iScan Online Mobile 2.0.1 iOS - Command Inject Vulnerability

Document Title: =============== iScan Online Mobile 2.0.1 iOS - Command Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1271 Release Date: ============= 2014-06-02 Vulnerability Laboratory ID VL-ID: ==================================...

PayPal GoToMaxx PDFMailer - Local Overflow Vulnerability

Document Title: =============== PayPal GoToMaxx PDFMailer - Local Overflow Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1274 http://www.vulnerability-lab.com/getcontent.php?id=940 Video: https://www.youtube.com/watch?v=IXhwfZV6x0M Release Date:...

PayPal GoToMaxx PDFMailer - Local Overflow Vulnerability

Document Title: =============== PayPal GoToMaxx PDFMailer - Local Overflow Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1274 http://www.vulnerability-lab.com/getcontent.php?id=940 Video: https://www.youtube.com/watch?v=IXhwfZV6x0M Release Date:...

WebTitan 4.01 (Build 68) - Multiple Vulnerabilities

WebTitan 4.01 Build 68 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: WebTitan vulnerable version: 4.01 Build 68 fixed version: 4.04 impact: critic...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.1 to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mozilla-firefox-24.6.0esr-i486-1slack14.1.txz: Upgraded. This release contains security fixes and improvements. For more information, see:...

Vulnerability in OpenSSL - DTLS recursion flaw

By sending an invalid DTLS handshake to an OpenSSL DTLS client the code can be made to recurse eventually crashing in a DoS attack. Only applications using OpenSSL as a DTLS client are affected. Found by Imre Rad Search-Lab Ltd...

FBI, European Authorities Go After GameOver Zeus Botnet

UPDATE–Law enforcement agencies in Europe and the United States, including Europol and the FBI, ran a coordinated takedown of the GameOver Zeus botnet on Friday, seizing servers and disrupting the botnet’s operation. Authorities say that the same botnet has been used to distribute the CryptoLocke...

Adobe to Patch Vulnerable Flash Player in Shockwave

It’s bad enough that the Flash runtime bundled with Adobe’s Shockwave player is deficient in security patches going back to January 2013, but what’s worse is that the increased attack surface provided by Shockwave might make it easier to exploit. And, in the bargain, Adobe has known about the iss...

Blackshades RAT Takedown Leads to 90 Arrests

More than 90 arrests have been made in connection with development and sales of a remote access Trojan used worldwide to steal data and spy on victims, including Syrian dissidents. The FBI and the Manhattan U.S. Attorney’s office yesterday announced the takedown of the Blackshades operation...

Clipperz Password Manager Code Execution

Exploit Title : Clipperz Password Manager remote code execution vulnerability Author : Manish Kishan Tanwar Vendor : https://clipperz.is/opensource/clipperzpasswordmanager/ Download Link : https://codeload.github.com/clipperz/password-manager/zip/master Date : 19/05/2014 Discovered @ : INDISHELL...

PayPal Filter Bypass

Document Title: =============== Paypal Inc Bug Bounty 109 MOS - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1050 PayPal Security UID: Pq115cey Release Date: ============= 2014-05-14 Vulnerability Laboratory ID VL-ID:...

[slackware-security] seamonkey

New seamonkey packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/seamonkey-2.26-i486-1slack14.1.txz: Upgraded. This update contains security fixes and improvements. For more information, se...

Paypal BBP #109 MOS - Bypass & Persistent Vulnerability

Document Title: =============== Paypal BBP 109 MOS - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1050 PayPal Security UID: Pq115cey Video: http://www.vulnerability-lab.com/getcontent.php?id=1273 Video Demonstration:...

WordPress Formidable Forms Remote Code Execution

Exploit Title : wordpress plugin "Formidable Forms" Remote code execution exploit Exploit Author : Manish Kishan Tanwar vendor Link : http://wordpress.org/plugins/formidable/ Version Affected: below verson 1.06.03only pro version Discovered At : IndiShell LAB indishell.in aka indian cyber army Lo...

WSS Lab 项目管理软件某处XSS

简要描述： WSS Lab 项目管理软件某处XSS 详细说明： 我们在写自己的项目管理软件的时候，参照了WSS Lab的在线系统，从开发角度上确实是写的好，功能很强大，界面也好看。在我写完我们的项目开始测试的时候，发现该系统也有同样的问题，如在编辑项目时项目名直接加入弹窗代码 该弹窗效果影响整个页面，包括首页，也是反复弹 由于在线演示的系统为1.3.2的正式版，所以还是上传上来了 漏洞证明：...

Offiria 2.1.0 Cross Site Scripting

Advisory ID: HTB23210 Product: Offiria Vendor: Slashes & Dots Sdn Bhd. Vulnerable Versions: 2.1.0 and probably prior Tested Version: 2.1.0 Advisory Publication: April 2, 2014 without technical details Vendor Notification: April 2, 2014 Public Disclosure: May 7, 2014 Vulnerability Type: Cross-Site...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.1 and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mozilla-firefox-24.5.0esr-i486-1slack14.1.txz: Upgraded. This release contains security fixes and improvements. For more...

Google Removes Bitcoin Mining Android Malware from Play

Google recently removed five bogus wallpaper apps from its Play marketplace after they were deemed malicious and found sneakily mining Bitcoins. The malware, dubbed BadLepricon, was spotted funneling Bitcoin into wallets and allowed the attacker to change mining pools easily to maximize the minin...

Flash Zero Day Used to Target Victims in Syria

A couple days after Microsoft warned users about a new vulnerability in Internet Explorer that’s being used in targeted attacks, Adobe on Monday said that researchers have discovered a zero day in Flash, as well, which attackers are using to target victims in Syria through a watering hole attack ...

Adobe warning Flash high-risk vulnerabilities: Mac and PC fast upgrade-vulnerability warning-the black bar safety net

Adobe on Tuesday for the Flash plug-in released a security update that solves allow an attacker to remotely control a user's computer vulnerabilities. According to Adobe, as long as the running version for 1 2. 0. 0. 4 3 or earlier versions of Flash Mac and a Windows machine can be vulnerable to...