CVE-2012-5695

Multiple cross-site request forgery CSRF vulnerabilities in Bulb Security Smartphone Pentest Framework SPF 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct 1 shell metacharacter or 2 SQL injection attacks or 3 send an SMS message...

CVE-2012-5697

The btinstall installation script in Bulb Security Smartphone Pentest Framework SPF before 0.1.3 uses weak permissions 777 for all files in the frameworkgui/ directory, which allows local users to obtain sensitive information or inject arbitrary Perl code via direct access to these files...

CVE-2012-5694

Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework SPF before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the 1 agentPhNo, 2 controlPhNo, 3 agentURLPath, 4 agentControlKey, or 5 platformDD1 parameter to frameworkgui/attach2Agents.pl; the 6...

CVE-2012-5697

CVE-2012-5697 relates to the Smartphone Pentest Framework (SPF) web GUI in frameworkgui/, where the btinstall script sets world-writable permissions (777) on all files. This permits a local attacker to read sensitive files and potentially inject arbitrary Perl code via direct access to the files,...

CVE-2012-5696

This entry corresponds to CVE-2012-5696 in the Smartphone Pentest Framework (SPF). Documentation confirms SPF before 0.1.3 vulnerable to improper access control via the /frameworkgui/config path, allowing remote attackers to obtain the plaintext database password. The connected advisory details m...

CVE-2012-5694

CVE-2012-5694 concerns multiple SQL injection flaws in the Smartphone Pentest Framework (SPF) web GUI, specifically in the frameworkgui/ directory. The linked HTB23123 advisory enumerates affected scripts and parameters (attach2Agents.pl, attachMobileModem.pl, escalatePrivileges.pl, getContacts.p...

Parallels Plesk 11.5.x - URL Protection Filter Bypass

Document Title: =============== Parallels Plesk 11.5.x - URL Protection Filter Bypass References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1331 View: https://www.youtube.com/watch?v=mjkWIFNJ2Sw Release Date: ============= 2014-10-13 Vulnerability Laboratory ID VL-ID:...

Microsoft Yammer - Bypass & Persistent Vulnerabilities

Document Title: =============== Microsoft Yammer - Bypass & Persistent Vulnerabilities References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1330 View: https://www.youtube.com/watch?v=0w8S3uryeII Advisory: http://www.vulnerability-lab.com/getcontent.php?id=976 Release Date:...

Microsoft Yammer - Bypass & Persistent Vulnerabilities

Document Title: =============== Microsoft Yammer - Bypass & Persistent Vulnerabilities References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1330 View: https://www.youtube.com/watch?v=0w8S3uryeII Advisory: http://www.vulnerability-lab.com/getcontent.php?id=976 Release Date:...

Yahoo! Messenger v11 - Bypass & Persistent Vulnerability

Document Title: =============== Yahoo! Messenger v11 - Bypass & Persistent Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1279 Video: https://www.youtube.com/watch?v=kDdg6O5vGCY Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1136 Release Dat...

Yahoo! Messenger v11 - Bypass & Persistent Vulnerability

Document Title: =============== Yahoo! Messenger v11 - Bypass & Persistent Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1279 Video: https://www.youtube.com/watch?v=kDdg6O5vGCY Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1136 Release Dat...

Quack Chat 1.0 - Multiple Vulnerabilities

No description provided by source. Exploit Title: Quack Chat 1.0 - XSS / SQL Injection / Path Diclosure Date: 15 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.quack-chat.com/ Tested on: Win8 & Linux Mint Affected Version : 1.0...

Hostscan - PHP tool for scanning specific range of hosts

Hostscan is a php tool which allows you to scan specific range of hosts, mostly for information gathering and testing for weak passwords. I guess it's a pentest tool, i'd created it to automate some tests that i often do. Since it's PHP, it works quite slowly compared to client-side soft. How it...

C2FO: c2fo.com is releasing sensitive Information about Database Configuration.

Hello C2FO Securiity Team, Vulnerability Details : Disclosure of Database Username and Password of c2fo.com Description: Your configuration file of your website is available to download from your website c2fo.com.When i thought to pentest your site,i landed on https://c2fo.com .But instead of...

RFP - External Network Vulnerability Assessment & PenTest

Document Title: =============== RFP - External Network Vulnerability Assessment & PenTest References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1225 Download: http://www.vulnerability-lab.com/resources/documents/RFP-BoMPLC-2014.pdf Release Date: ============= 2014-03-13...

RFP - External Network Vulnerability Assessment & PenTest

Document Title: =============== RFP - External Network Vulnerability Assessment & PenTest References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1225 Download: https://www.vulnerability-lab.com/resources/documents/RFP-BoMPLC-2014.pdf Release Date: ============= 2014-03-13...

[FS-NyarL] A network takeover & forensic analysis tool

NyarL it's Nyarlathotep, a mitological chaotic deity of the writer HP. Lovecraft's cosmogony. It's represent Crawling Chaos and FS-NyarL it's The Crawling Chaos of Cyber Security :- A network takeover & forensic analysis tool - useful to advanced PenTest tasks & for fun and profit - but use it at...

Penetration Testing Browser Bundle: PenQ

PenQ is an open source, Linux-based penetration testing browser bundle we built over Mozilla Firefox. It comes pre-configured with security tools for spidering, advanced web searching, fingerprinting, anonymous browsing, web server scanning, fuzzing, report generating and more. Penetration Testin...

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities Exploit Title: Hotel Software and Booking system 1.8 - SQL Injection / Cross Site Scripting Date: 21 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.cbhotel.eu/...

Quack Chat 1.0 - Multiple Vulnerabilities

Exploit Title: Quack Chat 1.0 - XSS / SQL Injection / Path Diclosure Date: 15 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.quack-chat.com/ Tested on: Win8 & Linux Mint Affected Version : 1.0 Contacts: https://twitter.com/Dylanirzi11...