Telegram (API) Cross Site Request Forgery

Document Title: =============== Telegram API - Cross Site Request Forgery Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1648 Release Date: ============= 2016-01-17 Vulnerability Laboratory ID VL-ID: ====================================...

Trend Micro Direct Pass - Bypass & Persistent Vulnerability

Document Title: =============== Trend Micro Direct Pass - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1661 Video: http://www.vulnerability-lab.com/getcontent.php?id=1688 Vulnerability Magazine:...

Ipswitch MOVEit Mobile 1.2.0.962 Cross Site Request Forgery

Profundis Labs - Security Advisory Vulnerablity Title ================== MOVEit Filetransfer Cross Site Request Forgery Vulnerability CVE-2015-7678 Vendor: ======= Ipswitch, Inc http://www.ipswitchft.com Product: ======== MOVEit File Transfer MOVEit is an automated file transfer system that lets...

WordPress Plugin Booking Calendar Contact Form 1.1.24 - Multiple Vulnerabilities

Exploit Title: WordPress appointment-booking-calendar =1.1.24 - Privilege escalation Managing calendars & Persistent XSS Date: 2016-01-28 Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/ Exploit Author: Joaquin Ramirez Martinez i0 security-lab Software Link:...

Spotify - CSRF & Privilege Escalation Vulnerability

Document Title: =============== Spotify - CSRF & Privilege Escalation Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1691 Video: https://www.youtube.com/watch?v=4axUu5xUtjM Guest Article:...

Oracle - 'HtmlConverter.exe' Local Buffer Overflow

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ORACLE-HTMLCONVERTER-BUFFER-OVERFLOW.txt Vendor: =============== www.oracle.com Product: ======================================== Java Platform SE 6 U24 HtmlConverter.exe Product Version:...

ntp -- multiple vulnerabilities

Network Time Foundation reports: NTF's NTP Project has been notified of the following low- and medium-severity vulnerabilities that are fixed in ntp-4.2.8p6, released on Tuesday, 19 January 2016: Bug 2948 / CVE-2015-8158: Potential Infinite Loop in ntpq. Reported by Cisco ASIG. Bug 2945 /...

mcart.xls Bitrix Module 6.5.2 - SQL Injection

mcart.xls Bitrix Module 6.5.2 - SQL Injection Advisory ID: HTB23279 Product: mcart.xls Bitrix module Vendor: www.mcart.ru Vulnerable Versions: 6.5.2 and probably prior Tested Version: 6.5.2 Advisory Publication: November 18, 2015 without technical details Vendor Notification: November 18, 2015...

mcart.xls Bitrix Module 6.5.2 - SQL Injection

Exploit for php platform in category web applications Product: mcart.xls Bitrix module Vendor: www.mcart.ru Vulnerable Versions: 6.5.2 and probably prior Tested Version: 6.5.2 Advisory Publication: November 18, 2015 without technical details Vendor Notification: November 18, 2015 Public Disclosur...

Microsoft Internet Explorer NewMessage Protected Mode Sandbox Escape Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

AccessDiver 4.301 Build 5888 Buffer Overflow

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ACCESSDIVER-BUFFER-OVERFLOW.txt Vendor: ============== M. Jean Fages www.accessdiver.com circa 1998-2006 Product: ============================= AccessDiver V4.301 build 5888 AccessDiver is...

Lithium Forum - (previewImages) Persistent Vulnerability

Document Title: =============== Lithium Forum - previewImages Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1520 Release Date: ============= 2015-12-18 Vulnerability Laboratory ID VL-ID: ==================================== 152...

TYPO3 is susceptible to Cross-Site Flashing

It has been discovered, that TYPO3 is susceptible to Cross-Site Flashing Component Type: TYPO3 CMS Release Date: December 15, 2015 Vulnerable subcomponent: Flvplayer Vulnerability Type: Affected Versions: Versions 6.2.0 to 6.2.15 Severity: Medium Suggested CVSS v2.0:...

Western Union CN Bug Bounty #6 - CS XSS Web Vulnerability

Document Title: =============== Western Union CN Bug Bounty 6 - CS XSS Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1657 Release Date: ============= 2015-12-14 Vulnerability Laboratory ID VL-ID: ====================================...

passenger -- client controlled header overwriting

Daniel Knoppel reports: It was discovered by the SUSE security team that it was possible, in some cases, for clients to overwrite headers set by the server, resulting in a medium level security issue. CVE-2015-7519 has been assigned to this issue. Affected use-cases: Header overwriting may occur ...

POP Peeper 4.0.1 - Persistent Code Execution Vulnerability

Document Title: =============== POP Peeper 4.0.1 - Persistent Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1657 Release Date: ============= 2015-11-26 Vulnerability Laboratory ID VL-ID: ====================================...

POP Peeper 4.0.1 - Persistent Code Execution Vulnerability

Document Title: =============== POP Peeper 4.0.1 - Persistent Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1657 Release Date: ============= 2015-11-26 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2015-8027 Denial of Service Vulnerability / CVE-2015-6764 V8 Out-of-bounds Access Vulnerability

CVE-2015-8027 Denial of Service Vulnerability / CVE-2015-6764 V8 Out-of-bounds Access Vulnerability This announcement is for: CVE-2015-8027: a high-impact denial of service vulnerability CVE-2015-6764: a low-impact V8 out-of-bounds access vulnerability CVE-2015-8027 Denial of Service Vulnerabilit...

Traffic CMS 1.4.x Local File Inclusion Vulnerability

Traffic CMS version 1.4.x suffers from a local file inclusion vulnerability. Traffic CMS v1.4.x = Local File Inclusion Vulnerability My + Author : KnocKout Contact : email protected HomePage : http://milw00rm.com - http://h4x0resec.blogspot.com Þeker Insanlar : ZoRLu, milw00rm.com , Septemb0x ,...

wireshark: GSM RLC/MAC dissector infinite loop (wnpa-sec-2015-25)

epan/dissectors/packet-gsmrlcmac.c in the GSM RLC/MAC dissector in Wireshark 1.12.x before 1.12.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service infinite loop via a crafted packet...