ADICO CMS 1.1 Blind SQL Injection

Title: ====== ADICO CMS v1.1 - Blind SQL Injection Vulnerability Date: ===== 2012-05-29 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=582 VL-ID: ===== 582 Common Vulnerability Scoring System: ==================================== 8.3 Introduction: ============= ADICO i...

Freeside SelfService CGI|API 2.3.3 - Multiple Vulnerabilities

Document Title: =============== Freeside SelfService CGI|API 2.3.3 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=614 Release Date: ============= 2012-06-13 Vulnerability Laboratory ID VL-ID: ==================================...

Apple iTunes 10.6.1.7 - .m3u Walking Heap Buffer Overflow (PoC)

Apple iTunes 10.6.1.7 - .m3u Walking Heap Buffer Overflow PoC !/usr/bin/perl Apple iTunes 10.6.1.7 M3U Playlist File Walking Heap Buffer Overflow Vendor: Apple Inc. Product web page: http://www.apple.com Affected version: 10.6.1.7 and 10.6.0.40 Summary: iTunes is a free application for your Mac o...

Apple iTunes 10.6.1.7 - '.m3u' Walking Heap Buffer Overflow (PoC)

!/usr/bin/perl Apple iTunes 10.6.1.7 M3U Playlist File Walking Heap Buffer Overflow Vendor: Apple Inc. Product web page: http://www.apple.com Affected version: 10.6.1.7 and 10.6.0.40 Summary: iTunes is a free application for your Mac or PC. It lets you organize and play digital music and video on...

Attorney General Holder Announces Probe Into Cyberwar Leaks

U.S. Attorney General Eric Holder has issued an assignment to the U.S. District Attorneys to start an investigation into possible leaks of classified information, presumably by individuals within the Obama administration who recently spoke anonymously about the administration’s ties to the...

Inout Mobile Webmail - Multiple Web Vulnerabilities

Document Title: =============== Inout Mobile Webmail - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=609 Release Date: ============= 2012-06-08 Vulnerability Laboratory ID VL-ID: ==================================== 609...

pyrocms 2.1.1 - Multiple Vulnerabilities

pyrocms 2.1.1 - Multiple Vulnerabilities PyroCMS 2.1.1 CRLF Injection And Stored XSS Vulnerability Vendor: HappyNinjas Ltd Product web page: http://www.pyrocms.com Affected version: 2.1.1 Community Summary: PyroCMS is a CMS built using the CodeIgniter PHP framework. Using an MVC architecture it w...

pyrocms 2.1.1 - Multiple Vulnerabilities

PyroCMS 2.1.1 CRLF Injection And Stored XSS Vulnerability Vendor: HappyNinjas Ltd Product web page: http://www.pyrocms.com Affected version: 2.1.1 Community Summary: PyroCMS is a CMS built using the CodeIgniter PHP framework. Using an MVC architecture it was built with modularity in mind...

Six Additional Carberp Scammers Arrested For Stealing $3.67m

Six more members of the Carberp gang have been arrested, according reports from the Russian Interior Ministry. Working with the firm Group-IB, authorities arrested six individuals affiliated with the Carberp and Hodprot malware. The group is alleged to have been responsible for thefts from client...

PyroCMS 2.1.1 CRLF Injection / Stored Cross Site Scripting

PyroCMS 2.1.1 CRLF Injection And Stored XSS Vulnerability Vendor: HappyNinjas Ltd Product web page: http://www.pyrocms.com Affected version: 2.1.1 Community Summary: PyroCMS is a CMS built using the CodeIgniter PHP framework. Using an MVC architecture it was built with modularity in mind...

PyroCMS 2.1.1 CRLF Injection / Stored Cross Site Scripting

Exploit for php platform in category web applications PyroCMS 2.1.1 CRLF Injection And Stored XSS Vulnerability Vendor: HappyNinjas Ltd Product web page: http://www.pyrocms.com Affected version: 2.1.1 Community Summary: PyroCMS is a CMS built using the CodeIgniter PHP framework. Using an MVC...

Keylogging Version of Anti-Censorship Software Simurgh Found

Citizen Lab found a compromised version of an anti-censorship tool that’s popular in Iran and Syria circulating with a backdoor installed. The software, Simurgh, is described by Citizen Lab as a stand-alone proxy software for Microsoft Windows users. It was used predominantly by Iranians in the...

DHS Says No Evidence That Flame Targets Industrial Systems, But Urges Caution

In and advisory, the Department of Homeland Security’s Industrial control System ICS CERT said that it doesn’t believe the Flame malware targets industrial control systems ICS or SCADA systems, but the group advised critical infrastructure owners to be on alert. The advisory, issued Wednesday,...

Sony VAIO Wireless Manager 4.0.0.0 Buffer Overflows

Exploit for hardware platform in category dos / poc Product: Wireless Manager Sony VAIO Vendor: Sony Computers Vulnerable Versions: 4.0.0.0 and probably prior Tested Version: 4.0.0.0 Vendor Notification: 7 December 2011 Vendor Patch: 20 January 2012 Public Disclosure: 30 May 2012 Vulnerability...

Multiple vulnerabilities in web@all

High-Tech Bridge Security Research Lab has discovered multiple vulnerabilities in web@all, which can be exploited to perform Сross-Site Request Forgery CSRF and Cross-Site Scripting XSS attacks. 1 Сross-Site Request Forgery CSRF in web@all: CVE-2012-3231 1.1 The application allows authorized...

ADICO CMS v1.1 - Blind SQL Injection Vulnerability

Document Title: =============== ADICO CMS v1.1 - Blind SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=582 Release Date: ============= 2012-05-28 Vulnerability Laboratory ID VL-ID: ==================================== 582 Comm...

Pligg CMS 1.2.1 Cross Site Scripting / Local File Inclusion

Advisory ID: HTB23089 Product: Pligg CMS Vendor: Pligg, LLC. Vulnerable Versions: 1.2.1 and probably prior Tested Version: 1.2.1 Vendor Notification: 25 April 2012 Vendor Patch: 18 May 2012 Public Disclosure: 23 May 2012 Vulnerability Type: Local File Inclusion, Cross-Site Scripting XSS CVE...

pragmaMx 1.12.1 Cross Site Scripting

Advisory ID: HTB23090 Product: pragmaMx Vendor: pragmaMx Team Vulnerable Versions: 1.12.1 and probably prior Tested Version: 1.12.1 Vendor Notification: 2 May 2012 Vendor Patch: 4 May 2012 Public Disclosure: 23 May 2012 Vulnerability Type: Cross-Site Scripting XSS CVE Reference: CVE-2012-2452...

Months After A Patch, Targeted Attacks Still Using Adobe Flash Bug

More than three months after it was patched, attackers are still using a vulnerability in Adobe’s Flash product in targeted, ‘APT-style’ attacks. The vulnerability, identified as CVE-2012-0754 was patched in February and linked to targeted attacks weeks later. But new attacks targeting unpatched...

DVD-Lab Studio 1.25 DAL File Open Crash

Exploit for windows platform in category dos / poc DVD-Lab Studio 1.25 DAL File Open Crash =================================================================================== Exploit Title:DVD-Lab Studio 1.25 Malicious DAL File Denial of service Download...