtube.com/watch?v=LUksqtG2WrE Release Date: ============= 2014-11-05 Vulnerability Laboratory ID VL-ID:...

PayPal Inc - Filter Bypass & Profile Code Execution

Document Title: =============== PayPal Inc - Filter Bypass & Profile Code Execution References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1275 Video: https://www.youtube.com/watch?v=LUksqtG2WrE Release Date: ============= 2014-11-05 Vulnerability Laboratory ID VL-ID:...

[slackware-security] mariadb

New mariadb packages are available for Slackware 14.1 and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mariadb-5.5.40-i486-1slack14.1.txz: Upgraded. This update contains security fixes and improvements. For more information, see:...

Russian APT28 Group Linked to NATO, Political Attacks

A Russian APT group tied to ongoing attacks against military and political targets in Eastern Europe and against NATO could also have ties to the MiniDuke espionage campaign uncovered more than a year ago. Dubbed APT28 by FireEye in a report published last night, the Russian hackers have targeted...

Koler Malware Propagating Through SMS

A new iteration of the Android ransomware Koler has surfaced that’s trying to trick its victims into downloading the malware by propagating through SMS messages. Android users receive SMS messages containing shortened bit.ly URLs that ultimately lead to the malicious .APK. Once opened, the packag...

PayPal Inc BB #107 MOS - Persistent History Vulnerability

Document Title: =============== PayPal Inc BB 107 MOS - Persistent History Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1048 PayPal Security UID: dq115aYq Release Date: ============= 2014-10-27 Vulnerability Laboratory ID VL-ID:...

PayPal Inc BB #107 MOS - Persistent History Vulnerability

Document Title: =============== PayPal Inc BB 107 MOS - Persistent History Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1048 PayPal Security UID: dq115aYq Release Date: ============= 2014-10-27 Vulnerability Laboratory ID VL-ID:...

Sandworm（CVE-2 0 1 4-4 1 1 4 new variants discovered for Taiwan's APT attacks-a vulnerability warning-the black bar safety net

! Xecure lab on 1 0 On 1 7, found variant of the 0day vulnerabilities worms（CVE-2 0 1 4-4 1 1 4 have been used in the for the Government of Taiwan and various units of APT attacks, the current mainstream anti-virus software also can't effectively detected. The variant can be directly embedded...

Google Youtube - Filter Bypass & Persistent Vulnerability

Document Title: =============== Google Youtube - Filter Bypass & Persistent Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1352 Google Security ID: 9-5942000004564 View: https://www.youtube.com/watch?v=656LM9zGLxc Article:...

SSL v3 Poodle security vulnerability fix recommendations-vulnerability warning-the black bar safety net

! The use of SSL to protect your website traffic far more than is on the server install an SSL certificate. Era in constant development,with the browser of aging, password strength reduction as well as attackers become more creative, the situation has undergone subtle changes. For early...

Arbitrary File Upload in HelpDEZk

High-Tech Bridge Security Research Lab discovered vulnerability in HelpDEZk, which can be exploited to compromise vulnerable web site. 1 Unrestricted Upload of File with Dangerous Type in HelpDEZk: CVE-2014-8337 The vulnerability exists due to absence of validation of file extensions when uploadi...

Sandworm APT Team Found Using Windows Zero Day Vulnerability

UPDATE–A cyberespionage team, possibly based in Russia, has been using a Windows zero day vulnerability to target a variety of organizations in several countries, including the United States, Poland, Ukraine and western Europe. The vulnerability, which will be patched today by Microsoft, is...

Croogo 2.0.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities

Croogo 2.0.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities ------------------------ XSS 1 -------- POST parameters: - dataContacttitle ------------------------ input type="hidden" name="dataTokenkey" value="...

Croogo 2.0.0 - Arbitrary PHP Code Execution

Croogo 2.0.0 - Arbitrary PHP Code Execution !/usr/bin/env python Croogo 2.0.0 Arbitrary PHP Code Execution Exploit Vendor: Fahad Ibnay Heylaal Product web page: http://www.croogo.org Affected version: 2.0.0 Summary: Croogo is a free, open source, content management system for PHP, released under...

Croogo 2.0.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities

------------------------ XSS 1 -------- POST parameters: - dataContacttitle ------------------------ input type="hidden"...

Croogo 2.0.0 Arbitrary PHP Code Execution

!/usr/bin/env python Croogo 2.0.0 Arbitrary PHP Code Execution Exploit Vendor: Fahad Ibnay Heylaal Product web page: http://www.croogo.org Affected version: 2.0.0 Summary: Croogo is a free, open source, content management system for PHP, released under The MIT License. It is powered by CakePHP MV...