ZENphoto 1.4.2 Code Execution / XSS / SQL Injection

Advisory ID: HTB23070 Product: ZENphoto Vendor: www.zenphoto.org Vulnerable Version: 1.4.2 and probably prior Tested Version: 1.4.2 Vendor Notification: 18 January 2012 Vendor Patch: 19 January 2012 Public Disclosure: 8 February 2012 Vulnerability Type: PHP Code Execution, SQL Injection, XSS...

eFront Community++ v3.6.10 - Cross Site Vulnerability

Document Title: =============== eFront Community++ v3.6.10 - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=423 Release Date: ============= 2012-02-07 Vulnerability Laboratory ID VL-ID: ==================================== 423...

Dinama SMS Service Cross Site Scripting

Title: ====== Dinama SMS Service - Persistent Web Vulnerability Date: ===== 2012-02-05 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=417 VL-ID: ===== 417 Introduction: ============= Las soluciones de medios interactivos de DINAMA habilitan la comunicación bidirecciona...

eFronts Community++ 3.6.10 Cross Site Scripting

Title: ====== eFronts Community++ v3.6.10 - Cross Site Vulnerability Date: ===== 2012-02-07 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=423 VL-ID: ===== 423 Introduction: ============= Tailored with larger organizations in mind, eFront Community ++ offers solutions...

eFront Community++ v3.6.10 - Cross Site Vulnerability

Document Title: =============== eFront Community++ v3.6.10 - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=423 Release Date: ============= 2012-02-07 Vulnerability Laboratory ID VL-ID: ==================================== 423...

Cyberoam Central Console v2.x - File Include Vulnerability

Document Title: =============== Cyberoam Central Console v2.x - File Include Vulnerability References: =========== Download: http://www.vulnerability-lab.com/resources/videos/411.wmv View: http://www.youtube.com/watch?v=pGJy2XNugy8 Release Date: ============= 2012-02-07 Vulnerability Laboratory I...

Dolibarr CMS v3.2.0 Alpha - File Include Vulnerabilities

Document Title: =============== Dolibarr CMS v3.2.0 Alpha - File Include Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=428 Release Date: ============= 2012-02-06 Vulnerability Laboratory ID VL-ID: ==================================== 42...

Google Service Reward #1 - ClickJacking Vulnerability

Document Title: =============== Google Service Reward 1 - ClickJacking Vulnerability References: =========== Download: http://www.vulnerability-lab.com/resources/videos/416.wmv View: http://www.youtube.com/watch?v=6N0YS9cTRHw Release Date: ============= 2012-02-06 Vulnerability Laboratory ID VL-I...

HITB2011KUL - Mobile Malware Analysis

Document Title: =============== HITB2011KUL - Mobile Malware Analysis References: =========== Download: http://www.vulnerability-lab.com/resources/videos/424.wmv View: http://www.youtube.com/watch?v=nVAuZ7jf7Sk Release Date: ============= 2012-02-05 Vulnerability Laboratory ID VL-ID:...

OSCommerce 3.0.2 Cross Site Scripting

Title: ====== OSCommerce v3.0.2 - Persistent Cross Site Vulnerability Date: ===== 2012-02-02 VL-ID: ===== 407 Introduction: ============= osCommerce is the leading Open Source online shop e-commerce solution that is available for free under the GNU General Public License. It features a rich set o...

Facebook Game Store - SQL Injection Vulnerability

Document Title: =============== Facebook Game Store - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=408 Release Date: ============= 2012-02-03 Vulnerability Laboratory ID VL-ID: ==================================== 408 Produ...

osCommerce 3.0.2 - Persistent Cross-Site Scripting

osCommerce 3.0.2 - Persistent Cross-Site Scripting Title: ====== OSCommerce v3.0.2 - Persistent Cross Site Vulnerability Date: ===== 2012-02-02 VL-ID: ===== 407 Introduction: ============= osCommerce is the leading Open Source online shop e-commerce solution that is available for free under the G...

OpenEMR 4.1.0 Local File Inclusion / Command Execution

Advisory ID: HTB23069 Product: OpenEMR Vendor: OEMR Vulnerable Version: 4.1.0 and probably prior Tested Version: 4.1.0 Vendor Notification: 11 January 2012 Vendor Patch: 29 January 2012 Public Disclosure: 01 February 2012 Vulnerability Type: Local File Inclusion, Arbitrary Command Execution...

HITB2011KUL - Reverse Engineering Android Malware

Document Title: =============== HITB2011KUL - Reverse Engineering Android Malware References: =========== Download: http://www.vulnerability-lab.com/resources/videos/413.wmv View: http://www.youtube.com/watch?v=22KVTR4mEIk Release Date: ============= 2012-02-02 Vulnerability Laboratory ID VL-ID:...

Facebook Profile Sticker - SQL Injection Vulnerability

Document Title: =============== Facebook Profile Sticker - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=409 Release Date: ============= 2012-02-02 Vulnerability Laboratory ID VL-ID: ==================================== 409...

OSCommerce v3.0.2 - Persistent Cross Site Vulnerability

Document Title: =============== OSCommerce v3.0.2 - Persistent Cross Site Vulnerability References Source: ==================== http://www.cnnvd.org.cn/vulnerability/show/cvid/2012020057 ID: CNNVD-201202-057 Release Date: ============= 2012-02-01 Vulnerability Laboratory ID VL-ID:...

Kelihos Botnet Resurfaces

UPDATE–The Kelihos botnet, which researchers at Kaspersky Lab and Microsoft disrupted last fall by sinkholing the control channel, has sprung back to life and is using only slightly different versions of the original malware and controller list. The rejuvenation of the botnet illustrates the...

Sun Microsystems (Print) - Cross Site Scripting Vulnerability

Document Title: =============== Sun Microsystems Print - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=404 Release Date: ============= 2012-01-31 Vulnerability Laboratory ID VL-ID: ====================================...

Mindjet MindManager 2012 v10.0.493 Multiple Remote Vulnerabilities

Summary An intuitive visual framework that fosters clarity, innovative thinking & communication to improve business results. Description MindManager suffers from several vulnerabilities included into the whole package. Several OCX and DLL libraries from 3rd party software glg.ocx,...

Virtualization: Threats and Protections For SMBs

Join Paul Roberts, Threatpost editor, and his guests, Michael Guigli, CEO of CloudConnect and Tim Armstrong, Malware Researcher at Kaspersky Lab as they discuss Virtualization and the security challenges faced by small businesses. To access your show page for the Threatpost Now! Series, please...