Critical Persistent Injection Vulnerability in Apple App Store and iTunes

A critical vulnerability has been discovered in the official Apple’s App Store and iTunes Store, affecting millions of Apple users. Vulnerability-Lab Founder and security researcher Benjamin Kunz Mejri discovered an Application-Side input validation web vulnerability that actually resides in the...

CVE-2015-2863

Open redirect vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Open redirect

Open redirect vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2015-2863

Open redirect vulnerability in Kaseya Virtual System Administrator VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2015-2863

Kaseya Virtual System Administrator (VSA) Open Redirect (CVE-2015-2863) affects VSA 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4. An attacker can redirect users to arbitrary sites to facilitate phishing via unspecified vectors. Remediation per sources: app...

New Campaign Targeting Japanese with Hacking Team Zero Day

Yet another group of attackers has quickly cashed in on one of the Adobe Flash zero days uncovered in the HackingTeam leak and is leveraging it to target Japanese organizations. Last week researchers determined that attackers were able to compromise two Japanese websites, the country’s...

CVE-2015-4529

Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to redirect users to arbitrary w...

CVE-2015-4529

This CVE (CVE-2015-4529) covers an open redirect vulnerability in EMC Documentum client/server components, including WebTop (before 6.8P02), Administrator (before 7.2P01), Digital Assets Manager (through 6.5SP6), Web Publishers (through 6.5SP7), and Task Space (through 6.7SP2). The underlying iss...

CVE-2015-5461

Open redirect vulnerability in the Redirect function in stageshowredirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter...

Open redirect

Open redirect vulnerability in the Redirect function in stageshowredirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter...

CVE-2015-5461

The CVE-2015-5461 entry maps to WordPress StageShow plugin prior to 5.0.9, which contains an open redirect vulnerability in the Redirect function (stageshow_redirect.php). A malicious URL in the url parameter can redirect users to arbitrary sites, enabling phishing attempts. Nuclei/WP template de...

CVE-2014-9737

Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block...

Open redirect

Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block...

CVE-2015-5354

Open redirect vulnerability in Novius OS 5.0.1 Elche allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login...

Cross site scripting

Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the href parameter to page/place.html. NOTE: this was originally reported as a...

CVE-2014-1750

Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the href parameter to page/place.html. NOTE: this was originally reported as a...

CVE-2014-1750

CVE-2014-1750 affects the Nokia Maps & Places WordPress plugin (version up to 1.6.6). The vulnerability is an open redirect via the href parameter to page/place.html, enabling an attacker to redirect users to arbitrary sites and potentially facilitate phishing. Some sources also reference XSS, bu...

Pinterest Fixes Validation Vulnerability in API

Pinterest recently fixed an issue in the API of its web app that could have allowed remote attackers to compromise emails and carry out session hijacking and phishing attacks. Vulnerability Lab researcher Benjamin Kunz Mejri discovered the issue, which is a persistent mail encoding and validation...

Pinterest Bug Bounty #1 - Persistent CNAME Vulnerability

Document Title: =============== Pinterest Bug Bounty 1 - Persistent CNAME Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1431 Release Date: ============= 2015-06-30 Vulnerability Laboratory ID VL-ID: ==================================== 14...

CVE-2015-0127

CVE-2015-0127 affects IBM Leads (multiple versions: 7.x; 8.1.0 up to 8.1.0.14; 8.2; 8.5.0 up to 8.5.0.7.3; 8.6.0 up to 8.6.0.8.1; 9.0.0 up to 9.0.0.4; 9.1.0 up to 9.1.0.6.1; 9.1.1 up to 9.1.1.0.2). The root cause is improper restriction of FRAME elements, enabling remote authenticated users to co...