[Onapsis Security Advisory 2013-003] SAP Enterprise Portal Cross-Site-Scripting

Onapsis Security Advisory 2013-003: SAP Enterprise Portal Cross-Site-Scripting This advisory can be downloaded in PDF format from http://www.onapsis.com/. By downloading this advisory from the Onapsis Resource Center, you will gain access to beforehand information on upcoming advisories,...

[CVE-2013-1636]Wordpress pretty-link plugin XSS in SWF‏

Exploit Title: Wordpress pretty-link plugin XSS in SWF Release Date: 20/02/13 Author: hip Insight-Labs Contact: [email protected] | Website: http://insight-labs.org Software Link: http://downloads.wordpress.org/plugin/pretty-link.1.6.3.zip Vendor Homepage: http://prettylinkpro.com/ Tested on:...

OSEC-2013-01: nagios metacharacter filtering omission

Exploit Title: Wordpress pretty-link plugin XSS in SWF Release Date: 20/02/13 Author: hip Insight-Labs Contact: [email protected] | Website: http://insight-labs.org Software Link: http://downloads.wordpress.org/plugin/pretty-link.1.6.3.zip Vendor Homepage: http://prettylinkpro.com/ Tested on:...

[CVE-2013-1464]Wordpress Audio Player Plugin XSS in SWF‏‏

Exploit Title: Wordpress Audio Player Plugin XSS in SWF Release Date: 31/01/13 Author: hip Insight-Labs Contact: [email protected] | Website: http://insight-labs.org Software Link: http://downloads.wordpress.org/plugin/audio-player.2.0.4.6.zip Vendor Homepage: http://wpaudioplayer.com/ Tested...

Predictive Security Analytics Tool Available Free to Researchers

SAN JUAN, Puerto Rico – Dan Hubbard has lately been a regular face at a lot of big data meet-ups. He’s also often been the lone security face at these meet-ups, which are dominated by analytics, search, social media and advertising professionals. That may change soon for the CTO of DNS and securi...

WordPress WP-Table-Reloaded Cross Site Scripting

Exploit Title: Wordpress wp-table-reloadedþ plugin cross-site scripting in SWF Release Date: 24/01/13 Author: hip Insight-Labs Contact: [email protected] | Website: http://insight-labs.org Software Link: http://downloads.wordpress.org/plugin/wp-table-reloaded.latest-stable.zip Vendor Homepage:...

CVE-2013-1402 - DigiLIBE Management Console - Execution After Redirect (EAR) Vulnerability

Product: DigiLIBE Management Console Vendor: Digitiliti Version: 3.4 - ? Tested Version: 3.4 Vendor Notified Date: October 09, 2012 Release Date: January 18, 2013 Risk: High Authentication: None required Remote: Yes Description: Execution After Redirect vulnerabilities exist in DigiLIBE Managemen...

Paypal Bug Bounty #20 - Persistent Web Vulnerabilities

Document Title: =============== Paypal Bug Bounty 20 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=682 PayPal UID: fxv444khi Release Date: ============= 2013-01-24 Vulnerability Laboratory ID VL-ID:...

RHEL 5 : scsi-target-utils (RHSA-2010:0518)

An updated scsi-target-utils package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Nexpose Security Console - Cross-Site Request Forgery

Nexpose Security Console - Cross-Site Request Forgery Product: Nexpose Security Console Vendor: Rapid7 Version: //document.forms0.submit; //uncomment to auto-submit /code 2. Lure victim to http://attackersite.com/nexpose-csrf.htm. 3. Site with ID 1 is deleted when form is submitted. V...

CVE-2012-6493 - Nexpose Security Console - Cross-Site Request Forgery (CSRF)

Product: Nexpose Security Console Vendor: Rapid7 Version: 5.5.3 Tested Version: 5.5.1 Vendor Notified Date: December 19, 2012 Release Date: January 2, 2013 Risk: High Authentication: None required Remote: Yes Description: Multiple Cross-Site Request Forgery CSRF vulnerabilities in Nexpose Securit...

gdb (GNU debugger) <= 7.5.1 NULL Pointer Dereference

Exploit for linux platform in category dos / poc / gdb GNU debugger = 7.5.1 crash due a NULL pointer dereference ELF anti-debugging/reversing patcher Published @ IOActive Labs Research blog: http://blog.ioactive.com/2012/12/striking-back-gdb-and-ida-debuggers.html - nitr0us...

Report Contends 'Project Blitzkrieg' Threat Credible

Earlier reports of a planned, sophisticated attack on 30 U.S. banks to siphon millions from fake wire transfers have been vetted by McAfee Labs in a just-released report. Speculation about the authenticity of the planned attack, dubbed Project Blitzkrieg, on large U.S. financial institutions...

Kelihos Update Includes New TLD and USB Infection Capabilities

There’s a little Michael Myers in the Kelihos botnet; maim it, kill it and it keeps on coming back to wreak more havoc. The 2011 takedown of the Kelihos botnet was one of Microsoft’s high-profile success stories against spambots and the like, yet Kelihos was back for more at the start of 2012 usi...

SilverStripe CMS 3.0.2 Cross Site Request Forgery / Cross Site Scripting

Sense of Security - Security Advisory - SOS-12-011 Release Date. 30-Nov-2012 Last Update. - Vendor Notification Date. 29-Oct-2012 Product. SilverStripe CMS Platform. Windows Affected versions. 3.0.2 Severity Rating. Medium Impact. Privilege escalation, cross-site scripting Attack Vector. From...

Bloomberg's Businessweek website infected with Malware

On a quick tip from a The Hacker News reader - Travis, we came to know about that some antivirus giving warning when readers try to visit Bloomberg's Businessweek website businessweek.com that the site is infected with malware and trying to drop a malware on visitor's system. Website having very...

Beware of Fake-Antivirus "Win 8 Security System"

Late in August McAfee Labs discovered a Fake Antivirus program that claims to detect infections, and displays alerts to scare users into purchasing protection. On the contrary, this program is not genuine software and has nothing to do with reliable and effective AV tools. The truth is that this ...

Penetration Testing Frequently Asked Questions

You may have noticed this recent article about Googles contest that rewarded a hacker for discovering a vulnerability in Chrome. Once Google verified the vulnerability, they were able to fix the bug and issue the cash prize to the hacker. This is a very public example similar to what Coalfire Lab...

IT Security Horror Stories: Truth is Scarier Than Fiction

At Coalfire Labs, we discover--and help our clients address--some pretty scary security and compliance problems. Everyones heard of blood-sucking cyber criminals looking for vulnerable IT systems. Even when organizations have protections in place, these monsters just wont give up. Their appetite ...

FileBound 6.2 - Local Privilege Escalation

Sense of Security - Security Advisory - SOS-12-010 Release Date. 10-Oct-2012 Last Update. - Vendor Notification Date. 14-Aug-2012 Product. FileBound On-Site Platform. Windows Affected versions. All versions prior to 6.2 Severity Rating. High Impact. Privilege escalation Attack Vector. From remote...