fsmail02.orange.co.uk XSS vulnerability

Vulnerable URL: http://fsmail02.orange.co.uk/webmail/enGB/connexionmultidomainssubmit.html Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 16:16 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

Database Assessment Tool: DbDat

DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is to highlight issues that need...

A comprehensive study of Huawei 3G routers - XSS, CSRF, DoS, unauthenticated firmware update, RCE

Hello, Please find a text-only version below sent to security mailing-lists. The html version on analysing the vulnerabilities in Huawei 3G routers is posted here: https://pierrekim.github.io/blog/2015-10-07-Huawei-routers-vulnerable-to-multiple-threats.html === text-version of the advisory ===...

New Utility Decrypts Files Lost to TeslaCrypt Ransomware

Crypto-ransomware variants have enterprises on edge because of the threat of irreversibly damaged files. Some organizations, including most recently the Tewksbury, Ma., police department have gone as far as to pay hundreds of dollars in ransom for the recovery key. Some technology companies are...

Directory traversal in the back end

Date : 2015-02-12 CVE ID : CVE-2015-0269 Description Arnaud Buchoux with Orange Consulting has discovered a directory traversal vulnerability, which allows logged in back end users to view files outside their file mounts or the document root. It is, however, not possible to edit these files or to...

AOL Advertising Network Abused to Distribute Malware

Security researchers have uncovered a malvertising campaign used to distribute malware to visitors of The Huffington Post website, as well as several other sites, through malicious advertisements served over the AOL advertising network. At the end of last year, Cyphort Labs, security firm...

Sweet Orange Exploit Kit Landing Page

Sweet Orange exploit kit is a web exploit kit that operates by delivering malicious payload to the victim's computer. Remote attackers can infect users with Sweet Orange exploit kit by enticing them to visit a malicious web page. Successful infection will allow the attacker to perform Remote Code...

Israeli Think Tank Compromised to Serve Sweet Orange Exploit Kit

The official website of a prominent Israel-based, Middle East foreign policy-focused think tank, the Jerusalem Center for Public Affairs JCPA, has been compromised and abused by attackers to distribute malware. The Israeli think tank website JCPA – an independent research institute focusing on...

Israeli Think-Tank Site Serves Sweet Orange Exploit

Attackers have compromised the website of a prominent Israel-based, Middle East foreign policy-focused think tank, the Jerusalem Center for Public Affairs JCPA. On Friday, researchers from Cyphort reported that the site was serving the Sweet Orange exploit kit via drive-by download. At the time o...

GoAhead WebServer 2.1.x URL Encoded Slash Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5197/info A vulnerability has been reported for GoAhead WebServer 2.1. Reportedly, it is possible to launch directory traversal attacks against GoAhead WebServer. It is possible for remote attackers to access arbitrary...

Wordpress Orange Themes CSRF File Upload Vulnerability

No description provided by source. Title : Wordpress Orange Themes CSRF File Upload Vulnerability Author : Jje Incovers Date : 01/12/2013 - 17 November 2013 Category : Web Applications Type : PHP Vendor : http://www.orange-themes.com/ Download : http://www.orange-themes.com/portfolio/ Tested :...

Orange Software Orange Web Server 2.1 DoS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2432/info A remote user can cause a denial-of-service condition in Orange Software Orange Web Server. The attacker could submit a specially crafted GET request via a telnet connection to cause the server to crash. A resta...

MS13-055 Microsoft Internet Explorer CAnchorElement Use-After-Free

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

GeekHelps ADMP 1.01 - Multiple Vulnerabilities

No description provided by source. local file include / sql injection Author: ItSecTeam download from:http://geekhelps.net/download.php script:ADMP remote:yes dork::D lfi vul1:/path/themes/colorvoid/footer.php include./themes/$style/info.php; ? line 3 vuls:themes/default-green/footer.php...

French intelligence agency gets complete access to Orange Telecom Data

Another leak from Edward Snowden files, but this time not about the NSA, rather the documents revealed that France's central intelligence agency, the DGSE has complete and unconditional access to all of telecom giant Orange’s data, not just metadata. Yes! It is the same Orange company who...

800,000 Customers' detail stolen in Data Breach at French Telecom 'Orange'

One of the world’s largest mobile operator 'Orange' has been hit by data breach. The French multinational telecommunication company announced recently, it was targeted by unknown hackers on 16th January 2014, who allegedly gained access to the accounts of up to 800,000 customers of Orange website...

CVE-2014-0808

Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request...

CVE-2014-0808

Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request...

CVE-2014-0808

Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request...

PT-2014-3854 · Ec Cube · Ec-Orange +1

Name of the Vulnerable Software and Affected Versions: EC-CUBE versions 2.11.0 through 2.12.2 EC-Orange systems deployed before June 29th, 2015 Description: An issue exists where a user-controlled key can be used to bypass authorization. This can be exploited by sending a crafted HTTP request,...