CVE-2014-7951 adb backup archive path traversal file overwrite

ADB backup archive path traversal file overwrite ------------------------------------------------ Using adb one can create a backup of his/her Android device and store it on the PC. The backup archive is based on the tar file format. By modifying tar headers to contain ../../ like patterns it is...

Spybot Search & Destroy 1.6.2 Security Center Service - Privilege Escalation Vulnerability

Exploit for windows platform in category local exploits Spybot Search & Destroy 1.6.2 Security Center Service Privilege Escalation Vendor: Safer-Networking Ltd. Product web page: http://www.safer-networking.org Affected version: 1.6.2 Summary: Spybot – Search & Destroy S&D is a spyware and adware...

JVN#39175666: MP Form Mail CGI eCommerce edition vulnerable to code injection

MP Form Mail CGI eCommerce edition provided by futomi Co., Ltd. is a CGI used to send mail from a web form. MP Form Mail CGI eCommerce edition contains a code injection vulnerability. Impact Arbitrary Perl code may be executed on the server where it resides. Solution Update the software Update to...

Spybot Search And Destroy 1.6.2 Privilege Escalation

Spybot Search & Destroy 1.6.2 Security Center Service Privilege Escalation Vendor: Safer-Networking Ltd. Product web page: http://www.safer-networking.org Affected version: 1.6.2 Summary: Spybot – Search & Destroy S&D is a spyware and adware removal computer program compatible with Microsoft...

Spybot Search Destroy 1.6.2 Security Center Service - Local Privilege Escalation

Spybot Search Destroy 1.6.2 Security Center Service - Local Privilege Escalation Spybot Search & Destroy 1.6.2 Security Center Service Privilege Escalation Vendor: Safer-Networking Ltd. Product web page: http://www.safer-networking.org Affected version: 1.6.2 Summary: Spybot – Search & Destroy...

Spybot Search & Destroy 1.6.2 Security Center Service - Local Privilege Escalation

Spybot Search & Destroy 1.6.2 Security Center Service Privilege Escalation Vendor: Safer-Networking Ltd. Product web page: http://www.safer-networking.org Affected version: 1.6.2 Summary: Spybot – Search & Destroy S&D is a spyware and adware removal computer program compatible with Microsoft...

ElasticSearch Unauthenticated Remote Code Execution Exploit

Exploit for linux platform in category remote exploits !/bin/python2 coding: utf-8 Author: Darren Martyn, Xiphos Research Ltd. Version: 20150309.1 Licence: WTFPL - wtfpl.net import json import requests import sys import readline readline.parseandbind'tab: complete' readline.parseandbind'set...

JVN#14522790: Smartphone Passbook fails to verify SSL server certificates

Smartphone Passbook provided by Ogaki Kyoritsu bank Ltd. fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the information provided by...

Built-In Backdoor Found in Popular Chinese Android Smartphones

Chinese smartphone manufacturers have been criticized many times for suspected backdoors in its products, the popular Chinese smartphone brands, Xiaomi and Star N9500 smartphones are the top examples. Now, the China's third-largest mobile and world's sixth-largest phone manufacturer 'Coolpad', ha...

Threat Outbreak Alert RuleID12757: Email Messages Distributing Malicious Software on December 8, 2014

Medium Alert ID: 36689 First Published: 2014 December 9 16:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID12757 may contain the following files: Name |...

Code injection

SQUARE ENIX Co., Ltd. Kaku-San-Sei Million Arthur before 2.25 for Android stores "product credentials" on the SD card, which allows attackers to gain privileges via a crafted application...

JVN#24909891: Kaku-San-Sei Million Arthur for Android information management vulnerability

Kaku-San-Sei Million Arthur provided by SQUARE ENIX CO., LTD. is a gaming application. Kaku-San-Sei Million Arthur for Android contains an information management vulnerability. Impact Android applications with permissions to read information stored on SD cards may obtain product credentials...

xEpan 1.0.1 - Cross-Site Request Forgery

xEpan 1.0.1 - Cross-Site Request Forgery Advisory ID: HTB23240 Product: xEpan Vendor: Xavoc Technocrats Pvt. Ltd. Vulnerable Versions: 1.0.1 and probably prior Tested Version: 1.0.1 Advisory Publication: October 22, 2014 without technical details Vendor Notification: October 22, 2014 Public...

xEpan 1.0.1 Cross Site Request Forgery Vulnerability

xEpan version 1.0.1 suffers from a cross site request forgery vulnerability. Product: xEpan Vendor: Xavoc Technocrats Pvt. Ltd. Vulnerable Versions: 1.0.1 and probably prior Tested Version: 1.0.1 Advisory Publication: October 22, 2014 without technical details Vendor Notification: October 22, 201...

Zenario CMS 7.0.2d Cross Site Scripting / Open Redirect

Zenario CMS 7.0.2d Reflected XSS and Open Redirect Vulnerabilities Vendor: Tribal Ltd. Product web page: http://www.zenar.io Affected version: 7.0.2d Community Edition Summary: Zenario is a web-based content management system for sites with one or many languages. It is simple to use, and can grow...

Zenario CMS 7.0.2d Reflected XSS and Open Redirect Vulnerabilities

Summary Zenario is a web-based content management system for sites with one or many languages. It is simple to use, and can grow with your requirements. Description Input passed via the 'location' GET parameter in 'index.php' script is not properly verified before being used to redirect users. Th...

File Manager 4.2.10 iOS - Code Execution Vulnerability

No description provided by source. Document Title: =============== File Manager v4.2.10 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1343 Release Date: ============= 2014-10-21 Vulnerability Laboratory ID VL-ID:...

X3 CMS 0.5.1.1 Cross Site Request Forgery / Cross Site Scripting

Product: X3 CMS 0.5.1 & 0.5.1.1 Vendor: X3 CMS Vulnerable Versions: 0.5.1 and 0.5.1.1 Tested Version: 0.5.1.1 Vendor Notification: 2 Nov , 2014 Vendor Patch: 7 Nov, 2014 Advisory Publication: 8 Nov, 2014 Public Disclosure: 8 November , 2014 Vulnerability Type: CSRF + Reflected Cross Site Scriptin...

X3 CMS 0.5.1.1 Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

X3 CMS versions 0.5.1 and 0.5.1.1 suffer from cross site request forgery and cross site scripting vulnerabilities. Product: X3 CMS 0.5.1 & 0.5.1.1 Vendor: X3 CMS Vulnerable Versions: 0.5.1 and 0.5.1.1 Tested Version: 0.5.1.1 Vendor Notification: 2 Nov , 2014 Vendor Patch: 7 Nov, 2014 Advisory...

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting

Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor Notification: 16 July, 2014 Vendor Patch: 15 July, 2014 Public Disclosure: 2 November , 2014 Vulnerability Type:...