HITB Quartal Magazine - eZine Issue 007

Document Title: =============== HITB Quartal Magazine - eZine Issue 007 References: =========== Original: https://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-007.pdf Article: https://magazine.hitb.org/ Mirror: https://www.vulnerability-lab.com/resources/documents/297.pdf Article:...

WordPress Pretty Link 1.4.56 Cross Site Scripting

Vulnerability ID: HTB23049 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinprettylinkwordpressplugin.html Product: Pretty Link WordPress Plugin Vendor: Caseproof http://blairwilliams.com/ Vulnerable Version: 1.4.56 and probably prior Tested Version: 1.4.56 Vendor Notification...

BugFree 2.1.3 Cross Site Scripting

Vulnerability ID: HTB23048 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinbugfree.html Product: BugFree Vendor: www.bugfree.org.cn http://www.bugfree.org.cn/ Vulnerable Version: 2.1.3 and probably prior Tested Version: 2.1.3 Vendor Notification: 21 September 2011 Vulnerabili...

Multiple vulnerabilities in Efront

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Efront, which can be exploited to perform SQL injection and cross-site scripting attacks. 1 Cross-Site scripting XSS vulnerabilities in Efront 1.1 Input passed via the "course" GET parameter to index.php is not...

Cotonti CMS v0.9.4 Multiple Remote Vulnerabilities

Summary Cotonti is a powerful open-source web development framework and content manager with a focus on security, speed and flexibility. Description Input passed via the parameters 'redirect.php' in 'message.php' and 'w' and 'id' in 'index.php' script are not properly sanitised before being...

eFront Enterprise 3.6.9 Arbitrary File Download

Title: ====== eFront Enterprise v3.6.9 - Arbitrary Download Vulnerability Date: ===== 2011-10-08 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=290 http://www.vulnerability-lab.com/getcontent.php?id=230 VL-ID: ===== 290 Introduction: ============= Tailored with larger...

eFront Enterprise Edition 3.6.9 SQL Injection

Title: ====== eFront Enterprise Edition v3.6.9 - SQL Injection Vulnerability Date: ===== 2011-10-07 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=230 VL-ID: ===== 230 Introduction: ============= Tailored with larger organizations in mind, eFront Enterprise offers...

Apple Cross Site Scripting

Title: ====== Apple Website - Non Persistent Cross Site Vulnerability Date: ===== 2011-10-07 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=289 VL-ID: ===== 289 Introduction: ============= Our communities are filled with thousands of Mac, iPod, iPhone and iPad users fr...

Troubleshooting Exchange AIR

Challenge You are not able to proceed through AIR wizard to perform application item recovery. You are not able to restore individual mailbox items. Cause vLab is misconfigured or you do not have sufficient permissions. Solution To address the issue, follow the steps below: 1. Make sure vLab is...

Prosieben Website - Multiple SQL Injection Vulnerabilities

Document Title: =============== Prosieben Website - Multiple SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=284 Release Date: ============= 2011-10-04 Vulnerability Laboratory ID VL-ID: ====================================...

CanadianISP.ca SQL Injection

Title: ====== Canadian ISP Website - SQL Injection Vulnerability Date: ===== 2011-09-23 VL-ID: ===== 282 Reference: ========== http://www.vulnerability-lab.com/getcontent.php?id=282 Introduction: ============= Canadianisp.ca - Is a wholly owned project of Marc Bissonnette / InternAlysis. It was...

Canadian ISP CA Website - SQL Injection Vulnerability

Document Title: =============== Canadian ISP CA Website - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=282 Release Date: ============= 2011-10-04 Vulnerability Laboratory ID VL-ID: ==================================== 282...

Adobe Photoshop Elements 8.0 - Multiple Arbitrary Code Execution Vulnerabilities

Adobe Photoshop Elements 8.0 - Multiple Arbitrary Code Execution Vulnerabilities Title: ------ Adobe Photoshop Elements 8.0 Multiple Arbitrary Code Execution Vulnerabilities Vendor: ------- Adobe Systems Inc. http://www.adobe.com Product web page: -----------------...

Adobe Photoshop Elements 8.0 - Multiple Arbitrary Code Execution Vulnerabilities

Title: ------ Adobe Photoshop Elements 8.0 Multiple Arbitrary Code Execution Vulnerabilities Vendor: ------- Adobe Systems Inc. http://www.adobe.com Product web page: ----------------- http://www.adobe.com/products/photoshop-elements.html Affected version: ----------------- 8.0 and 7.0...

Barracuda Backup v2.0 - Multiple Web Vulnerabilities

Title: ====== Barracuda Backup v2.0 - Multiple Web Vulnerabilities Date: ===== 2011-09-28 References: =========== Barracuda Backup Application v2.0 VL-ID: ===== 31 Introduction: ============= Barracuda Networks - Worldwide leader in email and Web security. Barracuda Backup Service is a complete a...

European Security Services GPS v1.0 - Multiple Vulnerabilities

Title: ====== European Security Services GPS 1.x - Multiple Vulnerabilities Date: ===== 2011-09-28 VL-ID: ===== 63 Reference: ========== http://www.vulnerability-lab.com/getcontent.php?id=63 Introduction: ============= Fur eine geringe Ortungsgebuhr erhalten Sie einen Zugang zu unserem Online...

QR Codes Found Sending Users to Site Containing Android Trojan

QR codes have been showing up everywhere in the last few months, from magazine ads to the sides of buses to, oddly, billboards. And now they’ve shown up on the list of ways that attackers are delivering malware to victims, with the emergence of a new Android-based Trojan that is hiding on malicio...

Botnet Takedown: Researcher Describes How Kelihos Fell

Dennis Fisher talks with Kaspersky Lab Researcher Tillmann Werner about the takedown of the Kelihos botnet, the network’s unique multi-tiered architecture, its custom protocol and the ethics and legality of pushing updates to disable bots on users’ machines. Podcast audio courtesy of sykboy65...

The Inside Story of the Kelihos Botnet Takedown

Earlier this week, Microsoft released an announcement about the disruption of a dangerous botnet that was responsible for spam messages, theft of sensitive financial information, pump-and-dump stock scams and distributed denial-of-service attacks. Kaspersky Lab played a critical role in this botn...

Facebook Scottsdale Inventory - SQL Injection Vulnerability

Document Title: =============== Facebook Scottsdale Inventory - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=272 Release Date: ============= 2011-09-29 Vulnerability Laboratory ID VL-ID: ====================================...