Arasism (IR) CMS - File Upload Vulnerability

Title: ====== Arasism IR CMS - File Upload Vulnerability Date: ===== 2012-07-12 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=657 VL-ID: ===== 657 Common Vulnerability Scoring System: ==================================== 6.5 Abstract: ========= The Laboratory Research...

Wiper, the Destructive Malware possibly connected to Stuxnet and Duqu

Kaspersky Lab publishes research resulting from the digital forensic analysis of the hard disk images obtained from the machines attacked by the Wiper - a destructive malware program attacking computer systems related to oil facilities in Western Asia. Security researchers from Kaspersky Lab have...

Adobe Photoshop CS6 - .png Parsing Heap Overflow

Adobe Photoshop CS6 - .png Parsing Heap Overflow Application: Adobe Photoshop CS6 PNG Parsing Heap Overflow Platforms: Windows & Macintosh Versions: 13.x Secunia: SA49141 PRL: 2012-27 Author: Francis Provencher Protek Research Lab's Website: http://www.protekresearchlab.com/ Twitter:...

SonicWall PolicyManager Module - Cross Site Vulnerability

Document Title: =============== SonicWall PolicyManager Module - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=529 Release Date: ============= 2012-09-01 Vulnerability Laboratory ID VL-ID: ==================================== 5...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 13.37 and -current to fix security issues. Here are the details from the Slackware 13.37 ChangeLog: This release contains security fixes and improvements. For more information, see:...

Express Burn Plus 4.58 Buffer Overflow

!/usr/bin/perl Express Burn Plus v4.58 EBP Project File Handling Buffer Overflow PoC Vendor: NCH Software Product web page: http://www.nchsoftware.com Affected version: 4.58 Summary: Express Burn is a program that allows you to create and copy many kinds of disc media, including Audio audio CDs /...

Express Burn Plus v4.58 EBP Project File Handling Buffer Overflow PoC

Summary Express Burn is a program that allows you to create and copy many kinds of disc media, including Audio audio CDs / .mp3 CDs, Video DVDs, and Data CDs / DVDs / Blu-ray. Description The vulnerability is caused due to a boundary error in the processing of a project file, which can be exploit...

Express Burn Plus 4.58 - EBP Project File Handling Buffer Overflow (PoC)

Express Burn Plus 4.58 - EBP Project File Handling Buffer Overflow PoC !/usr/bin/perl Express Burn Plus v4.58 EBP Project File Handling Buffer Overflow PoC Vendor: NCH Software Product web page: http://www.nchsoftware.com Affected version: 4.58 Summary: Express Burn is a program that allows you t...

xt:Commerce VEYTON 4.0.15 (products_name_de) Script Insertion Vulnerability

Summary One shop system, many shop solutions. The shop software xt:Commerce 4 is the basic framework for online shops and for merchants who install and configure their own shop. Description xt:Commerce suffers from a stored XSS vulnerability when parsing user input to the 'productsnamede' paramet...

Monstra CMS 1.2.1 - Multiple HTML Injection Vulnerabilities

Monstra CMS 1.2.1 - Multiple HTML Injection Vulnerabilities Monstra 1.2.1 Multiple HTML Injection Vulnerabilities alert1;' / alert2;' / input type="hidden" name="csrf" value="a7de775dce681ae31b7e89...

Monstra 1.2.1 Multiple HTML Injection Vulnerabilities

Summary Monstra is fast and small content management system written in PHP! It's free, open source and easy to use from the start! Description Monstra suffers from multiple stored XSS vulnerabilities when parsing user input to the 'menuitemlink', 'menuitemname' and 'pagetitle' parameters via POST...

KindEditor 4.1.2 (name parameter) Reflected XSS Vulnerability

Summary KindEditor online HTML editor is a set of open source, mainly for users on the site to get WYSIWYG editing effects, developers can replace the traditional multi-line text input box textarea KindEditor rich visualization text input box. Description KindEditor is prone to a reflected...

web@all CMS 2.0 Multiple Remote XSS Vulnerabilities

Summary web@all is a PHP content management system CMS. If you know about it,you nearly can use it to do anything. Description web@all CMS suffers from multiple stored and reflected cross-site scripting vulnerabilities. The issues are triggered when input passed via several parameters to several...

Multiple vulnerabilities in TCExam

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in TCExam, which can be exploited to perform Cross-Site Scripting XSS and SQL injection attacks. 1 SQL Injection in TCExam: CVE-2012-4601 1.1 Input passed via the "usergroups" POST parameter to /admin/code/tceedittest.php ...

Nike+ Panel / Mobile App Cross Site Scripting

Title: ====== Nike+ Panel & Mobile App - Multiple Web Vulnerabilities Date: ===== 2012-08-01 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=663 VL-ID: ===== 663 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: ============= Da...

Joomla com_photo - SQL Injection Vulnerability

Title: ====== Joomla comphoto - SQL Injection Vulnerability Date: ===== 2012-07-10 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=654 VL-ID: ===== 641 Common Vulnerability Scoring System: ==================================== 8 Introduction: ============= Joomla is a fr...

phpList 2.10.18 Cross Site Scripting / SQL Injection Vulnerability

Exploit for php platform in category web applications Vendor: phpList Ltd Vulnerable Versions: 2.10.18 and probably prior Tested Version: 2.10.18 Vendor Notification: July 11, 2012 Public Disclosure: August 8, 2012 Vulnerability Type: Cross-Site Scripting CWE-79, SQL Injection CWE-89 CVE...

Researchers Release Detection Tool For Gauss Malware's Palida Narrow Font

One of the many mysteries around the discovery of the Gauss malware is why the tool installs a new font called Palida Narrow on infected machines. Researchers have been unable to figure out yet what the purpose of the font is, but as its presence on a PC is a good indicator of a Gauss infection,...

7 Sepher SQL Injection

Exploit Title : 7sepehr SQL Injection Vulnerability Author : Tapco Security & Research Lab Discovered By : K0242 Home : sec-lab.ir Contact : research at sec-lab dot ir Portal Link : www.7sepehr.Com Security Risk : High DorK : "Powered by 7sepehr.com" Expl0iTs: www.target.com/contents.aspx?id=sqli...

Zeus malware targeting BlackBerry and Android devices

Security researchers at Kaspersky Lab have discovered five new samples of the ZeuS-in-the-Mobile ZitMo malware package, targeting Android and BlackBerry devices. Zitmo Zeus in the mobile is the name given to the mobile versions of Zeus, and it's been around for a couple of years already, mostly...