15699 matches found
GozNym Trojan Attackers Set Sights on Europe, Poland
The banking malware GozNym has legs; only a few weeks after the hybrid Trojan was discovered, it has reportedly spread into Europe and begun plaguing banking customers in Poland with redirection attacks. The malware has started targeting corporate, SMB, investment banking and consumer accounts at...
IrIran Shopping Script 4.1 Cross Site Scripting
Exploit Title : IrIran Shoping Script Cross Site Scripting Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://www.iriran.net/eshopbuilder/ Google Dork : "Powered by: IRIran.net" Date: 2016/04/26 Category: Webapps Tested on: Win /php Version : 4.1 PoC: Search Box Vulnerable ...
i-Tech Nepal Radio CMS 2.0 SQL Injection
Exploit Title : i-Tech Nepal Radio CMS SQL Injection Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://www.itechnepal.com Google Dork : "Powered By : i-Tech Nepal" inurl:php? Date: 2016/04/26 Category: Webapps Tested on: Win /php Version : 2.0 Vulnerable Inputs: + alid + i...
NVV Ticket Krauth ATM - (NaN) Devide by Zero Vulnerability
Document Title: =============== NVV Ticket Krauth ATM - NaN Devide by Zero Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1837 View Video: https://www.youtube.com/watch?v=iIT4gcboKjk Release Date: ============= 2016-04-25 Vulnerability Laboratory ID VL-ID...
Debian Security Advisory DSA 3554-1 (xen - security update)
Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-3158, CVE-2016-3159 XSA-172 Jan Beulich from SUSE discovered that Xen does not properly handle writes to the hardware FSW.ES bit when...
Slack: Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIs
Hi, I noticed while looking at an old article I made a while ago that some links were actually inserted as javascript:-links. Doing some modifications to these actually revealed that inside editing mode, no protection is added for getting arbitrary scripts to run. This means that by catching the...
Pass to kill the Windows of Badlock? The How to repair? - Vulnerability warning-the black bar safety net
Badlock Bug Badlock Bug description 2 0 1 6 years 4 on 1 on 2, Windows and Samba revealed a very critical security vulnerabilities. Samba 4.4.2, and 4.3.8 and 4.2.11 security updates are available. Please update your system. We are very determined hackers will soon use this vulnerability to attac...
Webnet CMS 1.2 XSS / File Disclosure / SQL Injection
Exploit Title : Webnet CMS Multiple Vulnerabilities Exploit Author : Persian Hack Team Vendor Homepage : http://www.webnet.ir/ Homepage : http://www.persian-team.ir Date: 2016/04/15 Version : 1.2 POC: 1-LFDLocal File Dislocation Explain : ids Parameter encode base64 Path , you can use...
ChitaSoft CMS 3 Cross Site Scripting
Exploit Title : ChitaSoft v3 CMS Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.chitasoft.com/products/3 Author Homepage : http://www.persian-team.ir Date: 2016/04/15 Version : 3 PoC: product.php?id=XSS Payload = ' Demo:...
April 2016 Security Update Release
Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month’s security updates and advisories can be found in the Security...
DirectAdmin Control Panel 1.50.0 Cross Site Scripting
@@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@...
Drupal Commerce - Less Critical - Information disclosure - SA-CONTRIB-2016-019
This module enables you to build an online store that uses nodes to display products through the use of product reference fields. The default widget for those fields is an autocomplete textfield similar to the taxonomy term reference field's autocomplete widget. As you type in the textfield, the...
Trello: Payments informations are sent to the webhook when a team changes its visibility
If an attacker installed a webhook on an team, and the team subsequently changed it's visibility from private to public, the payload sent to the webhook to notify it of the visibility change could potentially have disclosed some information that the attacker shouldn't have had access to. For paid...
FIFA 15 Ultimate Team - Base64 encoded String, Customized SSL, Redefined SSL Common Names verifier vulnerabilities
HackApp vulnerability scanner discovered that application FIFA 15 Ultimate Team published at the 'play' market has multiple vulnerabilities...
Skylanders Trap Team Quiz - Dangerous filesystem permissions, Exported ContentProvider, MIT license vulnerabilities
HackApp vulnerability scanner discovered that application Skylanders Trap Team Quiz published at the 'play' market has multiple vulnerabilities...
Ultimate Team Quiz - Demo - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Ultimate Team Quiz - Demo published at the 'play' market has multiple vulnerabilities...
Soccer Team Bus Battle Brazil - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities
HackApp vulnerability scanner discovered that application Soccer Team Bus Battle Brazil published at the 'play' market has multiple vulnerabilities...
Fit Girls: Gymnastic Team Star - Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Fit Girls: Gymnastic Team Star published at the 'play' market has multiple vulnerabilities...
SWAT Sniper Team - Dynamic Code Loading, External URLs, Native code usage vulnerabilities
HackApp vulnerability scanner discovered that application SWAT Sniper Team published at the 'play' market has multiple vulnerabilities...
Modern Air Combat: Team Match - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities
HackApp vulnerability scanner discovered that application Modern Air Combat: Team Match published at the 'play' market has multiple vulnerabilities...