3221 matches found
Monster Menus - Access Bypass - Moderately Critical - SA-CONTRIB-2015-163
Monster Menus is a hierarchical menu tree, which provides highly scalable, granular permissions for all pages within a site. The module includes an option to remove nodes from view add them to a "recycle bin" rather than deleting them outright. When a node has been put into a bin using an affecte...
tools.cisco.com Cross Site Scripting
Exploit Title: Cisco.com sub-domain Reflected XSS RXSS Date: 31/10/2015 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.cisco.com Version: / Category: Reflected Cross Site Scripting Google dork: Tested on: cisco.com sub-domains Cisco description :...
Xen Patches VM Escape Vulnerability
The Xen Project, which oversees the open source Xen hypervisor, yesterday patched a seven-year-old vulnerability that allows an attacker to escape a guest virtual machine and attack the host operating system. The flaw is so bad that the developers of the Qubes OS Project, a security-heavy operati...
DSA-3332-2 wordpress - regression update
Bulletin has no description...
Webform CiviCRM Integration - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-160
Webform CiviCRM Integration allows you to add CiviCRM fields to a Drupal Webform. The module doesn't sufficiently escape user input. Some of the vulnerabilities are mitigated by the fact that an attacker must have a role with the permission to edit the webform node plus "access CiviCRM" to define...
jQuery Update - Less Critical - Open Redirect - SA-CONTRIB-2015-158
The jQuery Update module enables you to update jQuery on your site. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack see SA-CORE-2015-004. Only sites with the Overlay module enabled are vulnerable. An incomplete fix for...
CVE-2015-7834
Multiple unspecified vulnerabilities in Google V8 before 4.6.85.23, as used in Google Chrome before 46.0.2490.71, allow attackers to cause a denial of service or possibly have other impact via unknown vectors...
MC Inventory Manager SQL Injection
Vulnerability title: MC Inventory Manager Authentication Bypass Exploit Author : Ashiyane Digital Security Team Product: MC Inventory Manager Date: 2015.10.13 Vendor Homepage: http://microcode.ws/inventory-manager.php Introduction: ============= Manage and maintain inventory of your company, item...
PayPal Inc - Bypass & Session Fixation Vulnerability
Document Title: =============== PayPal Inc - Bypass & Session Fixation Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1615 Video: https://www.youtube.com/watch?v=Uyg8xlt-8go Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1509 Release Date:...
Zope Management Interface 4.3.7 - CSRF Vulnerabilities
Exploit for php platform in category web applications Product: ================================ Zope Management Interface 4.3.7 Zope is a Python-based application server for building secure and highly scalable web applications. Plone Is a Content Management System built on top of the open source...
Entity Registration - Moderately Critical - Information Disclosure - SA-CONTRIB-2015-155
This module enables you to manage registrations for events. The module doesn't sufficiently protect information about who is registered to attend specific events when anonymous users are granted a permission that is commonly recommended when allowing anonymous registrations. This vulnerability is...
Colorbox - Access bypass - Less Critical - SA-CONTRIB-2015-156
This module allows for integration of Colorbox, a jQuery lightbox plugin, into Drupal. The module allows unprivileged users to add unexpected content to a Colorbox, including content from external sites. This allows an unprivileged user to deface a site. This vulnerability is mitigated by the fac...
[SECURITY] [DLA 323-1] fuseiso security update
Package : fuseiso Version : 20070708-2+deb6u1 Debian Bug : 779047 The following two issues have recently been fixed in Debian LTS squeeze for the fuseiso package. Issue 1 An integer overflow, leading to a heap-based buffer overflow flaw was found in the way FuseISO, a FUSE module to mount ISO...
Information Disclosure in extension "LDAP" (eu_ldap)
It has been discovered that the extension "LDAP" euldap is susceptible to Information Disclosure. Release Date: September 30, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 2.8.18 and below Vulnerability Type:...
Shadow Infosystem Arbitrary File Download Vulnerability
Exploit for php platform in category web applications |||||||||||||||||||||||||||||||||||||||||| |--------------------------------------------------------------| |+ Exploit Title: Shadow Infosystem Arbitrary File Download |+ |+ Exploit Author: Ashiyane Digital Security Team |+ |+ Vendor Homepage:...
CMS Updater - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-150
CMS Updater allows to update Drupal core automatically with a subscription service. Access bypass The module does not sufficiently protect the settings page allowing any user with the permission "access administration pages" to change settings. This vulnerability is mitigated by the fact that an...
Drupal 7 driver for SQL Server and SQL Azure - Moderately Critical - SQL Injection - SA-CONTRIB-2015-148
Drupal 7 driver for SQL Server and SQL Azure module has a SQL injection vulnerability. Certain characters aren't properly escaped by the Drupal database API. A malicious user may be able to access restricted information by performing a specially-crafted search. Only sites that use contrib or cust...
Twitter - Moderately Critical - Access bypass - SA-CONTRIB-2015-146
This module enables you to pull in public tweets from Twitter accounts, post messages to Twitter to announce content changes, and authenticate using Twitter. The module doesn't sufficiently check for access when using the Twitter Post submodule to post messages to Twitter and allows a tweet to be...
200 Million WhatsApp Users Vulnerable to vCard Vulnerability
WhatsApp recently claimed to have hit 900 Million monthly active users, but a dangerous security flaw in the web version of the popular instant messaging app puts up to 200 Million of its users at risk. Yes, the web-based extension of WhatsApp is vulnerable to an exploit that could allow hackers ...