Feng Office 2.3.2-rc Cross Site Scripting Vulnerability

Feng Office version 2.3.2-rc suffers from a cross site scripting vulnerability. Advisory ID: HTB23174 Product: Feng Office Vendor: Secure Data SRL Vulnerable Versions: 2.3.2-rc and probably prior Tested Version: 2.3.2-rc Advisory Publication: September 18, 2013 without technical details Vendor...

Netgear ProSafe switches: Unauthenticated startup-config disclosure and Denial of Service

BACKGROUND According to the vendor, Netgear ProSafe is a cost-effective line of smart switches for Small and Medium Businesses SMBs. The products cover an essential set of network features and easy-to-use web-based management. Power over Ethernet PoE and Stacking versions are also available. 2...

Microsoft paid over $28,000 Rewards to Six Researchers for its first ever Bug Bounty Program

Microsoft today announced that they had paid more than $28,000 in rewards to Security Researchers for its first Bug Bounty program, that went on for a month during the preview release of Internet Explorer 11 IE11. The program was designed to run during Internet Explorer 11's browser beta test on...

WHMCS SQL injection EXP-vulnerability warning-the black bar safety net

Localhost in the report WHMCS SQL injection, by the way, and EXP with the release, here it will be his turn! This site provides programmethodmay carry offensive,for security research and teaching purposes,at your own risk! !/ usr/bin/env python 2013/10/03 - WHMCS 5.2.7 SQL Injection...

CMS Formulasi 2.07 - Multiple Vulnerabilities

/ \ / | / \ /000000 | 00 | /000000 | 00 \00/ / \ / \ / \ 00 \ / / \ / \ 00 \00/ / \ / | 00 \ 000000 |/000000 |000000 |0000000 |000000 0000 | 000000 | 00 \ /000000 |/0000000/ 000000 | / 00 |00 | 00/ / 00 |00 | 00 |00 | 00 | 00 | / 00 | 000000 |00 00 |00 | / \00 |/0000000 |00 | /0000000 |00 | 00 |0...

Yahoo Revamps Bug Bounty Vulnerability Rewards Program

Yahoo has promised to put the finishing touches on a new vulnerability reporting and rewards policy by Halloween after finding itself in the throes of a mini scandal this week over two $12.50 Yahoo company store discount codes handed out to one researcher in thanks for turning in a pair of...

PT-2013-67: Sensitive Information Disclosure in Serv-U File Server

The specialists of the Positive Research center have detected a Sensitive Information Disclosure vulnerability in Serv-U File Server. This vulnerability allows an attacker to find out the system configuration and obtain users’ authentication information via Serv-U variables values. Exploitation...

PT-2013-69: Denial of Service in Serv-U File Server

The specialists of the Positive Research center have detected a Denial of Service vulnerability in Serv-U File Server. Handling HTTP request with a recursive variable causes the application to enter an infinite loop, resulting in Denial of Service. Exploitation...

Researchers Ponder When to Notify Users of Public Vulnerability Exploits

BERLIN–Just whispering the words “vulnerability disclosure” within earshot of a security researcher or vendor security response team members can put you in fear for your life these days. The debate is so old and worn out that there is virtually nothing new left to say or chew on at this point...

Multiple Vulnerabilities in Gnew

Advisory ID: HTB23171 Product: Gnew Vendor: Raoul Proenca Vulnerable Versions: 2013.1 and probably prior Tested Version: 2013.1 Advisory Publication: August 28, 2013 without technical details Vendor Notification: August 28, 2013 Public Disclosure: October 2, 2013 Vulnerability Type: PHP File...

[PT-2013-41] Arbitrary Code Execution in Ajax File and Image Manager

----------------------------------------------------------- PT-2013-41 Positive Technologies Security Advisory Arbitrary Code Execution in Ajax File and Image Manager ----------------------------------------------------------- --- Vulnerable software Ajax File and Image Manager Version: 1.1 and...

Gnew 2013.1 - Multiple Vulnerabilities

Gnew version 2013.1 suffers from file inclusion and remote SQL injection vulnerabilities. Product: Gnew Vulnerable Versions: 2013.1 and probably prior Tested Version: 2013.1 Advisory Publication: August 28, 2013 without technical details Vendor Notification: August 28, 2013 Public Disclosure:...

XAMPP 1.8.1 Local Write Access Vulnerability

XAMPP version 1.8.1 allows an unprivileged user the ability to write to the local disk. It has been detected than an unprivileged user can write in the local disk and the local file "lang.tmp" can be modified in the remote machine. The injection is done through the page "/xampp/lang.php"...

Remote Code Execution in Microweber

High-Tech Bridge Security Research Lab discovered vulnerability in Microweber, which can be exploited to delete arbitrary files and compromise vulnerable system as a consequence. 1 Improper Access Control in Microweber: CVE-2013-5984 Vulnerability exists due to improper access restriction to...

X2CRM 3.4.1 Cross Site Scripting / Local File Inclusion

Advisory ID: HTB23172 Product: X2CRM Vendor: X2Engine Inc. Vulnerable Versions: 3.4.1 and probably prior Tested Version: 3.4.1 Advisory Published: September 4, 2013 Vendor Notification: September 4, 2013 Vendor Patch: September 10, 2013 Public Disclosure: September 25, 2013 Vulnerability Type: PH...

Hackers Bypass iPhone 5S Touch ID

Hackers from the venerable Chaos Computer Club in Germany have found a method for bypassing the new iPhone 5S Touch ID fingerprint security mechanism. The method, which is the first known technique for circumventing the iPhone’s newest security feature, involves taking a picture of a user’s...

GLPI - 'install.php' Remote Command Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'GLPI install.php Remote Command...

Turning your iPhone or Android camera into Microscope

Have you ever been wanting to take a picture of something you're looking at under your microscope but you just can't? Well, but now the Microphone Lens turns your iPhone or Android camera phone into a portable handheld microscope. By attaching a lightweight, inexpensive device to the back of a...

Turning your iPhone or Android camera into Microscope

Have you ever been wanting to take a picture of something you're looking at under your microscope but you just can't? Well, but now the Microphone Lens turns your iPhone or Android camera phone into a portable handheld microscope. By attaching a lightweight, inexpensive device to the back of a...

vtiger CRM 5.4.0 SQL Injection Vulnerability

vtiger CRM version 5.4.0 suffers from a remote SQL injection vulnerability. Product: vtiger CRM Vendor: vtiger Vulnerable Versions: 5.4.0 and probably prior Tested Version: 5.4.0 Vendor Notification: August 7, 2013 Vendor Patch: September 17, 2013 Public Disclosure: September 18, 2013 Vulnerabili...