Counter.php Redirecting to Sites Peddling Styx Exploit Kit

The Counter.php strain of malware has been spotted in the past redirecting users to a handful of malicious sites and now appears to be leveraging that ability to send victims to websites serving up the Styx exploit kit. According to a post on Securelist today, Vincente Diaz, a researcher with...

Gnew v2013.1 Multiple XSS And SQL Injection Vulnerabilities

Summary Gnew is a simple Content Management System written with PHP language and using a database server MySQL, PostgreSQL or SQLite for storage. Description Input passed via several parameters is not properly sanitised before being returned to the user or used in SQL queries. This can be exploit...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 13.37, 14.0, and -current to fix security issues. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/mozilla-firefox-17.0.8esr-i486-1slack14.0.txz: Upgraded. This release contains security fixes and improvements. For...

MyBB 1.6.10 'url' Parameter Arbitrary Site Redirection Vulnerability

Summary MyBB, also known as MyBBoard or MyBulletinBoard, is a powerful, efficient, and free forum package, developed using PHP and MySQL. Description Input passed via the 'url' parameter in 'member.php' script is not properly verified before being used to redirect users. This can be exploited to...

Atlassian JIRA v6.0.3 Arbitrary HTML/Script Execution Vulnerability

Summary JIRA is an issue tracking project management software for teams planning, building, and launching great products. Description JIRA suffers from a reflected XSS issue due to a failure to properly sanitize user-supplied input to the 'name' GET parameter in the 'deleteuserconfirm.jsp' script...

PuTTY SSH handshake heap overflow

PuTTY SSH handshake heap overflow CVE-2013-4852 Description: PuTTY versions 0.62 and earlier - as well as all software that integrates these versions of PuTTY - are vulnerable to an integer overflow leading to heap overflow during the SSH handshake before authentication, caused by improper bounds...

Microsoft Yammer SN - oAuth Bypass Token Vulnerability

Document Title: =============== Microsoft Yammer SN - oAuth Bypass Token Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1043 View: http://www.youtube.com/watch?v=SwxWNvmOsU4 Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1003 Microsoft...

Facebook Bug Bounty - Canvas & Web URL Filter Bypass

Document Title: =============== Facebook Bug Bounty - Canvas & Web URL Filter Bypass References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1036 View: http://www.youtube.com/watch?v=Pw24BsLHYk Release Date: ============= 2013-07-28 Vulnerability Laboratory ID VL-ID:...

Windu CMS 2.2 Multiple Persistent Cross-Site Scripting Vulnerabilities

Summary Windu CMS is a simple, lightweight and fun-to-use website content management software. Description Multiple stored XSS vulnerabilities exist when parsing user input to the 'name' and 'username' POST parameters. Attackers can exploit these weaknesses to execute arbitrary HTML and script co...

ePhoto Transfer 1.2.1 iOS - Multiple Vulnerabilities

ePhoto Transfer 1.2.1 iOS - Multiple Vulnerabilities Title: ====== ePhoto Transfer v1.2.1 iOS - Multiple Web Vulnerabilities Date: ===== 2013-07-17 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1017 VL-ID: ===== 1017 Common Vulnerability Scoring System:...

Multiple Vulnerabilities in BigTree CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in BigTree CMS, which can be exploited to perform SQL injection, Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF attacks. A remote attacker can add, modify or delete information in application's database and...

Dell Kace 1000 SMA 5.4.70402 - Persistent Cross-Site Scripting

Title: ====== Dell Kace 1000 SMA v5.4.70402 - Persistent Vulnerabilities Date: ===== 2013-07-16 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=833 VL-ID: ===== 833 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...

Operation Troy espionage campaign : Hackers steal South Korean military secrets

McAfee Lab researchers issued a report on the large scale cyber attacks against South Korea that appear to be linked to hackers also specialized in cyber espionage. The attackers behind these recent attacks against South Korean infrastructure are skilled professionals and they designed a...

Facebook Bug Bounty #8 - Multiple Vulnerabilities

Document Title: =============== Facebook Bug Bounty 8 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=993 Release Date: ============= 2013-07-06 Vulnerability Laboratory ID VL-ID: ==================================== 993 Common...

Kasseler CMS 2 r1223 - Multiple Vulnerabilities

Kasseler CMS 2 r1223 - Multiple Vulnerabilities Advisory ID: HTB23158 Product: Kasseler CMS Vendor: Kasseler CMS Vulnerable Versions: 2 r1223 and probably prior Tested Version: 2 r1223 Vendor Notification: May 29, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type...

Kasseler CMS 2 r1223 CSRF / XSS / SQL Injection Vulnerabilities

Kasseler CMS version 2 r1223 suffers from cross site request forgery, cross site scripting, and remote SQL injection vulnerabilities. Vendor: Kasseler CMS Vulnerable Versions: 2 r1223 and probably prior Tested Version: 2 r1223 Vendor Notification: May 29, 2013 Vendor Patch: June 28, 2013 Public...

Kasseler CMS 2 r1223 CSRF / XSS / SQL Injection

Advisory ID: HTB23158 Product: Kasseler CMS Vendor: Kasseler CMS Vulnerable Versions: 2 r1223 and probably prior Tested Version: 2 r1223 Vendor Notification: May 29, 2013 Vendor Patch: June 28, 2013 Public Disclosure: July 3, 2013 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting...

MSN Hotmail - Password Reset (Session) Web Vulnerability

Document Title: =============== MSN Hotmail - Password Reset Session Web Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=994 Video: https://www.youtube.com/watch?v=INq6CirLgt0 Release Date: ============= 2013-06-29 Vulnerability Laboratory ID VL-ID:...

MSN Hotmail - Password Reset (Session) Web Vulnerability

Document Title: =============== MSN Hotmail - Password Reset Session Web Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=994 Video: https://www.youtube.com/watch?v=INq6CirLgt0 Release Date: ============= 2013-06-29 Vulnerability Laboratory ID VL-ID:...

AVAST Internet Security Suite - Persistent Vulnerabilities

Document Title: =============== AVAST Internet Security Suite - Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=969 Release Date: ============= 2013-06-26 Vulnerability Laboratory ID VL-ID: ====================================...