15699 matches found
FUT 15 Ultimate Team Companion - Dynamic Code Loading, External URLs, Suspicious files vulnerabilities
HackApp vulnerability scanner discovered that application FUT 15 Ultimate Team Companion published at the 'play' market has multiple vulnerabilities...
Joomla! Administrator File Upload [Templates]
Joomla! allows administrators to create and edit files using the template management page Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...
Joomla! Administrator File Upload [Extensions]
Joomla! allows administrators to upload extensions. Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...
Threat Outbreak Alert RuleID22013: Email Messages Distributing Malicious Software on March 31, 2016
Medium Alert ID: 44382 First Published: 2016 March 31 14:14 GMT Last Updated: 2016 April 1 12:36 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22013 and...
Axil CMS 0.1 SQL Injection
Exploit Title : Axil CMS 0.1 Authentication bypass Exploit Author : Persian Hack Team Vendor Homepage : http://www.axilcreations.com/ Date: 2016/03/31 Version : 0.1 PoC: User And Pass : '=' 'or' Demo : http://www.mets.com.np/myadmin/ http://www.princeies.com/myadmin/...
Apple QuickTime < 7.7.79.80.95 - FPX File Parsing Memory Corruption 2
Exploit for multiple platform in category dos / poc Application: Apple Quicktime Platforms: Windows, OSX Versions: before version 7.7.79.80.95 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG @protekresearch CVE-2016-1768 1 Introduction 2 Report...
PayPal Bug Bounty #121 - Bypass & Persistent Vulnerability
Document Title: =============== PayPal Bug Bounty 121 - Bypass & Persistent Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1696 Video: https://www.youtube.com/watch?v=ilLmbVC7RVY Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1627 Release...
Trello: If a team is public, the web socket receives data about the Team visible boards
When viewing a public team, users are allowed to connect to an update channel that notifies them of changes made to the team. When a "team visible" not public board was added or removed from a public team, an update with the name of the team would be sent to all subscribers, potentially including...
99 Problems but Two-Factor Ain’t One
Two-factor authentication is a best practice for securing remote access, but it is also a Holy Grail for a motivated red team. Hiding under the guise of a legitimate user authenticated through multiple credentials is one of the best ways to remain undetected in an environment. Many companies rega...
Login one time - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-017
The Login one time module provides the ability to email one-time login links to users. The module doesn't sufficiently sanitize user input supplied to an ajax callback function. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordance with Drupal Security...
Joomla Easy Youtube Gallery 1.0.2 SQL Injection
Exploit Title : Joomla Easy Youtube Gallery 1.0.2 SQL Injection Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/easy-youtube-gallery Google Dork : inurl:comeasyyoutubegallery mycategory Date: 2016/03/22 Version: 1.0.2 PoC: mycategory=SQL...
Joomla iCagenda 3.5.15 Cross Site Scripting
Exploit Title : Joomla iCagenda Cross Site Scripting Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/calendars-a-events/icagenda Google Dork : inurl:index.php?option=comicagenda Date: 2016/03/22 Version: 3.5.5 up to 3.5.15 Payload : " Demo...
HackerOne: External programs revealing info
A bug in an authorization check was found by @1337coder on an endpoint that was showing the members of a team, as well as the team member groups that were set up. Example output: "id":1, "username":"dirk", "name":"dirk", "bio":"", "url":"https://hackerone.com/dirk" , "id":2, "name":"Admin",...
Joomla! Component Easy Youtube Gallery 1.0.2 - SQL Injection
Joomla! Component Easy Youtube Gallery 1.0.2 - SQL Injection Exploit Title : Joomla Easy Youtube Gallery 1.0.2 SQL Injection Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/easy-youtube-gallery Google Dork : inurl:comeasyyoutubegallery...
Joomla! Component Easy Youtube Gallery 1.0.2 - SQL Injection
Exploit Title : Joomla Easy Youtube Gallery 1.0.2 SQL Injection Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/easy-youtube-gallery Google Dork : inurl:comeasyyoutubegallery mycategory Date: 2016/03/22 Version: 1.0.2 PoC: mycategory=SQL...
Joomla Easy YouTube Gallery 1.0.2 - SQL Injection
Exploit for php platform in category web applications Exploit Title : Joomla Easy Youtube Gallery 1.0.2 SQL Injection Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/easy-youtube-gallery Google Dork : inurl:comeasyyoutubegallery mycategory...
Pwn2Own Day Two: Safari, Microsoft Edge Go Down Winner Announced
In the end, it was a nail-biter pitting Tencent Security Team Sniper KeenLab and PC Manager against JungHoon Lee lokihardt for the title of Master of Pwn for Pwn2Own 2016. After a tense last two minutes of the competition, it was Tencent Security Team Sniper and its successful code execution of a...
Zenphoto 1.4.11 Remote File Inclusion
Security Advisory - Curesec Research Team 1. Introduction Affected Product: Zenphoto 1.4.11 Fixed in: 1.4.12 Fixed Version Link: https://github.com/zenphoto/zenphoto/archive/ zenphoto-1.4.12.zip Vendor Website: http://www.zenphoto.org/ Vulnerability Type: RFI Remote Exploitable: Yes Reported to...
PivotX 2.3.11 Directory Traversal
Security Advisory - Curesec Research Team 1. Introduction Affected Product: PivotX 2.3.11 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://pivotx.net/ Vulnerability Type: Directory Traversal Remote Exploitable: Yes Reported to vendor: 01/20/2016 Disclosed to public: 03/15/2016...
Android Security Advisory — 2016-03-18Stay organized with collectionsSave and categorize content based on your preferences.
Android Security Advisories are supplemental to the Nexus Security Bulletins. Refer to our summary page for more information about Security Advisories. Summary Google has become aware of a rooting application using an unpatched local elevation of privilege vulnerability in the kernel on some...