Alt+Tab Does Not Pass Through the VDI in ICA Session

When pressing Alt+Tab while on a VDI in ICA session Full Screen, the apps show up from the endpoint and not from the VDI...

Piwigo Remote File Inclusion Vulnerability

Piwigo is a photo album script written in PHP. A security vulnerability exists in the admin/languages.php implementation in versions prior to Piwigo 2.8.3, where a remote administrator user passes the tab parameter and the executable file contains an attack...

CVE-2016-10085

admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter...

MSF-Remote-Console - A Remote Msfconsole To Connect To The Msfrcpd Server Of Metasploit

A remote msfconsole written in Python 2.7 to connect to the msfrcpd server of metasploit. This tool gives you the ability to load modules permanently as daemon on your server like autopwn2. Although it gives you the ability to remotely use the msfrpcd server it is recommended to use it locally wi...

CVE-2016-5186

Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled objects after a tab crash, which allowed a remote attacker to perform an out of bounds memory read via crafted PDF files...

CVE-2016-5186

Removed by vendor...

Design/Logic Flaw

XSS issues were discovered in phpMyAdmin. This affects Zoom search specially crafted column content can be used to trigger an XSS attack; GIS editor certain fields in the graphical GIS editor are not properly escaped and can be used to trigger an XSS attack; Relation view; the following...

CVE-2016-6607

phpMyAdmin is affected by CVE-2016-6607: XSS vulnerabilities in multiple components (Zoom search, GIS editor, relations view, various Transformations, XML/MediaWiki exports, Designer, etc.) due to improper escaping. Affected are phpMyAdmin 4.0.x before 4.0.10.17, 4.4.x before 4.4.15.8, and 4.6.x ...

CVE-2016-6607

XSS issues were discovered in phpMyAdmin. This affects Zoom search specially crafted column content can be used to trigger an XSS attack; GIS editor certain fields in the graphical GIS editor are not properly escaped and can be used to trigger an XSS attack; Relation view; the following...

Open-Xchange: Tab nabbing via window.opener

Details: When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change it's location using the window.opener property. POC: Edit your contact details, with the website URL of http://davenport.net.nz/test.html, which has the following htm...

Stable Channel Update for Chrome OS

The Stable channel has been updated to 54.0.2840.79 Platform version: 8743.76.0 for all Chrome OS devices except HP Chromebook 13 G1, Acer Chromebook 14 for Work and Thinkpad 13 Chromebook. This build contains a number of bug fixes, security updates, and feature enhancements. Systems will be...

Telegram Web 0.5.5 Username Bypass Vulnerability

Exploit for tricks platform in category remote exploits Exploit Title: Telegram Web Empty Username Bypass Date: 18/10/2016 Author: Ashiyane Digital Security Team Software Link: https://web.telegram.org version : Telegram Web 0.5.5 Tested on: Windows 7 Description: Telegram filters null bytes for...

Cross-Site Scripting in Web Interface

The Palo Alto Networks web management interface is vulnerable to a post-authentication persistent cross-site scripting condition in the monitor tab. Ref PAN-57659/95895...

chromium-browser: out of bounds read in devtools

Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled objects after a tab crash, which allowed a remote attacker to perform an out of bounds memory read via crafted PDF files...

CVE-2016-7397

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in the notifications configuration tab...

Design/Logic Flaw

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the proxy user settings in "system settings / scan settings / anti spam" configuration tab...

CVE-2016-7397

The CVE-2016-7397 vulnerability affects the Sophos UTM Frontend component (firmware 9.405-5 and earlier). A local administrator can disclose sensitive password information by reading the value field of the SMTP user settings in the Notifications configuration tab. Public disclosures and multiple ...

GPU tab on XenCenter is not visible for Citrix Hypervisor 8.2 CU1 hosts

We are not able to see the GPU tab in XenCenter. However we are able to run commands like nvidia-smi and xe vgpu-list...

How to change default view on storefront website.

When we access Storefront site, the page directly lands to Favorites tab. How to change it?...

InstantHMI 6.1 - Privilege Escalation

Exploit for windows platform in category local exploits Title: InstantHMI - EoP: User to ADMIN CWE Class: CWE-276: Incorrect Default Permissions Date: 01/06/2016 Vendor: Software Horizons Product: InstantHMI Version: 6.1 Download link: http://www.instanthmi.com/ihmisoftware.htm Tested on: Windows...