samba: Insufficient symlink verification in smbd

An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share. A remote attacker could exploit this flaw to gain access to files outside of Samba's share path...

DEBIAN-CVE-2015-5252

vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share...

WordPress Simple Share Buttons Adder Plugin <= 6.0.0 - Reflected XSS

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...

UBUNTU-CVE-2015-5252

vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share...

MS15-134 Microsoft Office COM Object DLL Planting with els.dll

While loading an embedded object in Microsoft Word or other Microsoft Office products, it is possible to load a Classic Event Viewer Extension, which causes a LoadLibraryW call that attempts to load elsext.dll from the same directory as the Office document. From an untrusted remote share such as...

One after another: the VTech user data leaked, and was broke two major vulnerability-vulnerability warning-the black bar safety net

Recently, the world's largest infant electronic learning product Maker Vtech（Vtech）is aeration 4 8 0 million parents and 6 4 0 million for children information disclosure. ! Due to this event, Vtech its share price fell to a year low. Followed, with security researchers in their innotab Max produ...

share-online.biz XSS vulnerability

Vulnerable URL: https://www.share-online.biz/helpdesk/index.php?x';alert/XSSPOSED/// Details: Description| Value ---|--- Patched:| Yes, at 22.06.2016 Latest check for patch:| 22.06.2016 18:07 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5888 Google Pagerank| ...

Social Share Button <= 2.1 - Authenticated Stored Cross-Site Scripting (XSS)

Fixed in 2.1.0 but fixedin set to 2.1.1 to avoid confusion between 2.1 and 2.1.0...

WordPress Social Share Button Plugin <= 2.1 - Stored Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can store HTML or JS code. Solution Update the plugin...

WordPress Social Share Button Plugin <= 2.1 - Stored Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can store HTML or JS code. Solution Update the plugin...

esgexperience.com XSS vulnerability

Vulnerable URL: https://esgexperience.com/share/get.php?url='"'"SCRIPT"' Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 8196379 Google Pagerank| 0 VIP website status:| No Check...

Multiple SQL Injections in Open Source Bike Share

High-Tech Bridge Security Research Lab discovered multiple SQL injection vulnerabilities in Open Source Bike Share. Successful exploitation of these vulnerabilities will enable the attacker to obtain sensitive data from the database such as usernames and passwords, to post fake content or malware...

MS15-100 Microsoft Windows Media Center MCL Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS15-100 Microsoft Windows Media Center MCL Vulnerability", 'Description' = %q This module exploits a vulnerability in Windows Media...

Windows Media Center command execution

Added: 09/15/2015 CVE: CVE-2015-2509 Background Windows Media Center is software for watching DVDs and TV channels on Windows systems. Problem A vulnerability in Windows Media Center could allow command execution when a user opens an .mcl file which references an executable file supplied by an...

Windows Media Center command execution

Added: 09/15/2015 CVE: CVE-2015-2509 Background Windows Media Center is software for watching DVDs and TV channels on Windows systems. Problem A vulnerability in Windows Media Center could allow command execution when a user opens an .mcl file which references an executable file supplied by an...

Windows Media Center command execution

Added: 09/15/2015 CVE: CVE-2015-2509 Background Windows Media Center is software for watching DVDs and TV channels on Windows systems. Problem A vulnerability in Windows Media Center could allow command execution when a user opens an .mcl file which references an executable file supplied by an...

CredCrack - Fast and Stealthy Credential Harvester

CredCrack is a fast and stealthy credential harvester. It exfiltrates credentials recusively in memory and in the clear. Upon completion, CredCrack will parse and output the credentials while identifying any domain administrators obtained. CredCrack also comes with the ability to list and enumera...

WordPress Share Buttons Plugin <= 5.0.12 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

AddThis Sharing Buttons <= 5.0.12 - Authenticated Cross-Site Scripting (XSS)

The WordPress Share Buttons Plugin – AddThis WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

WordPress 1-Click Retweet/Share/Like 5.2 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Title: WordPress '1-click Retweet/Share/Like' Plugin Version: 5.2 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-21 Download: - https://wordpress.org/plugins/1-click-retweetsharelike/ -...