GLPI 0.83.7 Parameter Traversal Arbitrary File Access Vulnerability

GLPI version 0.83.7 suffers from a parameter traversal vulnerability that allows for arbitrary file access. GLPI v0.83.7 itemtype Parameter Traversal Arbitrary File Access Exploit Vendor: INDEPNET Development Team Product web page: http://www.glpi-project.org Affected version: 0.83.7 Summary: GLP...

GLPI 0.83.7 Parameter Traversal Arbitrary File Access

GLPI v0.83.7 itemtype Parameter Traversal Arbitrary File Access Exploit Vendor: INDEPNET Development Team Product web page: http://www.glpi-project.org Affected version: 0.83.7 Summary: GLPI, an initialism for Gestionnaire libre de parc informatique Free Management of Computer Equipment, was...

Multiple XSS Vulnerabilities in Jahia xCM

High-Tech Bridge Security Research Lab discovered multiple XSS vulnerabilities in Jahia xCM, which can be exploited to perform cross-site scripting attacks against administrator of vulnerable application. 1 Multiple Cross-Site Scripting XSS Vulnerabilites in Jahia xCM: CVE-2013-4624 1.1 The...

Surveillance malware targets 350 high profile victims in 40 countries

A global cyber espionage campaign affecting over 350 high profile victims in 40 countries, appears to be the work of Chinese hackers using a Surveillance malware called "NetTraveler". Kaspersky Lab’s team of experts published a new research report about NetTraveler, which is a family of malicious...

Paypal Bug Bounty #12 - PPM Listing Vulnerability

Document Title: =============== Paypal Bug Bounty 12 - PPM Listing Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=649 Release Date: ============= 2013-05-30 Vulnerability Laboratory ID VL-ID: ==================================== 649 Common...

Barracuda SSL VPN 680 2.2.2.203 Open Redirect

Title: ====== Barracuda SSL VPN 680 2.2.2.203 - Redirect Web Vulnerability Date: ===== 2013-05-25 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=755 Barracuda Networks Security ID BNSEC: 731 VL-ID: ===== 755 Common Vulnerability Scoring System:...

Filter Evasion and Bypass Methods - Pentest Magazine

Document Title: =============== Filter Evasion and Bypass Methods - Pentest Magazine References: =========== Download: http://www.vulnerability-lab.com/resources/documents/798.pdf Magazine: http://pentestmag.com/pentest-regular-0113/ Release Date: ============= 2013-05-28 Vulnerability Laboratory...

mozilla-thunderbird x86_64 packages

New mozilla-thunderbird packages are available for Slackware64 13.37 and 14.0. These were accidentally omitted from the last upload. Here are the details from the Slackware64 14.0 ChangeLog: patches/packages/mozilla-thunderbird-17.0.6-x8664-1slack14.0.txz: Upgraded. Here's the package that was...

Wordpress Newsletter Plugin 3.2.6 (alert) Reflected XSS Vulnerability

Summary Newsletter is the perfect WordPress plugin for creating real newsletters and mail marketing system on your WordPress blog. Description The plugin suffers from a XSS issue due to a failure to properly sanitize user-supplied input to the 'alert' GET parameter in the 'page.php' script...

PayPal Ecommerce Script Insertion

Title: ====== Paypal BugBounty 13 - Mail Encoding Web Vulnerability Date: ===== 2013-05-12 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=650 VL-ID: ===== 650 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: ============= PayP...

Wordpress Securimage-WP Plugin v3.2.4 URI-based XSS Vulnerability

Summary Securimage-WP adds powerful CAPTCHA protection to comment forms on posts and pages to help prevent comment spam from getting onto your site. Description Securimage-WP suffers from a XSS issue in 'siwptest.php' that uses the 'PHPSELF' variable. The vulnerability is present because there...

Securimage 3.5 URI-based Cross-Site Scripting Vulnerability

Summary Securimage is an open-source free PHP CAPTCHA script for generating complex images and CAPTCHA codes to protect forms from spam and abuse. Description Securimage suffers from a XSS issue in 'exampleform.php' that uses the 'REQUESTURI' variable. The vulnerability is present because there...

NetApp OnCommand System Manager 2.1 / 2.0.2 XSS / File Inclusion / Command Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: NetApp OnCommand System Manager vulnerable version: = 2.1 and =2.0.2 fixed version: 2.2 only XSS fixed CVE: CVE-2013-3320 XSS...

PHP Code Injection in FUDforum

Advisory ID: HTB23146 Product: FUDforum Vendor: FUDforum Vulnerable Versions: 3.0.4 and probably prior Tested Version: 3.0.4 Vendor Notification: February 21, 2013 Vendor Patch: March 11, 2013 Public Disclosure: April 3, 2013 Vulnerability Type: Code Injection CWE-94 CVE Reference: CVE-2013-2267...

Governments Using FinFisher Disguised as Firefox to Spy

Oppressive governments have not been shy about using surveillance software to monitor dissidents’ activity. Like cybercriminals, these governments have been accused of using any means at their disposal to implant the spyware on computers. One tactic, uncovered by Citizen Lab, Munk School of Globa...

Photo Transfer v4.1 iOS - Multiple Web Vulnerabilities

Document Title: =============== Photo Transfer v4.1 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=933 Release Date: ============= 2013-04-23 Vulnerability Laboratory ID VL-ID: ==================================== 933...

KrisonAV CMS 3.0.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications Advisory Details: High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in KrisonAV CMS, which can be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-Site Scripting XSS vulnerabili...

KrisonAV CMS 3.0.1 - Multiple Vulnerabilities

KrisonAV CMS 3.0.1 - Multiple Vulnerabilities Advisory ID: HTB23150 Product: KrisonAV CMS Vendor: http://www.krisonav.com Vulnerable Versions: 3.0.1 and probably prior Tested Version: 3.0.1 Vendor Notification: March 27, 2013 Vendor Patch: March 31, 2013 Public Disclosure: April 17, 2013...

CMSLogik 1.2.1 User Enumeration Weakness

!/usr/bin/python CMSLogik 1.2.1 user param User Enumeration Weakness Vendor: ThemeLogik Product web page: http://www.themelogik.com/cmslogik Affected version: 1.2.1 and 1.2.0 Summary: CMSLogik is built on a solid & lightweight framework called CodeIgniter, and design powered by Bootstrap. This...

[REMnux] A Linux Distribution for Malware Analysis

REMnux incorporates a number of tools for analyzing malicious executables that run on Microsoft Windows, as well as browser-based malware, such as Flash programs and obfuscated JavaScript. This popular toolkit includes programs for analyzing malicious documents, such PDF files, and utilities for...