Design/Logic Flaw

An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference : 1999965...

CVE-2016-2981

An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference : 1999965...

CVE-2016-2981

The CVE-2016-2981 entry concerns an undisclosed vulnerability in the CLM applications of IBM Jazz Team Server that could allow unauthorized access to user credentials. The IBM bulletin for CLM/Jazz products (Rational Collaboration Lifecycle Management, QMR, RTC, DOORS Next Gen, etc.) lists affect...

VM Escape Earns Hackers $105K at Pwn2Own

Hackers managed to take down Microsoft Edge and escape a virtual machine to boot on the third day of Pwn2Own early Friday. Members from Qihoo’s 360 Security Team carried out the VM exploit, earning the group $105,000, by far the highest amount awarded to a group at the hacking challenge this week...

Bejtlich Moves On

Exactly six years ago today I announced that I was joining Mandiant to become the company's first CSO. Today is my last day at FireEye, the company that bought Mandiant at the very end of 2013. The highlights of my time at Mandiant involved two sets of responsibilities. First, as CSO, I enjoyed...

HumHub 1.0.1 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: HumHub 1.0.1 and earlier Fixed in: 1.1.1 Fixed Version https://www.humhub.org/en/download/default/form?version=1.1.1 Link: &type=zip Vendor Website: https://www.humhub.org/ Vulnerability XSS Type: Remote Yes Exploitable:...

HumHub 0.20.1 / 1.0.0-beta.3 Shell Upload

Security Advisory - Curesec Research Team 1. Introduction Affected Product: HumHub 0.20.1 / 1.0.0-beta.3 Fixed in: 1.0.0 Fixed Version https://www.humhub.org/en/download/default/form?version=1.0.0 Link: &type=zip Vendor Website: https://www.humhub.org/ Vulnerability Code Execution Type: Remote Ye...

Fixed in Apache Tomcat 7.0.76

Low: Information Disclosure CVE-2017-5648 While investigating bug 60718, it was noticed that some calls to application listeners did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to...

XSS Vulnerability in wiki markup

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-51825. panel Luke Jahnke of the Australia Post Digital Mailbox Security Team reported to Atlassian an XSS in nesting various...

XSS Vulnerability in wiki markup

Luke Jahnke of the Australia Post Digital Mailbox Security Team reported to Atlassian an XSS in nesting various markup...

XSS Vulnerability in wiki markup

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-51825. panel Luke Jahnke of the Australia Post Digital Mailbox Security Team reported to Atlassian an XSS in nesting various...

Joomla ALFContact 3.2.3 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla Component ALFContact 3.2.3 - SQL Injection Date: 2017-03-13 Home : https://extensions.joomla.org/extensions/extension/contacts-and-feedback/contact-forms/alfcontact/ Exploit Author: Persian Hack Team Discovered by : Mojta...

Fixed in Apache Tomcat 9.0.0.M18

Low: Information Disclosure CVE-2017-5648 While investigating bug 60718, it was noticed that some calls to application listeners did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to...

Joomla ALFContact 3.2.3 SQL Injection

Exploit Title: Joomla Component ALFContact 3.2.3 - SQL Injection Date: 2017-03-13 Home : https://extensions.joomla.org/extensions/extension/contacts-and-feedback/contact-forms/alfcontact/ Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM [email protected] Home :...

CVE-2017-5040

V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which allowed a remote attacker to read values in memory via a crafted HTML page...

CVE-2017-5030

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page...

Trend Micro SafeSync for Enterprise 3.2 check_nfs_server_status RCE

Remote command execution vulnerability in Trend Micro SafeSync for Enterprise checknfsserverstatus Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Using the Registry to Discover Unix Systems and Jump Boxes

On red team engagements, Mandiant consultants are often tasked with identifying and obtaining access to critical Unix systems within our client’s environments. The objectives may include obtaining payment card data on point of sale terminals or accessing intellectual property residing on Apple...

Joomla Akeeba Backup 5.2.5 Directory Traversal Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla Component Akeeba Backup 5.2.5 - Directory Traversal Date: 2017-03-07 Home : https://extensions.joomla.org/extensions/extension/access-a-security/site-security/akeeba-backup/ Version : Akeeba Backup Core 5.3.0.b1 2017-02-2...

Joomla Akeeba Backup 5.2.5 Directory Traversal

Exploit Title: Joomla Component Akeeba Backup 5.2.5 - Directory Traversal Date: 2017-03-07 Home : https://extensions.joomla.org/extensions/extension/access-a-security/site-security/akeeba-backup/ Version : Akeeba Backup Core 5.3.0.b1 2017-02-22 Exploit Author: Persian Hack Team Discovered by :...