Joomla 3.2.x - 3.4.4 - SQL Injection Vulnerability

Exploit for php platform in category web applications --==Mannu joomla SQL Injection exploiter by Team Indishell==-- body font-family: Tahoma; color: white; background: 444444; input border : solid 2px ; border-color : black; BACKGROUND-COLOR: 444444; font: 8pt Verdana; color: white; submit BORDE...

Security advisory for Bugzilla 5.0, 4.4.9, and 4.2.14

Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issue has been discovered in Bugzilla: Login names longer than 127 characters can be corrupted, which could lead to the creation of a user account with an unexpected ema...

[CORE-2015-0013] - FortiClient Antivirus Multiple Vulnerabilities

Advisory Information Title: FortiClient Antivirus Multiple Vulnerabilities Advisory ID: CORE-2015-0013 Advisory URL: http://www.coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities Date published: 2015-09-01 Date of last update: 2015-09-01 Vendors contacted: Fortinet...

Webform CiviCRM Integration - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-160

Webform CiviCRM Integration allows you to add CiviCRM fields to a Drupal Webform. The module doesn't sufficiently escape user input. Some of the vulnerabilities are mitigated by the fact that an attacker must have a role with the permission to edit the webform node plus "access CiviCRM" to define...

jQuery Update - Less Critical - Open Redirect - SA-CONTRIB-2015-158

The jQuery Update module enables you to update jQuery on your site. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack see SA-CORE-2015-004. Only sites with the Overlay module enabled are vulnerable. An incomplete fix for...

Hacking Team vulnerability to a wide range of hanging horse, millions computer recruitment-vulnerability warning-the black bar safety net

A, overview Recently, Tencent anti-virus lab intercepted a malicious extension Trojans a wide range of propagation, the total propagating the amount of millions, the analysis and investigation found that the Trojan has the following characteristics: 1）the Trojan horse is through a Web hang horse...

Nibbleblog 4.0.3 - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nibbleblog File Upload Vulnerability', 'Description' = %q Nibbleblog contains a flaw that allows a authenticated remote attacker...

HackerOne: Minimum bounty of a private program is visible for users that were removed from the program

Hello, Privileged information is getting leaked to an unauthorized user in the json response of https://hackerone.com/reports/.json. In a team there can be many members, also roles are defined. But an x-member of the team is getting information which should not be visible to him. As I tested it o...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.4 and fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. Common...

CVE-2015-7834

Multiple unspecified vulnerabilities in Google V8 before 4.6.85.23, as used in Google Chrome before 46.0.2490.71, allow attackers to cause a denial of service or possibly have other impact via unknown vectors...

Untethered Jailbreak for iOS 9.0, 9.0.1 and 9.0.2 Released

The Chinese Pangu jailbreak team has once again surprised everyone by releasing the first untethered jailbreak tool for iOS 9 – iOS 9.0, iOS 9.0.1, and iOS 9.0.2. The untethered jailbreak is a jailbreak where your device don't require any reboot every time it connects to an external device capabl...

MC Inventory Manager SQL Injection

Vulnerability title: MC Inventory Manager Authentication Bypass Exploit Author : Ashiyane Digital Security Team Product: MC Inventory Manager Date: 2015.10.13 Vendor Homepage: http://microcode.ws/inventory-manager.php Introduction: ============= Manage and maintain inventory of your company, item...

October 2015 Security Update Release Summary

Today we released security updates to provide protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month’s security updates and advisories can be found in the Security TechNet Librar...

Solarwinds Storage Manager ProcessFileUpload.jsp File Upload

File upload vulnerability in Solarwinds Storage Manager ProcessFileUpload.jsp Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

How to Install Receiver Windows 4.2 Desktop Lock

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. This article explains howto install Receiver for Windows 4.2 desktop lock...

PayPal Inc - Bypass & Session Fixation Vulnerability

Document Title: =============== PayPal Inc - Bypass & Session Fixation Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1615 Video: https://www.youtube.com/watch?v=Uyg8xlt-8go Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1509 Release Date:...

Zope Management Interface 4.3.7 - CSRF Vulnerabilities

Exploit for php platform in category web applications Product: ================================ Zope Management Interface 4.3.7 Zope is a Python-based application server for building secure and highly scalable web applications. Plone Is a Content Management System built on top of the open source...

Colorbox - Access bypass - Less Critical - SA-CONTRIB-2015-156

This module allows for integration of Colorbox, a jQuery lightbox plugin, into Drupal. The module allows unprivileged users to add unexpected content to a Colorbox, including content from external sites. This allows an unprivileged user to deface a site. This vulnerability is mitigated by the fac...

Entity Registration - Moderately Critical - Information Disclosure - SA-CONTRIB-2015-155

This module enables you to manage registrations for events. The module doesn't sufficiently protect information about who is registered to attend specific events when anonymous users are granted a permission that is commonly recommended when allowing anonymous registrations. This vulnerability is...

Cross-Site Scripting in subscribetocalendar.action

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48910. panel The contents of the 'subCalendarId' parameter is not validated in POST requests to 'subscribetocalendar.action' and...