lcms2 -- Null Pointer Dereference Denial of Service Vulnerability

Mageia security team reports: It was discovered that Little CMS did not properly verify certain memory allocations. If a user or automated system using Little CMS were tricked into opening a specially crafted file, an attacker could cause Little CMS to crash CVE-2013-4160...

Another Facebook hack exposes primary email address facebook users

Last week we explained a critical vulnerability in Facebook that discloses the primary email address of facebook user. Later the bug was patched by Facebook Security Team. Today another similar interesting Facebook hack disclosed by another bug hunter, Roy Castillo. On his blog he explained a new...

SA-CONTRIB-2013-058 - MRBS - Abandoned - Mutliple vulnerabilities

MRBS is a free, GPL, web application using PHP and MySQL/pgsql for booking meeting rooms or other resources. The module doesn't sufficiently filter user supplied data when creating queries which leads to a SQL injection vulnerability. CVE identifiers issued ACVE identifier will be requested, and...

Oracle Linux 3 : kernel (ELSA-2009-1233)

From Red Hat Security Advisory 2009:1233 : Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the...

Oracle Linux 4 : kernel (ELSA-2009-1223)

From Red Hat Security Advisory 2009:1223 : Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the...

Oracle Linux 4 : glibc (ELSA-2012-0125)

From Red Hat Security Advisory 2012:0125 : Updated glibc packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS...

SA-CONTRIB-2013-055 - Hatch - Cross Site Scripting

Hatch theme is a simple and minimal portfolio theme for photographers, illustrators, designers, or photobloggers. The theme didn't sufficiently escape user supplied text prior to printing them. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...

SA-CONTRIB-2013-057 - TinyBox - Cross Site Scripting (XSS)

TinyBox module uses TinyBox, a lightweight and standalone modal window script. The main purpose of this module is to provide Splash Screen/Window as simple as possible. The module doesn't filter user-supplied text prior to display. The vulnerability is mitigated by the fact that an attacker must...

Stable Channel Update

Update: We are separately updating users to Flash Player 11.8.800.97 via our component updater. The Stable channel has been updated to 28.0.1500.71 for Windows, Macintosh and Chrome Frame platforms. Security fixes and rewards: Please see the Chromium security page for more information. Note that...

WordPress JS Restaurant SQL Injection

Exploit Title : Wordpress JS Restaurant Plugin SQL Injection Vulnerability Author : Ashiyane Digital Security Team Security Risk : HIgh Google Dork : inurl:/wp-content/plugins/js-restaurant/popup.php?restuarantid= Location:site/path/wp-content/plugins/js-restaurant/popup.php?restuarantid=SQLi DEm...

Hacking DropBox account, Vulnerability allows hacker to bypass Two-Factor Authentication

Q-CERT team found a critical vulnerability that allows the attacker to bypass the two-factor authentication in the most popular file sharing service 'DropBox'. Two Factor Authentication is an extra layer of security that is known as "multi factor authentication" that requires not only a password...

Memory corruption found using Address Sanitizer — Mozilla

Security researcher Abhishek Arya Inferno of the Google Chrome Security Team used the Address Sanitizer tool to discover a series of use-after-free problems rated critical as security issues in shipped software. Some of these issues are potentially exploitable, allowing for remote code execution...

CentOS 5 : java-1.7.0-openjdk (CESA-2013:0958)

Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Joomla Rokdownloads Shell Upload

ISlamic Republic Of Iran Security Team Www.IrIsT.Ir Exploit Title : joomla comrokdownloads Components shell upload Vulnerability Author : IrIsT Security & Researcher Team Discovered By : Am!r Home : http://IrIsT.Ir - http://IrIsT.Ir/forum Facebook Page :...

Sharetronix 3.0.1 Cross Site Scripting

Exploit Title : xss signup sharetronix Designed By : amir.av727 Author : Ashiyane Digital Security Team Home : http://ashiyane.org Software Link : http://sharetronix.com Security Risk : High - xss Version : sharetronix 3.0.1 Exploit : 1-site.com/signup 2 . Copy "alert/Hacked By amir.av727/ In the...

Vulnerability in Whatsapp messenger media server

If you own an iPhone or an Android device, then the chances are high that you're familiar with the extremely popular cross-platform messaging app, WhatsApp. According to a whitehat hacker Mohammed Saeed, Whatsapp media server media.whatsapp.com interface was vulnerable to Traversal local file...

SA-CONTRIB-2013-048 - Edit Limit - Access Bypass

Edit Limit enables you to set time and count-based limits on how and when a user can edit nodes or comments. The module doesn't sufficiently check user access when editing comments to see if the user has the necessary permissions to edit a comment outside of the limits applied by this module. Thi...

SA-CONTRIB-2013-050 - Webform - Cross Site Scripting (XSS)

The Webform module allows the creation of custom webforms and surveys. Webform module does not sanitize the labels of created components fields when displaying a list of components to be used in e-mails or downloaded CSV files. This vulnerability is mitigated by the fact that an attacker must hav...

Wordpress Flagallery-Skins SQL Injection

Exploit Title : Wordpress Flagallery-skins plugin SQL Injection Exploit Author : Ashiyane Digital Security Team Home : www.ashiyane.org Security Risk : Medium Dork : inurl:/wp-content/plugins/flagallery-skins/compactmusicplayer/gallery.php?playlist= Tested on: Linux...

WordPress Plugin ProPlayer 4.7.9.1 - SQL Injection

WordPress Plugin ProPlayer 4.7.9.1 - SQL Injection Exploit Title : WordPress ProPlayer Plugin SQL Injection Exploit Author : Ashiyane Digital Security Team Plugin Link : http://wordpress.org/plugins/proplayer/ Home : www.ashiyane.org Security Risk : High Version : 4.7.9.1 Dork :...