Orbit Open Ad Server 1.1.0 SQL Injection Vulnerability

Orbit Open Ad Server version 1.1.0 suffers from a remote SQL injection vulnerability. Product: Orbit Open Ad Server Vendor: OrbitScripts, LLC Vulnerable Versions: 1.1.0 and probably prior Tested Version: 1.1.0 Advisory Publication: March 19, 2014 without technical details Vendor Notification: Mar...

Orbit Open Ad Server 1.1.0 SQL Injection

Advisory ID: HTB23208 Product: Orbit Open Ad Server Vendor: OrbitScripts, LLC Vulnerable Versions: 1.1.0 and probably prior Tested Version: 1.1.0 Advisory Publication: March 19, 2014 without technical details Vendor Notification: March 19, 2014 Vendor Patch: March 21, 2014 Public Disclosure: Apri...

Google Voice Private/Unknown Number Disclosure

!/usr/bin/perl Title: Google Voice private/unknown numbers disclosure Author: Simo Ben youssef Contact: SimoatMorxploitcom Discovered: March 24 2014 Reported: March 28 2014 Published: April 04 2014 MorXploit Research http://www.MorXploit.com Service: Google Voice Vendor: Google...

Cross-Site Scripting (XSS) in Offiria

High-Tech Bridge Security Research Lab discovered vulnerability in Offiria, which can be exploited to perform Cross-Site Scripting XSS attacks against users of vulnerable application. 1 Reflected Cross-Site Scripting XSS in Offiria: CVE-2014-2689 The vulnerability exists due to insufficient...

Second NSA Crypto Tool Found in RSA BSafe

A team of academics released a study on the maligned Dual EC DRBG algorithm used in RSA Security’s BSafe and other cryptographic libraries that includes new evidence that the National Security Agency used a second cryptographic tool alongside Dual EC DRBG in Bsafe to facilitate spying. Allegation...

Cisco Prime Security Manager Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Prime Security Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to insufficient input validation of several...

New Platform Protects Data From Arbitrary Server Compromises

Researchers are in the midst of rolling out a secure new platform for building web applications that can protect confidential data from being stolen in the event attackers gain full access to servers. The platform, Mylar, is the result of a project spearheaded by students at the Massachusetts...

VUPEN Security Research - Google Chrome "Clipboard::WriteData()" Function Sandbox Escape (Pwn2Own)

VUPEN Security Research - Google Chrome Clipboard Format Processing Sandbox Escape Pwn2Own Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Google Chrome is a freeware web browser developed by Google. Chrome version 28 and beyond uses the WebK...

[ODA] Online Web Based Disassembler

ODA stands for Online DisAssembler. ODA is a general purpose machine code disassembler that supports a myriad of machine architectures. Built on the shoulders of libbfd and libopcodes part of binutils, ODA allows you to explore an executable by dissecting its sections, strings, symbols, raw hex,...

PT-2014-09: Sensitive Information Disclosure in SAP NetWeaver

The specialists of the Positive Research center have detected a Sensitive Information Disclosure vulnerability in SAP NetWeaver. An attacker can read any tables from SAP Central User Administration SAP CUA via accessing the system affiliated with SAP CUA. How to fix Update your software up to the...

Joomla Multi Calendar 4.0.2 Cross Site Scripting

Hello, Multiple cross-site scripting XSS vulnerabilities in Multi calendar 4.0.2 component for Joomla! allow remote attackers to inject arbitrary web script or HTML code via 1 the calid parameter to index.php or 2 the paletteDefault parameter to index.php. File: /tmpl/layouteditevent.php Lines: 1...

RFP - External Network Vulnerability Assessment & PenTest

Document Title: =============== RFP - External Network Vulnerability Assessment & PenTest References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1225 Download: https://www.vulnerability-lab.com/resources/documents/RFP-BoMPLC-2014.pdf Release Date: ============= 2014-03-13...

PT-2014-38: File inclusion in Honeywell EPKS

The specialists of the Positive Research center have detected a File inclusion vulnerability in Honeywell EPKS. Function hscsconfpnt from module confd.exe doesn’t check input and output filename parameters for command which leads to file inclusion. How to fix Update your sofware up to the latest...

PT-2014-49: Stack-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Stack-based buffer overflow vulnerability in Honeywell EPKS. Stack-based buffer overflow was discovered in hscodbcn.exe module when using function unmarshallCharArray for copying data from packet in stack buffer of static size withou...

PT-2014-37: Stack-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Stack-based buffer overflow vulnerability in Honeywell EPKS. Stack-based buffer overflow was discovered in function hscsvalrefs which can lead to dynamic memory corruption. How to fix Update your sofware up to the latest version...

OpenDocMan 1.2.7 - Multiple Vulnerabilities

OpenDocMan 1.2.7 - Multiple Vulnerabilities Advisory ID: HTB23202 Product: OpenDocMan Vendor: Free Document Management Software Vulnerable Versions: 1.2.7 and probably prior Tested Version: 1.2.7 Advisory Publication: February 12, 2014 without technical details Vendor Notification: February 12,...

Ilch CMS 2.0 Cross Site Scripting

Advisory ID: HTB23203 Product: Ilch CMS Vendor: http://ilch.de Vulnerable Versions: 2.0 and probably prior Tested Version: 2.0 Advisory Publication: February 12, 2014 without technical details Vendor Notification: February 12, 2014 Public Disclosure: March 5, 2014 Vulnerability Type: Cross-Site...

Ilch CMS 2.0 - Persistent Cross-Site Scripting

Ilch CMS 2.0 - Persistent Cross-Site Scripting Advisory ID: HTB23203 Product: Ilch CMS Vendor: http://ilch.de Vulnerable Versions: 2.0 and probably prior Tested Version: 2.0 Advisory Publication: February 12, 2014 without technical details Vendor Notification: February 12, 2014 Public Disclosure:...

Interview Benjamin Kunz Mejri - HITB Amsterdam 2013Q4

Document Title: =============== Interview Benjamin Kunz Mejri - HITB Amsterdam 2013Q4 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1220 View: http://www.youtube.com/watch?v=QnfWpuVk-jo Release Date: ============= 2014-03-04 Vulnerability Laboratory ID VL-ID:...

Cisco Offers $300,000 Prize For 'Internet of Things' Security Apps

In the last few years, this emerging domain for the Internet of Things has been attracting the significant interest, and will continue for the years to come. It would be a $20 Trillion Market over the next several years, but Security and privacy are the key issues for such applications, and still...