15694 matches found
Joomla JobGrok Listing 3.1-1.2.58 Component - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Joomla Component JobGrok Listing 3.1-1.2.58 - SQL Injection Date: 2017-04-02 Home : https://extensions.joomla.org/extensions/extension/ads-a-affiliates/jobs-a-recruitment/job-grok-list/ Discovered by : Mojtaba MobhaM...
Fixed in Apache Tomcat 7.0.77
Important: Information Disclosure CVE-2017-5647 A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong...
Joomla JobGrok Application 3.1-1.2.55 SQL Injection
Exploit Title: Joomla Component JobGrok Application 3.1-1.2.55 - SQL Injection Date: 2017-04-02 Home : https://extensions.joomla.org/extension/job-grok-app/ Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM [email protected] Home : http://persian-team.ir/ Telegram Channel AND...
Fixed in Apache Tomcat 8.0.43
Important: Information Disclosure CVE-2017-5647 A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong...
Aviation-Related Phishing Campaigns Seeking Credentials
A wave of email-based phishing campaigns is targeting airline consumers with messages that contain malware that infects systems or links to spoofed airline websites that are personalized to trick victims into handing over personal or business credentials. “Over the past several weeks, we have see...
FreeBSD : chromium -- multiple vulnerabilities (7cf058d8-158d-11e7-ba2c-e8e0b747a45a)
Google Chrome Releases reports : 5 security fixes in this release, including : - 698622 Critical CVE-2017-5055: Use after free in printing. Credit to Wadih Matar - 699166 High CVE-2017-5054: Heap buffer overflow in V8. Credit to Nicolas Trippar of Zimperium zLabs - 662767 High CVE-2017-5052: Bad...
VMSA-2017-0006 : VMware ESXi, Workstation and Fusion updates address critical and moderate security issues
a. ESXi, Workstation, Fusion SVGA memory corruption ESXi, Workstation, Fusion have a heap buffer overflow and uninitialized stack memory usage in SVGA. These issues may allow a guest to execute code on the host. VMware would like to thank ZDI and Team 360 Security from Qihoo for reporting these...
Mail.ru: Stored XSS in e.mail.ru (payload affect multiple users)
Hi, We have found a high risk level STORED XSS in e.mail.ru chat, the status change function allow to inject malicious payload in javascript & HTML, The attack affect multiple users and run in auto mode, no need a user interaction. Vulnerability affect any user that have been invited to your chat...
pfsense 2.3.2 Cross Site Request Forgery
Security Advisory - Curesec Research Team 1. Introduction Affected Product: pfsense 2.3.2 Fixed in: 2.3.3 Fixed Version Link: https://pfsense.org/download/ Vendor Website: https://www.pfsense.org/ Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 02/06/2017 Disclosed to public:...
VMSA-2017-0006:VMware ESXi, Workstation and Fusion updates address CRITICAL and MEDIUM security issues
VMSA-2017-0006 VMware ESXi, Workstation and Fusion updates address critical and moderate security issues VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2017-0006 VMware Security Advisory Severity: Critical VMware Security Advisory Synopsis: VMware ESXi, Workstation and Fusion...
LastPass Password Manager and then exposed a serious vulnerability, the browser-based Password Manager can also be used? - Vulnerability warning-the black bar safety net
No use cryptographic software before, we easily forget the password; use password software, we“reluctantly”leak the All password. LastPass, the popular password management software, recently again broke security vulnerabilities. Security personnel found in LastPass Chrome and Firefox 4.1.42 versi...
Joomla FocalPoint 1.2.3 SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Joomla Component FocalPoint 1.2.3 - SQL Injection Date: 2017-03-23 Home : https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/focalpoint/ Exploit Author: Persian Hack Team Discovered by : Mojtaba...
WMImplant – A WMI Based Agentless Post-Exploitation RAT Developed in PowerShell
Just over one year ago November 2015, I released WMIOps, a PowerShell script that enables a user to carry out different actions via Windows Management Instrumentation WMI on the local machine or a remote machine. WMIOps can: Start or stop a process. Return a list of all running processes. Power...
A Red Teamer’s guide to pivoting
A Red Teamer’s guide to pivoting A Red Teamer's guide to pivoting Penetration testers often traverse logical network boundaries in order to gain access to client’s critical infrastracture. Common scenarios include developing the attack into the internal network after successful perimeter breach o...
Joomla FocalPoint 1.2.3 SQL Injection
Exploit Title: Joomla Component FocalPoint 1.2.3 - SQL Injection Date: 2017-03-23 Home : https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/focalpoint/ Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM [email protected] Home :...
Office Hours - Moderately Critical - Cross Site Scripting - DRUPAL-SA-CONTRIB-2017-032
This module enables you to show the office hours of a location to the public. The module doesn't sufficiently filter user input for malicious Cross Site Scripting xss. This vulnerability is mitigated by the fact that an attacker must have a role with a permission to add fields to an entity. CVE...
Linkit - Moderately Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-033
Linkit provides an easy interface for internal and external linking with WYSIWYG editors by using an autocomplete field. When searching for entities, this module doesn't always enforce the access restrictions and users may see information about entities they should not be able to access. This is...
Unspecified Vulnerability in IBM Jazz Team Server
IBM Jazz Team Server is a set of project management tools for use in IBM Rational Jazz team collaboration platform from IBM in the United States. A security vulnerability exists in the CLM application in IBM Jazz Team Server. An attacker could exploit the vulnerability to gain access to user...
