Wetkit Omega - Moderately Critical - Access Bypass - SA-CONTRIB-2017-012

WetKit Omega 4.x is a modern, Sass and Compass enabled Drupal 7 theme powered by the Omega base theme. When using the Drupal page cache, some links intended for privileged users can get cached and displayed to users who shouldn't have access to them. This is mitigated by the fact that the...

Acquia Content Hub - Moderately Critical - Access Bypass - SA-CONTRIB-2017-013

The Acquia Content Hub module enables the distribution and discovery of content from any source using the Acquia Content Hub service. The module allows rendering of any arbitrary entity, without performing the appropriate access check. Users browsing to a well crafted URL could access information...

I got emails - G Suite Vulnerability

After recent finding about Uber and SendGrid bug, I decided to check other third party applications that were also used for similar cases. During the investigation, some third party applications were found to be vulnerable including G Suite. The initial research of this vulnerability started when...

Better Exposed Filters - Less Critical - Cross Site Sscripting (XSS) - SA-CONTRIB-2017-009

The Better Exposed Filters module gives site builders more choices for rendering Views' exposed form elements. The module does not sufficiently sanitize taxonomy term descriptions when the "Include the term description" option is selected. This vulnerability is mitigated by the fact that an...

Joomla JTAG Calendar 6.2.4 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla Component JTAG Calendar 6.2.4 - SQL Injection Vender Home : https://extensions.joomla.org/extension/jtag-calendar/ Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Home : http://persian-team.ir/ Tested on:...

Police Arrested Suspected Hacker Who Hacked the 'Hacking Team'

Remember the Hacker who hacked Hacking Team? In 2015, a hacker named Phineas Fisher hacked Hacking Team – the Italy-based spyware company that sells spying software to law enforcement agencies worldwide – and exposed some 500 gigabytes of internal data for anyone to download. Now, the Spanish...

Adapt CMS 3.0.3 File Upload

!usr/bin/python """ | Exploit Title: Adapt Cms Arbitrary File Upload | | Exploit Author: Ashiyane Digital Security Team | | Vendor Homepage: http://www.adaptcms.com/ | | Download Link : http://www.adaptcms.com/downloads/latestadaptcms.zip | | Tested Version : AdaptCMS 3.0.3 | | Tested on: Windows...

Joomla Store Locator 2.3.1.0 Cross Site Scripting

Exploit Title: Joomla Component Store Locator 2.3.1.0 - Cross-site scripting Date: 2017-1-28 Home : https://extensions.joomla.org/extension/store-locator/ Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Home : http://persian-team.ir/ Tested on: Windows AND Linux Telegram Channel ...

Joomla! Component JTAG Calendar 6.2.4 - search SQL Injection

Joomla! Component JTAG Calendar 6.2.4 - search SQL Injection Exploit Title: Joomla Component JTAG Calendar 6.2.4 - SQL Injection Date: 2017-1-28 Vender Home : https://extensions.joomla.org/extension/jtag-calendar/ Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Home :...

Joomla! Component JTAG Calendar 6.2.4 - 'search' SQL Injection

Exploit Title: Joomla Component JTAG Calendar 6.2.4 - SQL Injection Date: 2017-1-28 Vender Home : https://extensions.joomla.org/extension/jtag-calendar/ Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Home : http://persian-team.ir/ Tested on: Windows AND Linux Telegram Channel :...

Joomla JTAG Calendar 6.2.4 SQL Injection

Exploit Title: Joomla Component JTAG Calendar 6.2.4 - SQL Injection Date: 2017-1-28 Vender Home : https://extensions.joomla.org/extension/jtag-calendar/ Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Home : http://persian-team.ir/ Tested on: Windows AND Linux Telegram Channel :...

CVE-2017-3263

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Team Member. Supported versions that are affected are 8.2, 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with...

About the security content of iOS 9.3.4 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

About the security content of Xcode 7.3 - Apple Support

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website. For information about...

openWYSIWYG Insert Image 1.4.7 Arbitrary File Upload Vulnerability

openWYSIWYG Insert Image version 1.4.7 suffers from a remote arbitrary unauthenticated file upload vulnerability Exploit Title: openWYSIWYG | Insert Image v1.4.7 / Unauthenticated File Upload Date: 2017-1-15 Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Home :...

openWYSIWYG Insert Image 1.4.7 Arbitrary File Upload

Exploit Title: openWYSIWYG | Insert Image v1.4.7 / Unauthenticated File Upload Date: 2017-1-15 Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Home : http://persian-team.ir/ Tested on: Windows AND Linux Telegram Channel : @PersianHackTeam Google Dork :...

Hassium CMS 0.10 Cross Site Scripting

=============================================================| |A ExploitA Title:A A HassiumA CMSA CrossA SiteA Scripting | |A ExploitA Author:A AshiyaneA DigitalA SecurityA Team | |A VendorA Homepage:A http://www.hassium.org/index.php | |A DownloadA LinkA :A...

Autocomplete Deluxe - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-003

This module creates a new widget for taxonomy fields based on JQuery UI autocomplete. The module doesn't sufficiently escape the entered taxonomy terms thereby exposing a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have the permission ...

January 2017 security update release

Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month’s security updates and advisories can be found in the Security...

January 2017 security update release

Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month’s security updates and advisories can be found in the Security...