phpList 2.10.18 Cross Site Scripting / SQL Injection Vulnerability

Exploit for php platform in category web applications Vendor: phpList Ltd Vulnerable Versions: 2.10.18 and probably prior Tested Version: 2.10.18 Vendor Notification: July 11, 2012 Public Disclosure: August 8, 2012 Vulnerability Type: Cross-Site Scripting CWE-79, SQL Injection CWE-89 CVE...

Researchers Release Detection Tool For Gauss Malware's Palida Narrow Font

One of the many mysteries around the discovery of the Gauss malware is why the tool installs a new font called Palida Narrow on infected machines. Researchers have been unable to figure out yet what the purpose of the font is, but as its presence on a PC is a good indicator of a Gauss infection,...

7 Sepher SQL Injection

Exploit Title : 7sepehr SQL Injection Vulnerability Author : Tapco Security & Research Lab Discovered By : K0242 Home : sec-lab.ir Contact : research at sec-lab dot ir Portal Link : www.7sepehr.Com Security Risk : High DorK : "Powered by 7sepehr.com" Expl0iTs: www.target.com/contents.aspx?id=sqli...

Zeus malware targeting BlackBerry and Android devices

Security researchers at Kaspersky Lab have discovered five new samples of the ZeuS-in-the-Mobile ZitMo malware package, targeting Android and BlackBerry devices. Zitmo Zeus in the mobile is the name given to the mobile versions of Zeus, and it's been around for a couple of years already, mostly...

PBBoard 2.1.4 SQL Injection / Improper Authentication / Broken Access Control

Advisory ID: HTB23101 Product: PBBoard Vendor: www.pbboard.com Vulnerable Versions: 2.1.4 and probably prior Tested Version: 2.1.4 Vendor Notification: July 18, 2012 Public Disclosure: August 8, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Improper Access Contro...

Joomla Photo SQL Injection

Title: ====== Joomla comphoto - SQL Injection Vulnerability Date: ===== 2012-07-10 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=654 VL-ID: ===== 641 Common Vulnerability Scoring System: ==================================== 8 Introduction: ============= Joomla is a fr...

BeneficialBank Business 4.13.1 SQL Injection

Title: ====== BeneficialBank Business v4.13.1 - Auth Bypass Vulnerability Date: ===== 2012-07-09 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=654 VL-ID: ===== 654 Common Vulnerability Scoring System: ==================================== 8.5 Abstract: ========= A...

Zoho BugTracker Multiple Stored XSS Vulnerabilities

Summary Zoho Bug Tracker is an online bug tracking software that combines a clean and an intuitive interface to submit and track bugs with custom workflows, business rules, custom fields and filters for the bugs that software projects are bound to generate and fix all bugs fast. Description The B...

WordPress Easy Comment Uploads Shell Upload

Exploit Title : Wordpress Easy Comment Uploads Shell Upload Vulnerability Author : Nafsh Discovered By : Tapco Security & Research Lab Home : sec-lab.ir Contact : research at sec-lab dot ir Date : 4/8/2012 - 13:33 Source : plugins.svn.wordpress.org/easy-comment-uploads/tags/0.60/upload.php DorK :...

Barracuda EMail Security 2.0.2 Filter Bypass / XSS

Title: ====== Barracuda EMail Security 2.0.2 - Multiple Web Vulnerabilities Date: ===== 2012-08-01 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=621 http://www.vulnerability-lab.com/getcontent.php?id=630 Barracuda Networks Security ID: BNSEC-304 VL-ID: ===== 621 Commo...

ShopperPress v2.7 Wordpress - Cross Site Vulnerabilities

Document Title: =============== ShopperPress v2.7 Wordpress - Cross Site Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=670 Release Date: ============= 2012-08-01 Vulnerability Laboratory ID VL-ID: ==================================== 67...

Nike+ Panel & Mobile App - Multiple Web Vulnerabilities

Document Title: =============== Nike+ Panel & Mobile App - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=663 Release Date: ============= 2012-07-31 Vulnerability Laboratory ID VL-ID: ==================================== 663...

New and Improved Madi Spyware Campaign Continues

Madi, the religiously-titled spyware that was discovered last week and thought to be dead, appears to be making a comeback, complete with updates. Kaspersky Lab researcher Nicolas Brulez reverse-engineered the new iteration of the malware, which surfaced on Wednesday. Unlike last week’s original...

SMF Board v2.0.2 - Multiple Web Vulnerabilities

Title: ====== SMF Board v2.0.2 - Multiple Web Vulnerabilities Date: ===== 2012-06-25 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=596 VL-ID: ===== 624 Common Vulnerability Scoring System: ==================================== 4.1 Introduction: ============= Simple...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 13.37 and -current to fix security issues. Here are the details from the Slackware 13.37 ChangeLog: patches/packages/mozilla-thunderbird-14.0-i486-1slack13.37.txz: Upgraded. This release contains security fixes and improvements. For mor...

Religious 'Madi' Spyware Spies on Critical Infrastructure in Middle East

A new variety of spyware has been targeting users in Iran, Israel and the Middle East for the last eight months according to joint research from Israeli security software firm Seculert and Kaspersky Lab. The new malware is using a variety of odd techniques and misdirection to entice users to...

Joomla Board All Version Sql Vulnerability

Exploit Title : Joomla Board All Version Sql Vulnerability Author : Iranian Security & Research Team Discovered By : Nafsh Home : sec-lab.ir Contact : research at sec-lab dot ir Date : 22/1/2012 - 13:30 Software Link : www.joomla.org Security Risk : High...

NDTV Cross Site Scripting Vulnerabilitiy

Exploit Title : NDTV Cross Site Scripting Vulnerabilitiy Author : Iranian Security & Research Team Discovered By : zilli0o0n Home : sec-lab.ir Contact : research at sec-lab dot ir Software Link : www.ndtv.com DorK : "Copyright NDTV Convergence Limited 2012"...

Arasism Remote Command Upload Vulnerability

Exploit Title : Arasism Remote Command Upload Vulnerability Author : Iranian Security & Research Team Discovered By : Ehram.shahmohamadi Home : sec-lab.ir Contact : research at sec-lab dot ir Portal Link : www.Arasism.Com Security Risk : High DorK : "Powered by Arasism.com"...

7sepehr SQL Injection Vulnerability

Exploit Title : 7sepehr SQL Injection Vulnerability Author : Iranian security & Research Lab Discovered By : Ehram.shahmohamadi Home : sec-lab.ir Contact : research at sec-lab dot ir Portal Link : www.7sepehr.Com Security Risk : High DorK : "Powered by 7sepehr.com"...