Samsung Kies 2.3.2.12054_20 - Multiple Vulnerabilities

Samsung Kies 2.3.2.1205420 - Multiple Vulnerabilities Advisory ID: HTB23099 Product: Samsung Kies Vendor: Samsung Electronics Vulnerable Versions: 2.3.2.1205420 and probably prior Tested Version: 2.3.2.1205420 Vendor Notification: June 25, 2012 Public Disclosure: October 15, 2012 Vulnerability...

TVMOBiLi Media Server Multiple Remote DoS Vulnerabilities

High-Tech Bridge Security Research Lab has discovered 2 remote DoS vulnerabilities in TVMOBiLi Media server, which could be exploited to crash remote server with malicious HTTP requests. 1 Improper Handling of Length Parameter Inconsistency in TVMOBiLi: CVE-2012-5451 1.1 The vulnerability exists...

Samsung Kies 2.3.2.12054_20 NULL Pointer Dereference / Access Control

Advisory ID: HTB23099 Product: Samsung Kies Vendor: Samsung Electronics Vulnerable Versions: 2.3.2.1205420 and probably prior Tested Version: 2.3.2.1205420 Vendor Notification: June 25, 2012 Public Disclosure: October 15, 2012 Vulnerability Type: NULL Pointer Dereference CWE-476, Improper Access...

OpenX 2.8.10 Cross Site Scripting / SQL Injection

Advisory ID: HTB23116 Product: OpenX Vendor: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Vendor Notification: September 19, 2012 Public Disclosure: October 10, 2012 Vulnerability Type: Cross-Site Scripting CWE-79, SQL Injection CWE-89 CVE References: CVE-2012-4989,...

Template CMS 2.1.1 Cross Site Request Forgery / Cross Site Scripting

Exploit for php platform in category web applications Product: Template CMS Vendor: template-cms.ru Vulnerable Versions: 2.1.1 and probably prior Tested Version: 2.1.1 Vendor Notification: September 12, 2012 Public Disclosure: October 3, 2012 Vulnerability Type: Cross-Site Scripting CWE-79,...

300% Increase in malnets Attack in the past six months

Blue Coat systems has undertaken detailed research into the use of 'malnets' by criminals to help support their various attacks in order to uncover the best ways to take down these systems. Botnet infections are commonly spread though compromised websites seeded with malicious scripts and promote...

Multiple vulnerabilities in AContent

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in AContent, which can be exploited to bypass authentication and to perform Cross-Site Scripting XSS and SQL Injection attacks. 1 SQL Injection in AContent: CVE-2012-5167 1.1 The vulnerability exists due to insufficient...

VUPEN - Adobe Flash Player "Matrix3D" Integer Overflow Code Execution (APSB12-19)

VUPEN Security Research - Adobe Flash Player "Matrix3D" Integer Overflow Code Execution APSB12-19 Website : http://www.vupen.com/english/research.php Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Adobe Flash Player is a cross-platform browser-based application runtime tha...

PHPList SQL injection and cross-site scripting vulnerability-vulnerability warning-the black bar safety net

Affected system: phplist phplist 2.10.17 Not affected system: phplist phplist 2.10.18 Description: -------------------------------------------------------------------------------- BUGTRAQ ID: 5 2 6 5 7 CVE ID: CVE-2 0 1 2-2 7 4 0 PHPList is a open source email campaign Manager. phpList 2.10. 1 8...

Multiple vulnerabilities in Template CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Template CMS, which can be exploited to perform Cross-Site Scripting XSS and Сross-Site Request Forgery CSRF attacks. 1 Cross-Site Scripting XSS in Template CMS: CVE-2012-4901 Input passed via the "themeseditor" POST...

Cross-Site Scripting (XSS) Vulnerabilities in Flogr

Advisory ID: HTB23110 Product: Flogr Vendor: Flogr Vulnerable Versions: 2.5.6 and probably prior Tested Version: 2.5.6 Vendor Notification: August 15, 2012 Public Disclosure: September 5, 2012 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2012-4336 CVSSv2 Base Score: 4.3...

TestLink 1.9.3 - Cross-Site Request Forgery

Advisory ID: HTB23088 Product: TestLink Vendor: teamst.org Vulnerable Versions: 1.9.3 and probably prior Tested Version: 1.9.3 Vendor Notification: April 18, 2012 Public Disclosure: September 5, 2012 Vulnerability Type: Cross-Site Request Forgery CWE-352 CVE Reference: CVE-2012-2275 CVSSv2 Base...

TestLink 1.9.3 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications Product: TestLink Vendor: teamst.org Vulnerable Versions: 1.9.3 and probably prior Tested Version: 1.9.3 Vendor Notification: April 18, 2012 Public Disclosure: September 5, 2012 Vulnerability Type: Cross-Site Request Forgery CWE-352 CVE...

New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions

There is a feature supported by the SSL/TLS encryption standard and used by most of the major browsers that leaks enough information about encrypted sessions to enable attackers decrypt users’ supposedly protected cookies and hijack their sessions. The researchers who developed the attack that...

JRE remote code execution 0DAY-vulnerability warning-the black bar safety net

Warning: this site provides programmethodmay carry offensive,for security research and teaching purposes,at your own risk! // // CVE-2 0 1 2-XXXX Java 0day // // reported here: http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html // // secret host / ip : ok.aa24.net /...

[SE-2012-01] information regarding recently discovered Java 7 attack

Hello All, This post is made in reference to recently discovered attack against Java SE 7 platform 12. We discovered that the vulnerabilities used by the attack code are similar to some of the weaknesses that we have found as part of our SE-2012-01 Java SE security research project 3. The recentl...

Crisis Trojan Makes Its Way onto Virtual Machines

The Windows version of the Crisis Trojan is able to sneak onto VMware implementations, making it possibly the first malware to target such virtual machines. It also has found a way to spread to Windows Mobile devices. “Many threats will terminate themselves when they find a virtual machine...

Multiple vulnerabilities in TCExam

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in TCExam, which can be exploited to perform Cross-Site Scripting XSS and SQL injection attacks. 1 SQL Injection in TCExam: CVE-2012-4601 1.1 Input passed via the "usergroups" POST parameter to /admin/code/tceedittest.php ...

As Bug Bounty Programs Mature, Still More Room For Growth

Google’s recent announcements that the company is doubling some of the rewards in its Chromium Vulnerability Reward Program and will also be committing up to $2 million for another round of the Pwnium contest in a couple of months brought a round of cheers from the security research community. Th...

phpList 2.10.18 Cross Site Scripting / SQL Injection Vulnerability

Exploit for php platform in category web applications Vendor: phpList Ltd Vulnerable Versions: 2.10.18 and probably prior Tested Version: 2.10.18 Vendor Notification: July 11, 2012 Public Disclosure: August 8, 2012 Vulnerability Type: Cross-Site Scripting CWE-79, SQL Injection CWE-89 CVE...