e107 2.1.2 Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

Exploit for php platform in category web applications e107 Content Management System CMS - Multiple Issues Affected Versions ================= e107 2.1.2 Bootstrap CMS Issue Overview ============== Vulnerability Type: Multiple Vulnerabilities Technical Risk: medium Likelihood of Exploitation:...

needle - The iOS Security Testing Framework

Needle is an open source, modular framework to streamline the process of conducting security assessments of iOS apps. Description Assessing the security of an iOS application typically requires a plethora of tools, each developed for a specific need and all with different modes of operation and...

CVE-2016-9177

A path traversal issue was found in Spark version 2.5 and potentially earlier versions. The vulnerability resides in the functionality to serve static files where there's no protection against directory traversal attacks. This could allow attackers access to private files including sensitive data...

Spark 2.5 Arbitrary File Read Vulnerability

Exploit for php platform in category web applications Spark sparkjava.com is a mildly hyped Java micro web framework that also provides functionality to serve static files. Unfortunately, there's no protection against directory traversal attacks and I haven't been able to contact anyone related t...

Sparkjava Framework arbitrary file read vulnerability

Classpath Vuln Exploit the classpath based vulnerability with something like: curl "http:///....\spark\Spark.class" The number of ..\ you need in the path depends on where in the classpath the static file location is configured to be. If you don't have the right amount then you don't get anything...

Ali poly security Android application vulnerability scanner analysis: local denial of service detection detailed explanation-vulnerability warning-the black bar safety net

Ali poly security of the Android application vulnerability scanners have a detection item is a local denial of service vulnerability detection using static analysis applied motion blur test of the method to the detection, the detection results are accurate and comprehensive. This article will tal...

WordPress Simply Static Plugin <= 1.7.0 - Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerabilities

WordPress Simply Static Plugin = 1.7.0 fails to check for a valid nonce when plugin's settings are saved. Also, some of the settings are shown on the front-end without escaping them. Solution Update the plugin...

Atlassian Confluence Server < 5.7 Reflected Static Content Injection

Binary data 9642.prm...

CVE-2016-3913

media/libmediaplayerservice/MediaPlayerService.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not validate a certain staticcast operation, which allows attackers to gain privileges via a crafted...

UBUNTU-CVE-2016-3913

media/libmediaplayerservice/MediaPlayerService.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not validate a certain staticcast operation, which allows attackers to gain privileges via a crafted...

Automated Memory Analyzer For Malware Samples: VolatilityBot

Automated Memory Analyzer For Malware Samples VolatilityBot is an automation tool for researchers cuts all the guesswork and manual tasks out of the binary extraction phase, or to help the investigator in the first steps of performing a memory analysis investigation. Not only does it automaticall...

XNC: How to Block any Device which does not use SecureMail Agent

Question : XNC: How to Block any Device which does not use SecureMail Agent Answer : Rule = Static+XDM: Block mode Made the static XNC rule for "WorxMail" agent. The Above step can also be achieved by allowing Secure Mail agent as "Secure Mail/Secure Mail" in the XNC RegEx build. Perform "Implici...

WSSAT - Web Service Security Assessment Tool

WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it performs both static and dynamic tests again...

Metasploit Web UI Static secret_key_base Value

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule NullSerializer @serializer = options:serializer || Marshal end def encryptandsignvalue...

Mobile APP vulnerabilities automated detection platform construction-vulnerability warning-the black bar safety net

Preface: this article is the mobile APP Client Security The notes of the series of original articles in the first article, mainly about enterprise mobile APP automated vulnerability detection platform construction, mobile APP vulnerability detection history with cutting-edge technology, the APP...

CVE-2016-3862

media/ExifInterface.java in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 does not properly interact with the use of static variables in libjheadjni, which allows remote attackers to execute arbitrary code or cause a denial of service...

Memory corruption

media/ExifInterface.java in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 does not properly interact with the use of static variables in libjheadjni, which allows remote attackers to execute arbitrary code or cause a denial of service...

CVE-2016-3862

media/ExifInterface.java in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 does not properly interact with the use of static variables in libjheadjni, which allows remote attackers to execute arbitrary code or cause a denial of service...

QIWI: [qiwi.com] Information Disclosure

XSS on qiwi.com via static files...

Manalyze - A static analyzer for PE executables

Manalyzer is a free service which performs static analysis on PE executables to detect undesirable behavior. A static analyzer for PE files Manalyze was written in C++ for Windows and Linux and is released under the terms of the GPLv3 license . It is a robust parser for PE files with a flexible...