OpenEMR 4.1.0 Local File Inclusion / Command Execution

Advisory ID: HTB23069 Product: OpenEMR Vendor: OEMR Vulnerable Version: 4.1.0 and probably prior Tested Version: 4.1.0 Vendor Notification: 11 January 2012 Vendor Patch: 29 January 2012 Public Disclosure: 01 February 2012 Vulnerability Type: Local File Inclusion, Arbitrary Command Execution...

HITB2011KUL - Reverse Engineering Android Malware

Document Title: =============== HITB2011KUL - Reverse Engineering Android Malware References: =========== Download: http://www.vulnerability-lab.com/resources/videos/413.wmv View: http://www.youtube.com/watch?v=22KVTR4mEIk Release Date: ============= 2012-02-02 Vulnerability Laboratory ID VL-ID:...

osCommerce 3.0.2 - Persistent Cross-Site Scripting

osCommerce 3.0.2 - Persistent Cross-Site Scripting Title: ====== OSCommerce v3.0.2 - Persistent Cross Site Vulnerability Date: ===== 2012-02-02 VL-ID: ===== 407 Introduction: ============= osCommerce is the leading Open Source online shop e-commerce solution that is available for free under the G...

Facebook Profile Sticker - SQL Injection Vulnerability

Document Title: =============== Facebook Profile Sticker - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=409 Release Date: ============= 2012-02-02 Vulnerability Laboratory ID VL-ID: ==================================== 409...

OSCommerce v3.0.2 - Persistent Cross Site Vulnerability

Document Title: =============== OSCommerce v3.0.2 - Persistent Cross Site Vulnerability References Source: ==================== http://www.cnnvd.org.cn/vulnerability/show/cvid/2012020057 ID: CNNVD-201202-057 Release Date: ============= 2012-02-01 Vulnerability Laboratory ID VL-ID:...

Kelihos Botnet Resurfaces

UPDATE–The Kelihos botnet, which researchers at Kaspersky Lab and Microsoft disrupted last fall by sinkholing the control channel, has sprung back to life and is using only slightly different versions of the original malware and controller list. The rejuvenation of the botnet illustrates the...

Sun Microsystems (Print) - Cross Site Scripting Vulnerability

Document Title: =============== Sun Microsystems Print - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=404 Release Date: ============= 2012-01-31 Vulnerability Laboratory ID VL-ID: ====================================...

Mindjet MindManager 2012 v10.0.493 Multiple Remote Vulnerabilities

Summary An intuitive visual framework that fosters clarity, innovative thinking & communication to improve business results. Description MindManager suffers from several vulnerabilities included into the whole package. Several OCX and DLL libraries from 3rd party software glg.ocx,...

Virtualization: Threats and Protections For SMBs

Join Paul Roberts, Threatpost editor, and his guests, Michael Guigli, CEO of CloudConnect and Tim Armstrong, Malware Researcher at Kaspersky Lab as they discuss Virtualization and the security challenges faced by small businesses. To access your show page for the Threatpost Now! Series, please...

Tracker Software pdfSaver ActiveX 3.60 Buffer Overflow

Tracker Software pdfSaver ActiveX 3.60 pdfxctrl.dll Stack Buffer Overflow SEH Vendor: ------- Tracker Software Products Ltd. Product web page: ----------------- http://www.tracker-software.com Affected version: ----------------- 3.60.0128 Summary: -------- PDF-Saver Technology is a unique new...

Tracker Software pdfSaver ActiveX 3.60 (pdfxctrl.dll) Stack Buffer (SEH)

Exploit for windows platform in category dos / poc Tracker Software pdfSaver ActiveX 3.60 pdfxctrl.dll Stack Buffer Overflow SEH Vendor: ------- Tracker Software Products Ltd. Product web page: ----------------- http://www.tracker-software.com Affected version: ----------------- 3.60.0128 Summary...

Tracker Software pdfSaver ActiveX 3.60 - pdfxctrl.dll Stack Buffer Overflow (SEH) (PoC)

Tracker Software pdfSaver ActiveX 3.60 - pdfxctrl.dll Stack Buffer Overflow SEH PoC Tracker Software pdfSaver ActiveX 3.60 pdfxctrl.dll Stack Buffer Overflow SEH Vendor: ------- Tracker Software Products Ltd. Product web page: ----------------- http://www.tracker-software.com Affected version:...

ME Monitoring Manager Cross Site Scripting / SQL Injection

Title: ====== ME Monitoring Manager v9.x; v10.x - Multiple Vulnerabilities Date: ===== 2012-01-27 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=115 VL-ID: ===== 115 Introduction: ============= Mit dem ManageEngine Applications Manager können IT-Administratoren von...

Tracker Software pdfSaver ActiveX 3.60 (pdfxctrl.dll) Stack Buffer Overflow (SEH)

Summary PDF-Saver Technology is a unique new feature of PDF-XChange software which allows printing jobs to be combined prior to the final PDF file being generated - e.g. to join 3 pages of Excel spreadsheet, 5 slides of PowerPoint presentation and 10 pages of Word document into one PDF document...

Tracker Software pdfSaver ActiveX 3.60 - 'pdfxctrl.dll' Stack Buffer Overflow (SEH) (PoC)

Tracker Software pdfSaver ActiveX 3.60 pdfxctrl.dll Stack Buffer Overflow SEH Vendor: ------- Tracker Software Products Ltd. Product web page: ----------------- http://www.tracker-software.com Affected version: ----------------- 3.60.0128 Summary: -------- PDF-Saver Technology is a unique new...

eBank IT Online Banking Cross Site Scripting

Title: ====== eBank IT Online Banking - Multiple Web Vulnerabilities Date: ===== 2012-01-26 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=313 VL-ID: ===== 313 Introduction: ============= As a leading provider of innovative online banking software solutions, eBank-IT!...

Oracle Solution Website - Cross Site Scripting Vulnerabilities

Document Title: =============== Oracle Solution Website - Cross Site Scripting Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=370 Release Date: ============= 2012-01-27 Vulnerability Laboratory ID VL-ID:...

DeutschePost Website - Non Persistent Web Vulnerability

Document Title: =============== DeutschePost Website - Non Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=261 Release Date: ============= 2012-01-26 Vulnerability Laboratory ID VL-ID: ==================================== 261...

Google BugBounty#9 - Cross Site Scripting Vulnerability

Document Title: =============== Google BugBounty9 - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=396 Release Date: ============= 2012-01-25 Vulnerability Laboratory ID VL-ID: ==================================== 396...

Acolyte CMS 1.5 / 6.3 Cross Site Scripting / SQL Injection

Title: ====== Acolyte CMS v1.5 and v6.3 - SQL Injection Vulnerabilities Date: ===== 2012-01-25 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=397 VL-ID: ===== 397 Abstract: ========= A Vulnerability Laboratory researcher discovered a critical remote SQL Injection and a...