Cells Blog 3.4 Cross Site Scripting

----------------------------------------------------------- foun by :kurd-team , Exploiter group : kurdish hackers team contact : [email protected] site : facebook.com/kurdteam ----------------------------------------------------------- ------------------------script-----------------------------...

xnews 3-0-0 Cross Site Scripting

=========================================================== xnews3-0-0 XSS Vulnerability ----------------------------------------------------------- foun by :kurd-team , Exploiter group : kurdish hackers team contact : [email protected] site : kurdsystem.com...

SA-CONTRIB-2014-045 - Drupal Commons - Multiple Vulnerabilities

This SA contains two patches against Drupal Commons Views Bulk Operations Access Bypass Drupal commons comes with a view to moderate reported content, which is intended for authenticated users to view which content has been reported. Since it has hard coded VBO operations within the view, and...

ORACLE Subdomain Page Defaced by Indian Hacker

A group of Indian Hackers dubbed as I-HOS TEAM has successfully defaced a page on the sub domain of Oracle Corporation, biggest provider of enterprise software, computer hardware and Services. The users visiting the domain are being greeted with a custom webpage with black background and the them...

vBulletin 5.1 Cross Site Scripting

Exploit Title: vBulletin 5.1 Multiple XSS vulnerabilities Authors: Romanian Security Team Website: https://rstforums.com/forum/ Date published: 19 April 2014 Software: vBulletin Version: 5.1.1 Alpha 9 XSS Random topic -...

CentOS 5 / 6 : java-1.6.0-openjdk (CESA-2014:0408)

Updated java-1.6.0-openjdk packages that fix various security issues and one bug are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

The Keen Team - Chinese Hacker Group Reveals their Identities

The Keen Team – a mysterious group of Chinese hackers who hacked Apple’s Safari Mac OS X Mavericks system in just 20 seconds and Windows 8.1. Adobe Flash in only 15 seconds during Pwn2Own Hacking Competition this year, are no more mysterious as the team revealed its members identity. In an...

SA-CONTRIB-2014-041 - Block Search - SQL Injection

Block Search module provides an alternative way of managing blocks. The module doesn't properly use Drupal's database API resulting in user-provided strings being passed directly to the database allowing SQL Injection. This vulnerability is mitigated by the fact that an attacker must either use a...

vtiger CRM 6.0 RC RCE

Remote command execution vulnerability in vtiger CRM Install Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Vtiger - 'Install' Remote Command Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Vtiger Install Unauthenticated Remote Command Execution', 'Description' = %q This module exploits an arbitrary command execution...

CVE-2014-1716

Cross-site scripting XSS vulnerability in the RuntimeSetPrototype function in runtime.cc in Google V8, as used in Google Chrome before 34.0.1847.116, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS UXSS."...

SA-CONTRIB-2014-040 - Skeleton theme - Cross Site Scripting

The Skeleton theme is a responsive Drupal theme, built upon the Skeleton Boilerplate. The Skeleton theme does not properly sanitize theme settings before they are used in the output of a page. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...

CA20140403-01: Security Notice for CA Erwin Web Portal

-----BEGIN PGP SIGNED MESSAGE----- CA20140403-01: Security Notice for CA Erwin Web Portal Issued: April 03, 2014 CA Technologies Support is alerting customers to multiple vulnerabilities with CA Erwin Web Portal. The vulnerabilities, CVE-2014-2210, occur due to insufficient path verification. A...

5-year-old Boy discovers Microsoft Xbox Password Bypass vulnerability

A 5-year-old San Diego boy managed to hack one of the most popular gaming systems in the world, Xbox and has now been acknowledged as a security researcher by Microsoft. Kristoffer Von Hassel uncovered a vulnerability in Xbox Live's password system, that would allow someone to log into a Xbox...

Important: Red Hat Security Advisory: libyaml security update

Updated libyaml packages that fix two security issues are now available for Red Hat Enterprise Linux OpenStack Platform 3. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severi...

Important: Red Hat Security Advisory: libyaml security update

Updated libyaml packages that fix two security issues are now available for Red Hat Enterprise Linux OpenStack Platform 4. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severi...

Apple Fixes More Than 25 Flaws in Safari

Apple has updated its Safari browser, dropping a pile of security fixes that patch more than 25 vulnerabilities in the WebKit framework. Many of the vulnerabilities Apple repaired in Safari can lead to remote code execution, depending upon the attack vector. There are a number of use-after-free...

vTiger CRM 5.4.0 kcfinder LFI

Local file include vulnerability in vtiger CRM kcfinder component Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

vTiger CRM 5.4.0 kcfinder File Upload

File upload vulnerability in vtiger CRM kcfinder component Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

SA-CONTRIB-2014-035 - CAS Server - Access Bypass

The casserver module of the CAS project implements the CAS 1.0 and 2.0 specifications for providing a single sign-on to relying party web application the "service" in CAS specs. The CAS server creates single-use tickets when serving a user's login request, which is subsequently deleted when the...