Siemens Working on Patches for OpenSSL Bugs Under Exploit

Siemens says it is working on patches for four critical vulnerabilities in the OpenSSL libraries it uses in a number of its industrial control products, flaws that are being exploited in the wild. The Industrial Control Systems Cyber Emergency Response Team ICS-CERT cautioned too that critical...

The LZO/LZ4 Integer Overflow Summary

Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4uncompress function in lib/lz4/lz4decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service memory corruption o...

glFusion <= 1.1.2 COM_applyFilter()/order SQL Injection Exploit

No description provided by source. ?php / glFusion = 1.1.2 COMapplyFilter/order sql injection exploit by Nine:Situations:Group::bookoo working against Mysql = 4.1 php.ini independent our site: http://retrogod.altervista.org/ software site: http://www.glfusion.org/ google dork: Page created in...

MSN Messenger 6.2.0137 PNG Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12506/info A remotely exploitable buffer overflow exists in MSN Messenger and Windows Messenger. This vulnerability is related to parsing of Portable Network Graphics PNG image header data. Successful exploitation will...

Wordpress Twitget Plugin 3.3.1 - Multiple Vulnerabilities

No description provided by source. Details ================ Software: Twitget Version: 3.3.1 Homepage: http://wordpress.org/plugins/twitget/ Advisory ID: dxw-1970-435 CVE: CVE-2014-2559 CVSS: 6.4 Medium; AV:N/AC:L/Au:N/C:P/I:P/A:N Description ================ CSRF/XSS vulnerability in Twitget 3.3...

eyeos <= 1.9.0.2 - Stored XSS vulnerability using image files

No description provided by source. Title: eyeOS = 1.9.0.2 Stored XSS vulnerability using image files Product: eyeOS = 1.9.0.2 Author: Alberto Ortega @a0rtega albertoatpentboxdotnet http://securitybydefault.com/ - Summary: A stored XSS vulnerability using image files jpg, png, gif tested affects t...

sap netweaver dispatcher 7.0 ehp1/2 - Multiple Vulnerabilities

No description provided by source. 1. Advisory Information Title: SAP Netweaver Dispatcher Multiple Vulnerabilities Advisory ID: CORE-2012-0123 Advisory URL: http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities Date published: 2012-05-08 Date of last update:...

WordPress Theme My Login 6.3.9 Local File Inclusion

Details ================ Software: Theme My Login Version: 6.3.9 Homepage: http://wordpress.org/plugins/theme-my-login/ Advisory report: https://security.dxw.com/advisories/lfi-in-theme-my-login/ CVE: Awaiting assignment CVSS: 6.5 Medium; AV:N/AC:L/Au:S/C:P/I:P/A:P Description ================...

WordPress Simple Share Buttons Adder 4.4 CSRF / XSS

Details ================ Software: Simple Share Buttons Adder Version: 4.4 Homepage: https://wordpress.org/plugins/simple-share-buttons-adder/ Advisory report: https://security.dxw.com/advisories/csrf-and-stored-xss-in-simple-share-buttons-adder/ CVE: Awaiting assignment CVSS: 5.8 Medium;...

Uzbey: Breach Attack Vulnerability

Breach Attack Vulnerability Respected Sir/Madam I Hope Your Cooperate With Me Cause It's Not Easy To Find Vulnerability On Your Official Website. Vulnerability description This web application is potentially vulnerable to the BREACH attack.An attacker with the ability to: Inject partial chosen...

WordPress JW Player 2.1.2 Cross Site Request Forgery

Details ================ Software: JW Player for Flash & HTML5 Video Version: 2.1.2 Homepage: http://wordpress.org/plugins/jw-player-plugin-for-wordpress/ Advisory ID: dxw-1970-1201 CVE: Awaiting assignment CVSS: 4.3 Medium; AV:N/AC:M/Au:N/C:N/I:N/A:P Description ================ CSRF in JW Playe...

CVE-2013-2014

OpenStack Identity Keystone before 2013.1 allows remote attackers to cause a denial of service memory consumption and crash via multiple long requests...

Microsoft Working on Patch for IE 8 Zero Day

UPDATE–Microsoft officials say they’re well aware of the Internet Explorer 8 zero day disclosed Wednesday by the Zero Day Initiative and have been working on a fix for it. However, there’s no stated timeline for releasing that patch. The vulnerability in IE 8 is a use-after-free bug in the way th...

Another Internet Explorer Zero Day Surfaces

Researchers have disclosed a new zero day vulnerability in Internet Explorer 8 that could enable an attacker to run arbitrary code on vulnerable machines via drive-by downloads or malicious attachments in email messages. The vulnerability was discovered and disclosed to Microsoft in October, but...

Assessing risk for the May 2014 security updates

Today we released eight security bulletins addressing 13 unique CVE’s. Two bulletins have a maximum severity rating of Critical while the other six have a maximum severity rating of Important. The table is designed to help you prioritize the deployment of updates appropriately for your environmen...

New Internet Explorer Zero Day Used in Targeted Attacks

There’s a new zero-day vulnerability in many of the current versions of Internet Explorer and is being used in active attacks right now. The exploit that’s in use has the ability to bypass both DEP and ASLR and researchers say it’s being used by a known APT group. Microsoft has issued an advisory...

WordPress Quick Page/Post Redirect Plugin 5.0.3 CSRF / XSS

WordPress Quick Page/Post Redirect plugin version 5.0.3 suffers from cross site request forgery and cross site scripting vulnerabilities. Details ================ Software: Quick Page/Post Redirect Plugin Version: 5.0.3 Homepage: http://wordpress.org/plugins/quick-pagepost-redirect-plugin/ Adviso...

Twitget 3.3.1 Cross Site Request Forgery / Cross Site Scripting

Twitget version 3.3.1 suffers from cross site request forgery and cross site scripting vulnerabilities. Details ================ Software: Twitget Version: 3.3.1 Homepage: http://wordpress.org/plugins/twitget/ Advisory ID: dxw-1970-435 CVE: CVE-2014-2559 CVSS: 6.4 Medium; AV:N/AC:L/Au:N/C:P/I:P/A...

WordPress Quick Page/Post Redirect Plugin 5.0.3 CSRF / XSS

Details ================ Software: Quick Page/Post Redirect Plugin Version: 5.0.3 Homepage: http://wordpress.org/plugins/quick-pagepost-redirect-plugin/ Advisory ID: dxw-1970-1091 CVE: CVE-2014-2598 CVSS: 6.8 Medium; AV:N/AC:M/Au:N/C:P/I:P/A:P Description ================ CSRF and stored XSS in...

Twitget 3.3.1 Cross Site Request Forgery / Cross Site Scripting

Details ================ Software: Twitget Version: 3.3.1 Homepage: http://wordpress.org/plugins/twitget/ Advisory ID: dxw-1970-435 CVE: CVE-2014-2559 CVSS: 6.4 Medium; AV:N/AC:L/Au:N/C:P/I:P/A:N Description ================ CSRF/XSS vulnerability in Twitget 3.3.1 Vulnerability ================ I...