Apple Patches Remote 'Invoice Vulnerability' in iTunes, App Store

Apple recently patched a serious issue in its App Store and iTunes Store web app that could have let a remote attacker inject malicious script into invoices that come from Apple and subsequently lead to session hijacking, phishing, and redirect. The vulnerability was unearthed in June by Benjamin...

Critical Persistent Injection Vulnerability in Apple App Store and iTunes

A critical vulnerability has been discovered in the official Apple’s App Store and iTunes Store, affecting millions of Apple users. Vulnerability-Lab Founder and security researcher Benjamin Kunz Mejri discovered an Application-Side input validation web vulnerability that actually resides in the...

FoxyCart Bug Bounty #1 - Filter Bypass & Persistent Vulnerability

Document Title: =============== FoxyCart Bug Bounty 1 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1451 098bdc9b309783df65044c5abb690dafdd4bcd436c380ae68c924fe37e14b4e0 Release Date: ============= 2015-07-15...

Airdroid iOS, Android & Win 3.1.3 - Persistent Vulnerability

Document Title: =============== Airdroid iOS, Android & Win 3.1.3 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1543 Release Date: ============= 2015-07-20 Vulnerability Laboratory ID VL-ID: ==================================...

Splunk Enterprise and Splunk Light Input Validation Cross-Site Scripting Vulnerability

Splunk is the engine of machine data. Splunk collects, indexes, and utilizes fast-moving computer data generated by all applications, servers, and devices. Splunk suffers from a cross-site scripting vulnerability that could be exploited by a remote attacker to inject malicious script or HTML code...

Multiple cross-site scripting vulnerabilities in Cisco WebEx Meeting Center (CNVD-2015-04700)

Cisco WebEx Meeting Center is a web-based online meeting product within a suite of WebEx meeting solutions. A cross-site scripting vulnerability in Cisco WebEx Meeting Center allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain...

CVE-2015-1936

The administrative console in IBM WebSphere Application Server WAS 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter...

CVE-2015-1936

The administrative console in IBM WebSphere Application Server WAS 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter...

FoxyCart Bug Bounty #1 - Bypass & Persistent Vulnerability

Document Title: =============== FoxyCart Bug Bounty 1 - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1451 098bdc9b309783df65044c5abb690dafdd4bcd436c380ae68c924fe37e14b4e0 Release Date: ============= 2015-07-14...

phpSQLiteCMS - Multiple Vulnerabilities

phpSQLiteCMS suffers from cross site request forgery, cross site scripting, arbitrary file upload, and privilege escalation vulnerabilities. + Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPSQLITECMS0712.txt Vendor:...

IBM WebSphere Application Server Session Hijacking Vulnerability

IBM WebSphere Application Server is an application server product that serves as a platform for Java EE and Web services applications and is the foundation of the IBM WebSphere software platform. A session hijacking vulnerability exists in IBM WebSphere Application Server, which allows remote...

CVE-2015-0544

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value...

Design/Logic Flaw

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value...

CVE-2015-0544

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value...

Ebay Magento Application-Side Cross Site Scripting

Document Title: =============== Ebay Magento Bug Bounty 14 - Persistent Description Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1463 EIBBP-31602 Release Date: ============= 2015-06-30 Vulnerability Laboratory ID VL-ID:...

IBM Security Network Protection Cross-Site Scripting Vulnerability

IBM Security Network Protection is a next-generation network intrusion prevention system. The system monitors application usage, website access and operation execution within the network to avoid attacks from malware, botnets and other threats. IBM Security Network Protection suffers from a...

Pinterest Fixes Validation Vulnerability in API

Pinterest recently fixed an issue in the API of its web app that could have allowed remote attackers to compromise emails and carry out session hijacking and phishing attacks. Vulnerability Lab researcher Benjamin Kunz Mejri discovered the issue, which is a persistent mail encoding and validation...

Pinterest Bug Bounty #1 - Persistent CNAME Vulnerability

Document Title: =============== Pinterest Bug Bounty 1 - Persistent CNAME Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1431 Release Date: ============= 2015-06-30 Vulnerability Laboratory ID VL-ID: ==================================== 14...

Pinterest Bug Bounty #1 - Persistent CNAME Vulnerability

Document Title: =============== Pinterest Bug Bounty 1 - Persistent CNAME Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1431 Release Date: ============= 2015-06-29 Vulnerability Laboratory ID VL-ID: ==================================== 14...

Netty and Play Framework Session Hijacking Vulnerability

Netty is a java open source framework provided by JBOSS . A session hijacking vulnerability exists in Netty and Play Framework, which can be exploited by an attacker to gain unauthorized access to an affected application...