CVE-2013-1758

CVE-2013-1758 affects the Marekkis Watermark WordPress plugin (version 0.9.2) and enables cross-site scripting via the pfad parameter to wp-admin/options-general.php. The flaw is a reflective XSS in the admin path, allowing remote attackers to inject arbitrary script/HTML. Public sources consiste...

[ImageCacheViewer] View images in the cache of your Web browser

ImageCacheViewer is a simple tool that scans the cache of your Web browser Internet Explorer, Firefox, or Chrome, and lists the images displayed in the Web sites that you recently visited. For every cached image file, the following information is displayed: URL of the image, Web browser that was...

MGASA-2014-0105 Updated subversion packages fix CVE-2014-0032

Updated subversion packages fix security vulnerability: The moddavsvn module in Apache Subversion before 1.8.8, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service crash via an OPTIONS request CVE-2014-0032. The package has been updated to version 1.8.8, which...

MGASA-2014-0104 Updated subversion packages fix CVE-2014-0032

Updated subversion packages fix security vulnerability: The moddavsvn module in Apache Subversion before 1.8.8, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service crash via an OPTIONS request CVE-2014-0032. The package has been patched to correct this issue...

Dropbox Publishes 2013 Transparency Report

Dropbox yesterday released a new set of principles that explain how it deals with government requests for customer data. The principles were a companion to its 2013 Transparency Report, which for the first time included National Security Letter requests made to the file hosting service. “We belie...

Apache Commons FileUpload and Apache Tomcat - Denial of Service

Apache Commons FileUpload and Apache Tomcat - Denial of Service CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service Author: Oren Hafif, Trustwave SpiderLabs Research This is a Proof of Concept code that was created for the sole purpose of assisting system administrators in...

Apache Commons FileUpload and Apache Tomcat - Denial of Service

CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service Author: Oren Hafif, Trustwave SpiderLabs Research This is a Proof of Concept code that was created for the sole purpose of assisting system administrators in evaluating whether their applications are vulnerable to this...

AmmyAdmin hidden options

Few hidden options allow to use application as a backdoor...

java-1.6.0-openjdk security update

1:1.6.0.1-3.1.13.0 - updated to icedtea 1.13.1 - http://blog.fuseyism.com/index.php/2014/01/23/security-icedtea-1-12-8-1-13-1-for-openjdk-6-released/ - updated to jdk6, b30, 21jan2014 - https://openjdk6.java.net/OpenJDK6-B30-Changes.html - adapted patch7 1.13fixes.patch - pre 2011 changelog moved...

USN-2083-1: Graphviz vulnerabilities

It was discovered that Graphviz incorrectly handled memory in the yyerror function. If a user were tricked into opening a specially crafted dot file, an attacker could cause Graphviz to crash, or possibly execute arbitrary code. CVE-2014-0978, CVE-2014-1235 It was discovered that Graphviz...

PHPJabbers Job Listing Script - Multiple Vulnerabilities

PHPJabbers Job Listing Script - Multiple Vulnerabilities Job Listing Script - Multiple Vulnerabilties ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

PHPJabbers Car Rental Script - Multiple Vulnerabilities

PHPJabbers Car Rental Script - Multiple Vulnerabilities Car Rental Script - Multiple Vulnerabilities ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

subversion -- mod_dav_svn vulnerability

Subversion Project reports: Subversion's moddavsvn Apache HTTPD server module will crash when it receives an OPTIONS request against the server root and Subversion is configured to handle the server root and SVNListParentPath is on. This can lead to a DoS. There are no known instances of this...

CVE-2014-0621

Multiple cross-site request forgery CSRF vulnerabilities in Technicolor formerly Thomson TC7200 STD6.01.12 allow remote attackers to hijack the authentication of administrators for requests that 1 perform a factory reset via a request to goform/system/factory, 2 disable advanced options via a...

Technicolor TC7200多个跨站请求伪造漏洞

CVECAN ID: CVE-2014-0621 Technicolor TC7200是调制解调器和路由器产品。 Technicolor TC7200在实现上存在多个跨站请求伪造漏洞，成功利用后可更改IP过滤选项、防火墙设置等。 0 technicolor TC7200 STD6.01.12 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.technicolor.com/en/solutions-services/connected-home/modems-gatew ays/cable-modems-gatewa...

Technicolor TC7200 - Multiple XSS / CSRF Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: Technicolor TC7200 - Multiple XSS Vulnerabilities Google Dork: N/A Date: 02-01-2013 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.technicolor.com/en/solutions-services/connected-home/modems-gatew...

Technicolor TC7200 - Multiple Cross-Site Request Forgery Vulnerabilities

Exploit Title: Technicolor TC7200 - Multiple CSRF Vulnerabilities Google Dork: N/A Date: 02-01-2013 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.technicolor.com/en/solutions-services/connected-home/modems-gatew ays/cable-modems-gateways/tc7200-tc7300 Software Link: N/A Version:...

Technicolor TC7200 - Multiple Cross-Site Request Forgery Vulnerabilities

Technicolor TC7200 - Multiple Cross-Site Request Forgery Vulnerabilities Exploit Title: Technicolor TC7200 - Multiple CSRF Vulnerabilities Google Dork: N/A Date: 02-01-2013 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage:...

CVE-2013-6992

Cross-site request forgery CSRF vulnerability in askapache-firefox-adsense.php in the AskApache Firefox Adsense plugin 3.0 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the aafireadco...

Technicolor TC7200 Cross Site Request Forgery

Exploit Title: Technicolor TC7200 - Multiple CSRF Vulnerabilities Google Dork: N/A Date: 02-01-2013 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.technicolor.com/en/solutions-services/connected-home/modems-gatew ays/cable-modems-gateways/tc7200-tc7300 Software Link: N/A Version:...