Built-In Backdoor Found in Popular Chinese Android Smartphones

Chinese smartphone manufacturers have been criticized many times for suspected backdoors in its products, the popular Chinese smartphone brands, Xiaomi and Star N9500 smartphones are the top examples. Now, the China's third-largest mobile and world's sixth-largest phone manufacturer 'Coolpad', ha...

WordPress 3 persistent script injection

OVERVIEW ======== A security flaw in WordPress 3 allows injection of JavaScript into certain text fields. In particular, the problem affects comment boxes on WordPress posts and pages. These don't require authentication by default. The JavaScript injected into a comment is executed when the targe...

SIP Script Remote Command Execution via Shellshock

The remote host appears to be running SIP. SIP itself is not vulnerable to Shellshock; however, any Bash script that SIP runs for filtering or other routing tasks could potentially be affected if the script exports an environmental variable from the content or headers of a SIP message. A negative...

Feng Office - Persistent Cross-Site Scripting

Feng Office - Persistent Cross-Site Scripting Affected software: Feng Office - URL: http://www.fengoffice.com/web/demo.php Discovered by: Provensec Website: http://www.provensec.com Type of vulnerability: XSS Stored Feng Office is a Collaboration tool that includes a CRM, Communication, Document...

NewsScript Access Validation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12761/info NewsScript is reported prone to an access validation vulnerability. This issue may allow an unauthorized attacker to add, modify and delete messages. It is reported that an attacker can exploit this issue by...

IBM U2 UniVerse 10.0 .0.9 UVADMSH Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8209/info Under certain configurations, UniVerse allows the 'uvadm' user to perform certain administration tasks for the software. It has been reported that the uvadmsh binary does not perform bounds checking when parsing...

TikiWiki Project 1.8 - tiki-user_tasks.php offset & sort_mode Parameter SQL Injections

No description provided by source. source: http://www.securityfocus.com/bid/10100/info Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting,...

SmartSPLAT - Tool to troubleshoot Checkpoint firewall issues and perform management tasks

Smart SPLAT is a freeware software to troubleshoot Checkpoint firewall issues and perform management tasks. It periodically checks for an update and when a new release is published, updates itself via the SmartSPLAT web site. SmartSPLAT lets you connect to your firewall via secure channel SSH...

Microsoft Windows Known Bad AutoRuns / Scheduled Tasks Deprecated

This feature is no longer part of the malware service provided by Tenable. Binary data windowsautorunsmalware.nbin...

CVE-2014-3878

Multiple cross-site scripting XSS vulnerabilities in the web client interface in Ipswitch IMail Server 12.3 and 12.4, possibly before 12.4.1.15, allow remote attackers to inject arbitrary web script or HTML via 1 the Name field in an add new contact action in the Contacts section or unspecified...

MS14-025: Vulnerability in Group Policy Preferences Could Allow Elevation of Privilege (2962486)

The remote Windows host is potentially affected by a vulnerability in the way that Active Directory distributes passwords that are configured using Group Policy preferences. This could allow a remote attacker to retrieve and decrypt passwords stored with Group Policy preferences. The following...

Localize: ClickJacking

It allows remote attackers to do some clickjacking which can be used for adding arbitrary tasks . Why? Almost all of your page has missing X-FRAME-OPTIONS header. Websites are at risk of a clickjacking attack when they allow content to be embedded within a frame. An attacker may use this risk to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote attackers to inject arbitrary web script or HTML via the 1 tasks view or 2 search view...

CVE-2012-5566

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote attackers to inject arbitrary web script or HTML via the 1 tasks view or 2 search view...

CVE-2012-5566: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.17, as used in Horde Groupware Webmail Edition before 4.0.8, allow remote attackers to inject arbitrary web script or HTML via the 1 tasks view or 2 search view...

CVE-2014-2567

The vulnerability CVE-2014-2567 affects Trojita prior to 0.4.1. The issue is in OpenConnectionTask::handleStateHelper in Trojita’s IMAP code, where a PREAUTH response can be exploited by a man-in-the-middle to force saving a message into the sent or draft folder over plaintext, bypassing STARTTLS...

Siemens SIMATIC S7-1200多个漏洞

CVE ID: CVE-2014-2249,CVE-2014-2250,CVE-2014-2252,CVE-2014-2254,CVE-2014-2256,CVE-2014-2258 SIMATIC S7-1200是可编程控制器，可实现简单却高度精确的自动化任务。 Siemens SIMATIC S7-1200 4.0.0之前版本在实现上存在多个漏洞，可被恶意利用执行跨站请求伪造、劫持用户会话、造成拒绝服务。 1、向TCP端口443发送特制的数据包造成的错误可造成设备进入defect模式。 2、随机生成器内弱熵相关错误，可导致劫持另外用户的会话。...

Design/Logic Flaw

Use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in modules/webdatabase/DatabaseThread.cpp in the web database implementation in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecifie...

CVE-2014-1702

Use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in modules/webdatabase/DatabaseThread.cpp in the web database implementation in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecifie...

CVE-2014-1702

Use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in modules/webdatabase/DatabaseThread.cpp in the web database implementation in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecifie...