989 matches found
OracleVM 3.3 : wget (OVMSA-2014-0036)
The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2014-4877 wget: FTP symlink arbitrary filesystem access 1156133 - Fix the parsing of weblink when doing recursive retrieving 960137 - Fix errors found by static analysis of source code 873216 ...
Web Application Protection - Tool to detect and correct vulnerabilities in PHP web applications
WAP 2.0 is a source code static analysis and data mining tool to detect and correct input validation vulnerabilities in web applications written in PHP version 4.0 or higher and with a low rate of false positives. WAP detects and corrects the following vulnerabilities: SQL Injection SQLI Cross-si...
How to prevent the next heartbleed-vulnerability warning-the black bar safety net
I. Introduction Based on the OpenSSL heart bleed vulnerability was considered to be the CVE-2 0 1 4-0 1 6 0 serious problem, OpenSSL is widely used in SSL and TLS plug-in. As used herein, the heart bleed vulnerability explanation this vulnerability is what is the use. This article studies the...
Fortify SCA analysis code vulnerabilities the whole solution-vulnerability warning-the black bar safety net
The last describes the use of FindBugs-assisted analysis of code vulnerability, this time a tools: Fortify SCA Demo 4.0.0。 Fortify is a security aspect of the quite famous company, there is not much to say. First introduce the protagonist: the Fortify SCA Demo 4.0.0, although do not know now...
Hook Analyser 3.1 - Malware Analysis Tool
Hook Analyser is a freeware application which allows an investigator/analyst to perform “static & run-time / dynamic” analysis of suspicious applications, also gather analyse & co-related threat intelligence related information or data from various open sources on the Internet. Essentially it’s a...
Senior PHP application vulnerability auditing techniques-vulnerability warning-the black bar safety net
Senior PHP application vulnerability auditing techniques Foreword Traditional code auditing techniques PHP version and application code audit Other factors and application code audit The expansion of our dictionary The variable itself is the key Variable coverage Traverse initialize variables...
[SOJOBO-ADV-13-05] - Vtiger 5.4.0 Reflected Cross Site Scripting
SOJOBO-ADV-13-05 - Vtiger 5.4.0 Reflected Cross Site Scripting I. Information ================== Name : Vtiger 5.4.0 Reflected Cross Site Scripting Software : Vtiger 5.4.0 and possibly below. Vendor Homepage : https://www.vtiger.com/ Vulnerability Type : Reflected Cross-Site Scripting Severity :...
Vtiger 5.4.0 Cross Site Scripting Vulnerability
Vtiger version 5.4.0 suffers from multiple reflective cross site scripting vulnerabilities. Vtiger 5.4.0 Reflected Cross Site Scripting I. Information ================== Name : Vtiger 5.4.0 Reflected Cross Site Scripting Software : Vtiger 5.4.0 and possibly below. Vendor Homepage :...
WordPress Gallery Bank 2.0.19 Cross Site Scripting
SOJOBO-ADV-13-03 - Wordpress plugin Gallery Bank 2.0.19 Reflected Cross Site Scripting I. Information ================== Name : Wordpress plugin Gallery Bank 2.0.19 Reflected Cross Site Scripting Software : Gallery Bank 2.0.19 and possibly below. Vendor Homepage : http://gallery-bank.com/...
[SOJOBO-ADV-13-02] - MODx 2.2.10 Reflected Cross Site Scripting
SOJOBO-ADV-13-02 - MODx 2.2.10 Reflected Cross Site Scripting I. Information ================== Name : MODx 2.2.10 Reflected Cross Site Scripting Software : MODx 2.2.10 and possibly below. Vendor Homepage : http://modx.com/ Vulnerability Type : Reflected Cross-Site Scripting Severity : Low 2/5...
[SOJOBO-ADV-13-01] - Zenphoto 1.4.5.2 multiple vulnerabilities
SOJOBO-ADV-13-01 - Zenphoto 1.4.5.2 multiple vulnerabilities I. Information ================== Name : Zenphoto 1.4.5.2 multiple vulnerabilities Software : Zenphoto 1.4.5.2 and possibly below. Vendor Homepage : http://www.zenphoto.org/ Vulnerability Type : SQL Injection, Reflected Cross-Site...
Zenphoto 1.4.5.2 Cross Site Scripting / SQL Injection
Zenphoto version 1.4.5.2 suffers from cross site scripting and remote SQL injection vulnerabilities. SOJOBO-ADV-13-01 - Zenphoto 1.4.5.2 multiple vulnerabilities I. Information ================== Name : Zenphoto 1.4.5.2 multiple vulnerabilities Software : Zenphoto 1.4.5.2 and possibly below. Vend...
Zenphoto 1.4.5.2 Cross Site Scripting / SQL Injection
SOJOBO-ADV-13-01 - Zenphoto 1.4.5.2 multiple vulnerabilities I. Information ================== Name : Zenphoto 1.4.5.2 multiple vulnerabilities Software : Zenphoto 1.4.5.2 and possibly below. Vendor Homepage : http://www.zenphoto.org/ Vulnerability Type : SQL Injection, Reflected Cross-Site...
[Binrev] Automate Reversing Windows Binaries for Pentesters
What you can do with this? Static analysis: you can do a basic manual code review for decompiled sources to discover hidden communication channels, search for hard-coded passwords, or SQL injection vulnerabilities. Import decompiled projects to an IDE to reconstruct and modify the original source...
About the PHP code auditing and vulnerability digging a little thought-vulnerability warning-the black bar safety net
Here is the PHP code auditing and vulnerability discovery the idea to do a bit summary, is a personal point of view, there is something wrong place please point out. PHP vulnerabilities in a large part is from the programmer's own lack of experience, of course, and server configuration related, b...
[Pyew v2.2] A Python tool for static malware analysis
Pyew is a command line python tool to analyse malware. It does have support for hexadecimal viewing, disassembly Intel 16, 32 and 64 bits, PE and ELF file formats it performs code analysis and let you write scripts using an API to perform many types of analysis, follows direct call/jmp instructio...
[Hook Analyser v2.4] Application (and Malware) Analysis tool
Application and Malware Analysis tool. Hook Analyser is a hook tool which could be potentially helpful in reversing application and analysing malwares. Changelog v2.4 Hook Analyser can now analyse DLLs. Part of the Static Malware Analysis Module The deep trace functionality has been improved...
[MASTIFF2HTML] Static Analysis Framework Results Viewer
MASTIFF2HTML is a python program that is used to create a GUI results interface in HTML from MASTIFF results. Download the python program at: https://github.com/1aN0rmus/TekDefense/blob/master/MASTIFF2HTML.py MASTIFF is an automated static malware analysis framework. Learn more about MASTIFF at:...
Reverse engineering, Malware and Goodware analysis of Android applications: Androguard
Androguard is a full python tool to play with Android files. DEX, ODEX APK Android’s binary xml Android resources Disassemble DEX/ODEX bytecodes Decompiler for DEX/ODEX files You can either use the cli or graphical frontend for androguard, or use androguard purely as a library for your own tools...
A CISO's Guide To Application Security – Part 4: Weighing AppSec Technology Options
This post is the fourth in a 5-part series on Application Security, or “AppSec”. The series will define the components of a sound AppSec program, delineate the growing threats to software, weigh the costs of a data breach, and outline the CISO’s responsibility in managing software security risk...