Drupal 7 driver for SQL Server and SQL Azure - Moderately Critical - SQL Injection - SA-CONTRIB-2015-148

Drupal 7 driver for SQL Server and SQL Azure module has a SQL injection vulnerability. Certain characters aren't properly escaped by the Drupal database API. A malicious user may be able to access restricted information by performing a specially-crafted search. Only sites that use contrib or cust...

Anchor CMS 0.9.2 Cross Site Scripting / Open Redirect

Anchor CMS 0.9.2: XSS Security Advisory – Curesec Research Team 1. Introduction Affected Product: Anchor CMS 0.9.2 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: Website: http://anchorcms.com/ Vulnerability Type: XSS and Open Redirect Remote Exploitable: Yes Reported to vendor:...

ZeusCart 4.0 Code Execution

ZeusCart 4.0: Code Execution Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to vendor: 08/13/2015 Disclose...

[security bulletin] HPSBMU03392 rev.2 - HP ArcSight Logger, Remote Authorization Bypass

Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04762372 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04762372 Version: 2 HPSBMU03392 rev.2 - HP ArcSight Logger, Remote Authorization...

These Top 30 Ashley Madison Passwords are just as Terrible as You'd Think

Yes, you heard it correct! First the Password Cracking Team 'CynoSure Prime' cracked more than 11 Million Ashley Madison’s passwords in just 10 days quite an achievement, though, now a member of the team shares the same list of passwords with few calculations. The calculations are... ...What...

Open Automation Software OPC Systems NET DLL Hijacking Vulnerability

OVERVIEW Ivan Sanchez from Nullcode Team has identified a DLL Hijacking vulnerability in Open Automation Software’s OPC Systems.NET application. Open Automation Software has reviewed the vulnerability and determined not to patch the issue at this time. This vulnerability could be exploited remote...

Hacker Demonstrated Untethered iOS 9 Jailbreak On Video

Good News for Jailbreakers! Just within 24 Hours after the launch of iOS 9 at Apple's Annual Event, a well-known iOS hacker has managed to untether jailbreak iOS 9. That's quite impressive. Believe it, iOS 9 has been Jailbroken! A reputed hacker 'iH8sn0w', who previously developed the popular...

Pangu disclosure iOS8. 4. 1 kernel exploit Apple to iOS9 in the repair section-Vulnerability warning-the black bar safety net

Yesterday, China's first successful jailbreak the iOS team Pangu team discloses 3 present in the iOS 8.4.1 kernel extension at the vulnerabilities: a stack overflow Bug, an out of bounds memory access Bug, a stack overflow Bug. One of the“perfect”could be compromised all the kernel protection and...

Turla APT Group Abusing Satellite Internet Links

Poorly secured satellite-based Internet links are being abused by nation-state hackers, most notably by the Turla APT group, to hide command-and-control operations, researchers at Kaspersky Lab said today. Active for close to a decade, Turla’s activities were exposed last year; the Russian-speaki...

Twitter - Moderately Critical - Access bypass - SA-CONTRIB-2015-146

This module enables you to pull in public tweets from Twitter accounts, post messages to Twitter to announce content changes, and authenticate using Twitter. The module doesn't sufficiently check for access when using the Twitter Post submodule to post messages to Twitter and allows a tweet to be...

200 Million WhatsApp Users Vulnerable to vCard Vulnerability

WhatsApp recently claimed to have hit 900 Million monthly active users, but a dangerous security flaw in the web version of the popular instant messaging app puts up to 200 Million of its users at risk. Yes, the web-based extension of WhatsApp is vulnerable to an exploit that could allow hackers ...

September 2015 Security Update Release Summary

Today we released security updates to provide protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month’s security updates and advisories can be found in the Security TechNet Librar...

These Top 7 Brutal Cyber Attacks Prove 'No One is Immune to Hacking' — Part I

If you believe that your organization is not at real risk of cyber attack, then you are absolutely wrong. Incidents of massive data breaches, advanced cyber attacks coming from China, groups like Syrian Electronic Army, Hacking Point of Sale machines at retailers such as Target have splashed acro...

WordPress eShop 6.3.13 Cross Site Scripting

" / Exploit : -- alertdocument.cookie setTimeout'form1.submit', 1;...

CVE-2015-6580

Multiple unspecified vulnerabilities in Google V8 before 4.5.103.29, as used in Google Chrome before 45.0.2454.85, allow attackers to cause a denial of service or possibly have other impact via unknown vectors...

Moderate: Red Hat Security Advisory: openshift security update

Updated openshift packages that fix one security issue are now available for Red Hat OpenShift Enterprise 3.0. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

WordPress sourceAFRICA 0.1.3 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sourceafrica/ Date: 2015-08-29 Tested On : Elementary Os - Firefox Software Link...

NibbleBlog 4.0.3 Shell Upload

NibbleBlog 4.0.3: Code Execution Security Advisory – Curesec Research Team 1. Introduction Affected Product: NibbleBlog 4.0.3 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: Website: http://www.nibbleblog.com/ Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to...

TWiki debugenableplugins RCE

Remote code execution vulnerability in TWiki debugenableplugins Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

WordPress Swim Team Plugin 1.44.10777 - Arbitrary File Download

The code in ./wp-swimteam/include/user/download.php doesn't sanitize user input from downloading sensitive system files: 50 $file = urldecode$args'file' ; 51 $fh = fopen$file, 'r' or die'Unable to load file, something bad has happened.' ; 52 53 while !feof$fh 54 $txt .= fread$fh, 1024 ; 55 56 //...