Keylogging Version of Anti-Censorship Software Simurgh Found

Citizen Lab found a compromised version of an anti-censorship tool that’s popular in Iran and Syria circulating with a backdoor installed. The software, Simurgh, is described by Citizen Lab as a stand-alone proxy software for Microsoft Windows users. It was used predominantly by Iranians in the...

DHS Says No Evidence That Flame Targets Industrial Systems, But Urges Caution

In and advisory, the Department of Homeland Security’s Industrial control System ICS CERT said that it doesn’t believe the Flame malware targets industrial control systems ICS or SCADA systems, but the group advised critical infrastructure owners to be on alert. The advisory, issued Wednesday,...

Sony VAIO Wireless Manager 4.0.0.0 Buffer Overflows

Exploit for hardware platform in category dos / poc Product: Wireless Manager Sony VAIO Vendor: Sony Computers Vulnerable Versions: 4.0.0.0 and probably prior Tested Version: 4.0.0.0 Vendor Notification: 7 December 2011 Vendor Patch: 20 January 2012 Public Disclosure: 30 May 2012 Vulnerability...

Multiple vulnerabilities in web@all

High-Tech Bridge Security Research Lab has discovered multiple vulnerabilities in web@all, which can be exploited to perform Сross-Site Request Forgery CSRF and Cross-Site Scripting XSS attacks. 1 Сross-Site Request Forgery CSRF in web@all: CVE-2012-3231 1.1 The application allows authorized...

ADICO CMS v1.1 - Blind SQL Injection Vulnerability

Document Title: =============== ADICO CMS v1.1 - Blind SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=582 Release Date: ============= 2012-05-28 Vulnerability Laboratory ID VL-ID: ==================================== 582 Comm...

Pligg CMS 1.2.1 Cross Site Scripting / Local File Inclusion

Advisory ID: HTB23089 Product: Pligg CMS Vendor: Pligg, LLC. Vulnerable Versions: 1.2.1 and probably prior Tested Version: 1.2.1 Vendor Notification: 25 April 2012 Vendor Patch: 18 May 2012 Public Disclosure: 23 May 2012 Vulnerability Type: Local File Inclusion, Cross-Site Scripting XSS CVE...

pragmaMx 1.12.1 Cross Site Scripting

Advisory ID: HTB23090 Product: pragmaMx Vendor: pragmaMx Team Vulnerable Versions: 1.12.1 and probably prior Tested Version: 1.12.1 Vendor Notification: 2 May 2012 Vendor Patch: 4 May 2012 Public Disclosure: 23 May 2012 Vulnerability Type: Cross-Site Scripting XSS CVE Reference: CVE-2012-2452...

Months After A Patch, Targeted Attacks Still Using Adobe Flash Bug

More than three months after it was patched, attackers are still using a vulnerability in Adobe’s Flash product in targeted, ‘APT-style’ attacks. The vulnerability, identified as CVE-2012-0754 was patched in February and linked to targeted attacks weeks later. But new attacks targeting unpatched...

DVD-Lab Studio 1.25 DAL File Open Crash

Exploit for windows platform in category dos / poc DVD-Lab Studio 1.25 DAL File Open Crash =================================================================================== Exploit Title:DVD-Lab Studio 1.25 Malicious DAL File Denial of service Download...

DVD-Lab Studio 1.25 - .DAL File Open Crash

DVD-Lab Studio 1.25 - .DAL File Open Crash DVD-Lab Studio 1.25 DAL File Open Crash =================================================================================== Exploit Title:DVD-Lab Studio 1.25 Malicious DAL File Denial of service Download...

DVD-Lab Studio 1.25 - '.DAL' File Open Crash

DVD-Lab Studio 1.25 DAL File Open Crash =================================================================================== Exploit Title:DVD-Lab Studio 1.25 Malicious DAL File Denial of service Download link:http://download.cnet.com/DVD-Lab-Studio/3000-79704-10391372.html Author: Ahmed Elhady...

DVD-Lab Studio 1.25 Crash

DVD-Lab Studio 1.25 DAL File Open Crash =================================================================================== Exploit Title:DVD-Lab Studio 1.25 Malicious DAL File Denial of service Download link:http://download.cnet.com/DVD-Lab-Studio/3000-79704-10391372.html Author: Ahmed Elhady...

backupDB() v1.2.7a (onlyDB) Remote XSS Vulnerability

Summary backupDB is a PHP script that backs up MySQL tables and databases to a file uncompressed, gzip, bzip2 for easy daily backup. Description backupDB is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to...

CLscript CMS v3.0 - Multiple Web Vulnerabilities

Document Title: =============== CLscript CMS v3.0 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=574 Release Date: ============= 2012-05-15 Vulnerability Laboratory ID VL-ID: ==================================== 574 Common...

Coupon Script v6.0 - SQL Injection Vulnerability

Document Title: =============== Coupon Script v6.0 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=572 Release Date: ============= 2012-05-15 Vulnerability Laboratory ID VL-ID: ==================================== 572 Common...

Andromeda Streaming MP3 Server v1.9.3.6 (s param) Remote XSS Vulnerability

Summary Turn your MP3 collection into an MP3 server. Simply add a single PHP or ASP script to any folder within your site. Now you can browse and play the contents of that folder - over the Web, or over your local network. Description Andromeda is prone to a cross-site scripting vulnerability. Th...

XSS in PrestaShop

High-Tech Bridge SA Security Research Lab has discovered vulnerability in PrestaShop, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in PrestaShop Input passed via the "product" POST parameter to ajax.php is not properly sanitised before being...

AnvSoft Any Video Converter 4.3.6 - Local Stack Overflow

AnvSoft Any Video Converter 4.3.6 - Local Stack Overflow !/usr/bin/python Exploit Title: AnvSoft Any Video Converter 4.3.6 Stack Overflow Author: cikumel @mhxx and y0k @riy0wid from @spentera research Website: http://www.spentera.com Platform: Windows Tested on: Windows XP SP3 Based on POC by...

AnvSoft Any Video Converter 4.3.6 Stack Overflow Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: AnvSoft Any Video Converter 4.3.6 Stack Overflow Author: cikumel @mhxx and y0k @riy0wid from @spentera research Website: http://www.spentera.com Platform: Windows Tested on: Windows XP SP3 Based on POC by...

Baby Gekko CMS v1.1.5c Multiple Stored XSS Vulnerabilities

Exploit for php platform in category web applications Baby Gekko CMS v1.1.5c Multiple Stored Cross-Site Scripting Vulnerabilities Vendor: Baby Gekko, Inc. Product web page: http://www.babygekko.com Affected version: 1.1.5c Summary: BabyGekko strives to deliver high quality websites and other web...