Good for Enterprise 2.2.2.1611 - XSS Vulnerability

Exploit for hardware platform in category web applications The vulnerable versions are v2.2.2.1611 and earlier Proof of Concept: HTML Email including the following payload will execute Javascript statements when the victim open the email using the vulnerable version. Payload: alert'XSS Here'...

Good for Enterprise 2.2.2.1611 - Cross-Site Scripting

The vulnerable versions are v2.2.2.1611 and earlier Proof of Concept: HTML Email including the following payload will execute Javascript statements when the victim open the email using the vulnerable version. Payload: alert'XSS Here' Remediation: I worked with the Good people to close the issue, ...

User invite functionality available to non-admins

The REST API which manages user invites ensures that only adminstrators can generate a new invite token. However, no similar access controls are present on the methods which are used to invite new users, or to revert to the previous security token – these can be successfully called by any...

kernel: block: passing disk names as format strings

Format string vulnerability in the registerdisk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/mdmod/parameters/newarray in order to create a crafted /dev/md device nam...

Oracle Updates Java 7

Oracle released on Tuesday the Java standard edition version 7 update 40. Java 7u40 includes fixes for a long list of bugs and a number of new features as well. The most notable security patch appears to be a fix for a plugin deployment bug that failed to block expired certificates for users that...

Fedora 18 : fedora-business-cards-1-0.1.beta1.fc18 (2013-0416)

Provides a slew of enhancements to fedora-business-cards, including dynamic creation of the card to a given size, new fonts, and an almost-completely redone backend. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenabl...

John CMS 5.1 Cross Site Scripting

Exploit Title : JohnCMS 5.1 Persistent XSS Vulnerability Author : DevilScreaM Date : 08/09/2013 Category : Web Applications Vendor : http://johncms.com/ Product Link : http://johncms.com/download/?cat=481 Version : 1.0 - 5.1 Dork intext:Powered by JohnCMS Vulnerability : Persistent XSS...

FBI Cyber Division put 'Syrian Electronic Army' Hackers in wanted list

The Syrian Electronic Army SEA, a pro-regime hacker group that emerged during Syrian anti-government protests in 2011, and involved in cyber attacks against western media organizations are now in the FBI's wanted list. The Federal Bureau of Investigation has issued an alert warning of cyber attac...

Dennis Fisher and Mike Mimoso Discuss the NYT Attack, News of the Week

Dennis Fisher and Mike Mimoso discuss the big stories of the last couple of weeks, including the Syrian Electronic Army’s attacks against the registrar for the New York Times and Twitter, and the release of Facebook’s first transparency report. Download: digitalunderground124 Subscribe to the...

CVE-2013-5645

Multiple cross-site scripting XSS vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in 1 new or 2 draft mode, related to compose.inc; and 3 might allow remote authenticated users to injec...

[Process Magic v2.0] Command-line Tool to Hide Windows Application or Launch New Process in Hidden Mode

Process Magic is the command-line tool to Hide any Windows application or launch new application in Hidden or Invisible mode. In addition to hiding any Windows process, it also allows you to Unhide any previously Hidden application. Note that it hides the application by hiding its main window. So...

Cross site scripting

Cross-site scripting XSS vulnerability in the Hatch theme 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with the "Administer content," "Create new article," or "Edit any article type content" permission to inject arbitrary web script or HTML via unspecified vectors...

Opera 16 Fixes Bugs, Improves HTML5 Performance

Norwegian software company Opera pushed out version 16 of its eponymous Internet browser this week, complete with what it’s calling “tons of bug fixes,” improved performance and a slew of new features and APIs. While the full changelog hasn’t been published yet, Ruarí Ødegaard, a member of Opera’...

CVE-2013-4138

Cross-site scripting XSS vulnerability in the Hatch theme 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with the "Administer content," "Create new article," or "Edit any article type content" permission to inject arbitrary web script or HTML via unspecified vectors...

New York Times, Twitter and Huffington Post Domains hijacked by Syrian Electronic Army

Media companies including the New York Times, Twitter and the Huffington Post has been unavailable since Tuesday after the external malicious attack by a group of hackers supporting Syrian President Bashar Assad. For the second time this month, the New York Times' website has gone down. "The New...

Syrian Electronic Army Hack Results in Compromise of Domain Data For NY Times, Twitter

The Syrian Electronic Army, a group known for attacking high-profile media sites in the last year or so, has in the last few hours compromised the domain information for a large number of sites, including the New York Times home page and some of Twitter’s domains. Security researchers say that th...

[oclHashcat-plus v0.15] Advanced Password Recovery

This version is the result of over 6 months of work, having modified 618,473 total lines of source code. Before we go into the details of the changes, here's a quick summary of the major changes: Added support for cracking passwords longer than 15 characters Added support for mask-files, which...

DEBIAN-CVE-2013-4205

Memory leak in the unshareuserns function in kernel/usernamespace.c in the Linux kernel before 3.10.6 allows local users to cause a denial of service memory consumption via an invalid CLONENEWUSER unshare call...

UBUNTU-CVE-2013-4205

Memory leak in the unshareuserns function in kernel/usernamespace.c in the Linux kernel before 3.10.6 allows local users to cause a denial of service memory consumption via an invalid CLONENEWUSER unshare call...

Aumlib, Ixeshe Malware Updated in Targeted China Attacks

After a quiet period, the state-sponsored hacker group blamed for attacks on the New York Times late last year has begun a number of new campaigns that feature updated versions of malware used in attacks going back to 2009. Researchers at FireEye said the group, identified as APT 12 by forensics...