RelateIQ: RelateIQ GWT based application visible to unauthenticated users

When a legitimate user authenticates to the RelateIQ application, since it is a GWT based application, a request is sent to the URL https://app.relateiq.com/app/app.nocache.js. This detects the browser and then a corresponding request is sent to the URL...

PNG Image Metadata Found Leveraging iFrame Injections

Researchers have discovered a relatively new way to distribute malware that relies on reading JavaScript code stored in an obfuscated PNG file’s metadata to trigger iFrame injections. The technique makes it highly unlikely a virus scanner would catch it because the injection method is so deeply...

Feedburner Hosting Malicious JavaScript Dropper

A sub-domain of Google’s Feedburner RSS management platform is hosting a string of malicious JavaScript embedded with an iFrame, all of which is designed to upload a Trojan onto user machines and redirect visitors to a series of malicious sites. According to a report published by the security fir...

[OMENS v1.17] The framework for distributing Actionable Intelligence

OMENS Object Monitor for Enhanced Network Security was born out of the intrusion and intrusion attempts analysis that I have been doing over many years. I consistently run into intrusion attempts that existing IDS systems have difficulty detecting. OMENS is my attempt to better detect and...

TP-Link Cross Site Request Forgery Vulnerability

This write up goes into detail about how real world cross site request forgery attacks can be used to hijack DNS on TP-Link routers. I. Introduction Today the majority of wired Internet connections is used with an embedded NAT router, which allows using the same Internet connection with several...

Unnamed Android Vulna Ad Library Abused to Steal User Data

A popular Android mobile ad library available on Google Play can be used to collect device data or execute malicious code, security researchers have discovered. The most alarming aspect to the library is that close to 2 percent of Android apps with more than 1 million downloads on Google Play use...

OpenX Backdoor PHP Code Execution Vulnerability

OpenX Ad Server version 2.8.10 was shipped with an obfuscated backdoor since at least November 2012 through August 2013. Exploitation is simple, requiring only a single request with a rot13'd and reversed payload. This file is part of the Metasploit Framework and may be subject to redistribution...

Private Photos 1.0 Script Insertion

Title: ====== Private Photos v1.0 iOS - Persistent Path Web Vulnerability Date: ===== 2013-07-25 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1034 VL-ID: ===== 1034 Common Vulnerability Scoring System: ==================================== 3.5 Introduction:...

Linux/x86 - execve(/bin/sh) + Obfuscated Shellcode (30 bytes)

Linux/x86 - execve/bin/sh + Obfuscated Shellcode 30 bytes. Shellcode exploit for Linuxx86 platform / Title : Obfuscated execve /bin/sh 30 bytes Date : 3rd July 2013 Author : Russell Willis System : Linux/x86 SMP Debian 3.2.41-2 i686 To build: gcc -fno-stack-protector -z execstack -o shellcode...

[Weevely] PHP Stealth Tiny Web Shell

Weevely is a stealth PHP web shell that provides a telnet-like console. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones. Weevely is currently included in Backtrack and Backbox...

Sparx Systems Enterprise Architect 9.3.931 Corporate Password Disclosure

Subject ======= Simple password obfuscation in Sparx Systems "Enterprise Architect" when using server based repositories Affected product ================ Product: Enterprise Architect Vendor: Sparx Systems Affected versions ================= Tested with 9.3.931 Corporate, other versions likely t...

Fake Automated Craigslist Email Notifications Link to Blackhole Exploit Kit

UPDATE: A big wave of emails purporting to be Craigslist notifications but containing links to websites hosting the Black Hole exploit kit hit the Internet yesterday, a day that already was filled with drama surrounding the LinkedIn password dump. The malicious emails, 150,000 of which were caugh...

Attackers Using Fake Google Analytics Code to Redirect Users to Black Hole Exploit Kit

Injecting malicious code into the HTML used on legitimate Web sites is a key part of the infection lifecycle for many attack crews, and they often disguise and obfuscate their code to make it more difficult to analyze or so it appears to be legitimate code. The latest instance of this technique h...

New Clickjacking Scam Uses Facebook, Javascript, Our Primate Brain To Spread

A researcher at Kaspersky Lab is warning of a new scam that pastes racy photos to victims’ Facebook pages while forcing them to view Web-based advertisements promoted by the scammers. Writing on the Securelist blog, Kaspersky Lab Expert David Jacoby said that the scam was circulating among Facebo...

VMware vFabric tc Server JMX Authentication Security Bypass Vulnerability

The host is running VMware vFabric tc Server and is prone to security bypass vulnerability. OpenVAS Vulnerability Test $Id: secpodvmwarevfabrictcserversecuritybypassvuln.nasl 7052 2017-09-04 11:50:51Z teissa $ VMware vFabric tc Server JMX Authentication Security Bypass Vulnerability Authors: Soor...

VMware vFabric tc Server 2.x JMX Authentication Security Bypass Vulnerability

VMware vFabric tc Server is prone to a security bypass vulnerability. Copyright C 2011 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2011-0527: VMware vFabric tc Server password obfuscation bypass

Severity: Important Versions Affected: 2.0.0.RELEASE to 2.0.5.SR01 2.1.0.RELEASE to 2.1.1.SR01 Description: tc Server allows users to store the passwords used for JMX authentication in an obfuscated form for organizations where storing passwords in plain text is not permitted. The JMX...

CVE-2011-0527

VMware vFabric tc Server aka SpringSource tc Server 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for context-dependent attackers to obtain access by leveraging an ability to read stored passwords...

Design/Logic Flaw

VMware vFabric tc Server aka SpringSource tc Server 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for context-dependent attackers to obtain access by leveraging an ability to read stored passwords...

CVE-2011-0527

VMware vFabric tc Server aka SpringSource tc Server 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for context-dependent attackers to obtain access by leveraging an ability to read stored passwords...