Grindr Bug Bounty - Denial of Service Vulnerability

Document Title: =============== Grindr Bug Bounty - Denial of Service Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1490 Video: https://www.youtube.com/watch?v=tqc5IacqXA Release Date: ============= 2015-05-05 Vulnerability Laboratory ID VL-ID:...

Grindr Account System - Auth Bypass Vulnerability

Document Title: =============== Grindr Account System - Auth Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1487 Video: https://www.youtube.com/watch?v=7WTLJ2d06kM Advisory1: http://www.vulnerability-lab.com/getcontent.php?id=1419 Advisory2:...

Foxit Reader PDF <= 7.1.3.320 - Parsing Memory Corruption Vulnerability

Exploit for windows platform in category local exploits Application: Foxit Reader PDF Parsing Memory Corruption Platforms: Windows Versions: The vulnerabilities are reported in Foxit Reader and Foxit Enterprise Reader versions 7.1.0.306 and 7.1.3.320 and Foxit Phantom PDF versions 7.1.0.306,...

Foxit Reader PDF 7.1.3.320 - Parsing Memory Corruption

Application: Foxit Reader PDF Parsing Memory Corruption Platforms: Windows Versions: The vulnerabilities are reported in Foxit Reader and Foxit Enterprise Reader versions 7.1.0.306 and 7.1.3.320 and Foxit Phantom PDF versions 7.1.0.306, 7.1.2.311, and 7.1.3.320. Secunia: SA63346 PRL: 2015-05...

New Utility Decrypts Files Lost to TeslaCrypt Ransomware

Crypto-ransomware variants have enterprises on edge because of the threat of irreversibly damaged files. Some organizations, including most recently the Tewksbury, Ma., police department have gone as far as to pay hundreds of dollars in ransom for the recovery key. Some technology companies are...

SonicWall SonicOS 7.5.0.12 & 6.x - Cross Site Vulnerability

Document Title: =============== SonicWall SonicOS 7.5.0.12 & 6.x - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1359 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3447 CVE-ID: ======= CVE-2015-3447 Release Date:...

KLA10564 Denial of service vulnerability in OS X

An unspecified vulnerability was found in Apple OS X. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited remotely via a specially designed JPEG. NB: Vendor does not provide CVSS rating. This rating was calculated in Kaspersky Lab and...

SonicWall SonicOS 7.5.0.12 & 6.x - Cross Site Vulnerability

Document Title: =============== SonicWall SonicOS 7.5.0.12 & 6.x - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1359 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3447 CVE-ID: ======= CVE-2015-3447 Release Date:...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.1 and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mozilla-firefox-31.6.0esr-i486-1slack14.1.txz: Upgraded. This release contains security fixes and improvements. For more...

Mobile Drive HD 1.8 Local File Inclusion

Document Title: =============== Mobile Drive HD v1.8 - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1446 Release Date: ============= 2015-03-11 Vulnerability Laboratory ID VL-ID: ==================================== 1446...

ADB - Backup Archive File Overwrite Directory Traversal

ADB - Backup Archive File Overwrite Directory Traversal ADB backup archive path traversal file overwrite ------------------------------------------------ Using adb one can create a backup of his/her Android device and store it on the PC. The backup archive is based on the tar file format. By...

CVE-2014-7954 MTP path traversal vulnerability in Android

MTP path traversal vulnerability in Android 4.4 ----------------------------------------------- doSendObjectInfo method of the MtpServer class implemented in frameworks/av/media/mtp/MtpServer.cpp does not validate the name parameter of the incoming MTP packet at all. It is possible to upload file...

CVE-2014-7951 adb backup archive path traversal file overwrite

ADB backup archive path traversal file overwrite ------------------------------------------------ Using adb one can create a backup of his/her Android device and store it on the PC. The backup archive is based on the tar file format. By modifying tar headers to contain ../../ like patterns it is...

ADB Backup Traversal / File Overwrite

ADB backup archive path traversal file overwrite ------------------------------------------------ Using adb one can create a backup of his/her Android device and store it on the PC. The backup archive is based on the tar file format. By modifying tar headers to contain ../../ like patterns it is...

PayPal Inc - (Merchant Search) CS Cross Site Vulnerability

Document Title: =============== PayPal Inc - Merchant Search CS Cross Site Vulnerability References: =========== Video: http://www.vulnerability-lab.com/getcontent.php?id=1454 View: https://www.youtube.com/watch?v=v5egy9VBs0 Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1453...

PayPal Inc - (Merchant Search) CS Cross Site Vulnerability

Document Title: =============== PayPal Inc - Merchant Search CS Cross Site Vulnerability References: =========== Video: http://www.vulnerability-lab.com/getcontent.php?id=1454 View: https://www.youtube.com/watch?v=v5egy9VBs0 Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1453...

Oracle - Outside-In .DOCX File Parsing Memory Corruption

Oracle - Outside-In .DOCX File Parsing Memory Corruption Title: Oracle Outside-In DOCX File Parsing Memory Corruption Platforms: Windows CVE: Secunia: PRL: 2015-04 Author: Francis Provencher Protek Research Lab’s Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2...

Oracle - Outside-In '.DOCX' File Parsing Memory Corruption

Title: Oracle Outside-In DOCX File Parsing Memory Corruption Platforms: Windows CVE: Secunia: PRL: 2015-04 Author: Francis Provencher Protek Research Lab’s Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2 Report Timeline 3 Technical details 4 POC ==============...

WordPress MiwoFTP Plugin 1.0.5 CSRF Arbitrary File Deletion Exploit

Summary MiwoFTP is a smart, fast and lightweight file manager plugin that operates from the back-end of WordPress. Description Input passed to the 'selitems' parameter is not properly sanitised before being used to delete files. This can be exploited to delete files with the permissions of the we...

Coordinated Takedown Puts End to Simda Botnet

The Simda botnet, known for spreading banking malware and dropping a backdoor on hundreds of thousands of machines worldwide, was taken down last Thursday in a collaborative effort between international law enforcement bodies and private security and technology companies. Fourteen command and...