Stark CRM多个安全漏洞

Bugtraq ID:65710 Stark CRM是一款PHP客户关系管理系统。 Stark CRM存在多个存储型跨站脚本和跨站请求伪造漏洞，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可获取敏感信息或以目标用户上下文执行恶意操作。 0 Stark CRM 1.0 目前没有详细解决方案提供： http://www.iwcn.ws Stark CRM v1.0 Multiple Script Injection And Session Riding Vulnerabilities Vendor: IWCn Systems Inc. Product web page:...

Hacking Team sold Spyware to 21 Countries; Targeting Journalists and Human Right Activists

Spying on the world by injecting sophisticated backdoors in software, systems, and mobile phones, leads to violation of the Privacy and Security of every individual. Yes, we are talking about Surveillance, but this time not about NSA. Instead, Countries including some with poor human-rights recor...

WiFiles HD v1.3 iOS - File Include Web Vulnerability

Document Title: =============== WiFiles HD v1.3 iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1214 Release Date: ============= 2014-02-21 Vulnerability Laboratory ID VL-ID: ==================================== 1214...

kernel

New kernel packages are available for Slackware 14.1 64-bit to fix a security issue. Here are the details from the Slackware64 14.1 ChangeLog: patches/packages/linux-3.10.17-2/: These are new kernels that fix CVE-2014-0038, a bug that can allow local users to gain a root shell. Be sure to reinsta...

File Hub v1.9.1 iOS - Multiple Web Vulnerabilities

Document Title: =============== File Hub v1.9.1 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1195 Release Date: ============= 2014-02-14 Vulnerability Laboratory ID VL-ID: ==================================== 1195...

Multiple SQL Injection Vulnerabilities in AuraCMS

Advisory ID: HTB23196 Product: AuraCMS Vendor: AuraCMS Vulnerable Versions: 2.3 and probably prior Tested Version: 2.3 Advisory Publication: January 8, 2014 without technical details Vendor Notification: January 8, 2014 Vendor Patch: January 30, 2014 Public Disclosure: February 5, 2014...

seamonkey

New seamonkey packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/seamonkey-2.24-i486-1slack14.1.txz: Upgraded. This update contains security fixes and improvements. For more information, se...

doorGets CMS 5.2 SQL Injection

Advisory ID: HTB23197 Product: doorGets CMS Vendor: doorGets Vulnerable Versions: 5.2 and probably prior Tested Version: 5.2 Advisory Publication: January 15, 2014 without technical details Vendor Notification: January 15, 2014 Vendor Patch: January 15, 2014 Public Disclosure: February 5, 2014...

Adobe issues Emergency Flash Player update to patch critical zero-day threat

Adobe is recommending that users update their Flash Players immediately. The company has published an emergency security bulletin today, that addresses vulnerabilities the Flash Player and released a patch to fix a vulnerability which is currently being exploited in a sophisticated cyber espionag...

Emergency Adobe Flash Player Security Update Patches 0Day

Adobe today released an out-of-band security update for Flash Player that patches a vulnerability the company said is currently being exploited. Adobe Flash Player version 12.0.0.43 and earlier for Windows and Mac are affected as is 11.2.202.335 and earlier on Linux. The vulnerability,...

Apache Tomcat Manager Code Execution Exploit

This Metasploit module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets var...

GameOver Zeus Now Using Encryption to Bypass Detection

Cybercriminals have begun to tweak the way the GameOver Zeus Trojan is being delivered to users’ machines, making it easier for the banking malware to evade detection and steal victims’ credentials. To get the job done the malware has been working in tandem with the malware Upatre. For about a we...

Multiple Vulnerabilities in Eventum

Advisory ID: HTB23198 Product: Eventum Vendor: Eventum Development Team Vulnerable Versions: 2.3.4 and probably prior Tested Version: 2.3.4 Advisory Publication: January 22, 2014 without technical details Vendor Notification: January 22, 2014 Vendor Patch: January 24, 2014 Public Disclosure:...

HackInTheBox Quartal Magazine - eZine Issue 10

Document Title: =============== HackInTheBox Quartal Magazine - eZine Issue 10 References: =========== Download: http://www.vulnerability-lab.com/resources/documents/hitbez10.pdf Original: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-010.pdf Release Date: ============= 2014-01-31...

NCH Software Inventoria 3.45 (id param) Reflected Cross-Site Scripting Vulnerability

Summary Inventoria is a business inventory management and stock control software that allows you to manage and monitor your inventory to help streamline your operations and boost profits. Description The application suffers from a reflected XSS issue due to a failure to properly sanitize...

mozilla-nss

New mozilla-nss packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mozilla-nss-3.15.4-i486-1slack14.1.txz: Upgraded. Upgraded to nss-3.15.4 and nspr-4.10.3. Fixes a possible...

Mozilla Thunderbird vulnerability allows hackers to Insert malicious code into Emails

Do you use Thunderbird, a free; open-source; cross-platform application for managing email and news feeds? According to a Pakistani Security Researcher from Vulnerability-Lab, a flaw gives an attacker the ability to run code on a user’s machine. Mozilla Thunderbird 17.0.6 email application is...

Mozilla Thunderbird does not adequately restrict HTML elements in email message content

Overview Mozilla Thunderbird does not adequately restrict HTML elements in email content, which could allow an attacker to execute arbitrary script when a specially-crafted email message is forwarded or replied to. Description Vulnerability Lab has reported a vulnerability in the way Mozilla...

Mozilla Thunderbird - WireTap Remote 0Day Vulnerability

Document Title: =============== Mozilla Thunderbird - WireTap Remote 0Day Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1182 View: http://www.youtube.com/watch?v=mqZ4eY2th0s Advisory: http://www.vulnerability-lab.com/getcontent.php?id=967 Release Date:...

Joomla Komento 1.7.2 Cross Site Scripting Vulnerability

Joomla Komento extension version 1.7.2 suffers from a cross site scripting vulnerability. Product: Komento Joomla Extension Vendor: Stack Ideas Sdn Bhd. Vulnerable Versions: 1.7.2 and probably prior Tested Version: 1.7.2 Advisory Publication: January 2, 2014 without technical details Vendor...