New windows malware can target smart cards for full remote access

If you think that having a USB Token Smartcard is extremely secure for Digital signatures or other activities, you may be wrong! The research done by Paul Rascagneres can remotely give access to victims smartcard! What makes the attack unique is it uses a keylogger to get the PIN or password and...

Multiple Vulnerabilities in Smartphone Pentest Framework (SPF)

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Smartphone Pentest Framework SPF web-based GUI, which could be exploited to get control over a pentester's machine. The research was inspired by the vulnerability found by Jon Passki http://osvdb.org/85873. Even if the...

Multiple vulnerabilities in BabyGekko

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in BabyGekko, which can be exploited to include local PHP files, perform SQL Injection and Cross-Site Scripting XSS attacks. 1 Multiple SQL Injections in BabyGekko: CVE-2012-5698 Two SQL injections exist in BabyGekko...

Open-Redirect Vulnerability, Fake Government URLs Duping Users

Spammers have recently taken advantage of an open-redirect vulnerability to phish users and trick them into clicking through links that appear to be coming from government .gov URLs. The scam relies on a malformed series of URLs that appear to be coming from 1.USA.gov, a collaboration between...

Multiple vulnerabilities in AContent

Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...

Multiple vulnerabilities in Subrion CMS

Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...

subrion CMS 2.2.1 - Multiple Vulnerabilities

Advisory ID: HTB23113 Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...

ATutor 1.2 Multiple Vulnerabilities

SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79 CVE References: CVE-2012-5167, CVE-2012-5168, CVE-2012-5169 CVSSv2 Base Scores: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P, 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P, 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Product: AContent Vendor: ATutor...

ATutor AContent 1.2 XSS / Authentication / SQL Injection

Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...

jCore 1.0pre Cross Site Scripting / SQL Injection

Advisory ID: HTB23107 Product: jCore Vendor: jcore.net Vulnerable Versions: 1.0pre and probably prior Tested Version: 1.0pre Vendor Notification: August 1, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79 CVE References: CVE-2012-4231,...

Subrion CMS 2.2.1 XSS / CSRF / SQL Injection

-------------------- Product: Subrion CMS Vendor: The Subrion development team Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Vendor Notification: September 5, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79,...

Zero-Day Attacks Thrive for Months Before Disclosure

Zero-day vulnerabilities and exploits dominate headlines and most heated information security discussions. In truth, however, there are relatively few of these attacks hitting a small number of hosts, according to new research on the subject. The reason zero days eat up so much bandwidth is becau...

Samsung Kies 2.3.2.12054_20 - Multiple Vulnerabilities

Samsung Kies 2.3.2.1205420 - Multiple Vulnerabilities Advisory ID: HTB23099 Product: Samsung Kies Vendor: Samsung Electronics Vulnerable Versions: 2.3.2.1205420 and probably prior Tested Version: 2.3.2.1205420 Vendor Notification: June 25, 2012 Public Disclosure: October 15, 2012 Vulnerability...

TVMOBiLi Media Server Multiple Remote DoS Vulnerabilities

High-Tech Bridge Security Research Lab has discovered 2 remote DoS vulnerabilities in TVMOBiLi Media server, which could be exploited to crash remote server with malicious HTTP requests. 1 Improper Handling of Length Parameter Inconsistency in TVMOBiLi: CVE-2012-5451 1.1 The vulnerability exists...

Samsung Kies 2.3.2.12054_20 NULL Pointer Dereference / Access Control

Advisory ID: HTB23099 Product: Samsung Kies Vendor: Samsung Electronics Vulnerable Versions: 2.3.2.1205420 and probably prior Tested Version: 2.3.2.1205420 Vendor Notification: June 25, 2012 Public Disclosure: October 15, 2012 Vulnerability Type: NULL Pointer Dereference CWE-476, Improper Access...

ReVuln Emerges as New Player in Vulnerability Sales Market

It’s getting difficult these days to keep track of all of the companies, public and otherwise, that are buying and selling vulnerabilities or information on bugs, and now there’s another group on the scene: ReVuln. But, unlike other companies in the industry, ReVuln is mostly focusing its efforts...

OpenX 2.8.10 Cross Site Scripting / SQL Injection

Advisory ID: HTB23116 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: September 19, 2012 Public Disclosure: October 10, 2012 Vulnerability Type: Cross-Site Scripting CWE-79, SQL Injection CWE-89 CVE References: CVE-2012-4989,...

LAN Messenger 1.2.28 Cross Site Scripting

Title: ====== LAN Messenger v1.2.28 - Persistent Software Vulnerability Date: ===== 2012-05-16 References: =========== http://www.vulnerability-lab.com/getcontent.php?id= VL-ID: ===== 541 Common Vulnerability Scoring System: ==================================== 7.5 Introduction: ============= LAN...

Zitmo Growing More Sophisticated, Prevalent in Android

From July to September this year, there’s been an uptick in Zitmo or Zeus-in-the-Mobile mobile banking malware according to research revealed this week by network security firm FortiGuard Labs. Researchers argue that iterations of the malware variant that have come to Blackberry and Android phone...

Template CMS 2.1.1 Cross Site Request Forgery / Cross Site Scripting

Exploit for php platform in category web applications Product: Template CMS Vendor: template-cms.ru Vulnerable Versions: 2.1.1 and probably prior Tested Version: 2.1.1 Vendor Notification: September 12, 2012 Public Disclosure: October 3, 2012 Vulnerability Type: Cross-Site Scripting CWE-79,...