SA-CONTRIB-2013-023 - Varnish module - Cross Site Scripting (XSS)

This module provides integration between your Drupal site and the Varnish HTTP Accelerator, an advanced and very fast reverse-proxy system. The module doesn't sufficiently filter user-supplied text provided in the configuration settings. This vulnerability is mitigated by the fact that an attacke...

SA-CORE-2013-002 - Drupal core - Denial of service

Drupal core's Image module allows for the on-demand generation of image derivatives. This capability can be abused by requesting a large number of new derivatives which can fill up the server disk space, and which can cause a very high CPU load. Either of these effects may lead to the site becomi...

Scripts Genie Pet Rate Pro 4.9.9 SQL Injection / Command Execution

. . || || || | \ \ / | |/ // /\ \ \ |/ \ / / | |/ | | \ |\ \ \ \ / | | / \ / \ \ /| /| // /| ||\ | / / / / / / / www.janissaries.org ===================================================================== AuthorPentester: TheMirkin Special Thanks : Burtay and All Janissaries...

0101SHOP CMS SQL Injection

.:: In The Name Of God ::. 0101SHOP CMS SQL Injection Vulnerability Security Risk : High Discovered By IRaNHaCK Security Team MR.XpR Our WebSite : IRaNHaCK.ORG Tested On : XP , 7 , BackTrack Date : 2013-02-16 Version : All Category : WebApp...

Facebook Says Employee Laptops Compromised in 'Sophisticated' Attack

Laptops belonging to several Facebook employees were compromised recently and infected with malware that the company said was installed through the use of a Java zero-day exploit that bypassed the software’s sandbox. Facebook claims that no user data was affected by the attack and says that it ha...

Cometchat - Multiple Vulnerabilities

Exploit for php platform in category web applications / / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // Cometchat chat Application All Version Multiple Vulnerabilities Cometchat is a chat application which in use...

Apple iOS 6.1 - 2x PassCode Bypass Vulnerabilities

Document Title: =============== Apple iOS 6.1 - 2x PassCode Bypass Vulnerabilities References: =========== http://www.vulnerability-lab.com/getcontent.php?id=874 Advisory: http://www.vulnerability-lab.com/getcontent.php?id=875 View: http://www.youtube.com/watch?v=oKOj0GMf810 Release Date:...

Apple iOS 6.1 - 2x PassCode Bypass Vulnerabilities

Document Title: =============== Apple iOS 6.1 - 2x PassCode Bypass Vulnerabilities References: =========== http://www.vulnerability-lab.com/getcontent.php?id=874 Advisory: http://www.vulnerability-lab.com/getcontent.php?id=875 View: http://www.youtube.com/watch?v=oKOj0GMf810 Release Date:...

SA-CONTRIB-2013-015 - Manager Change for Organic Groups - Cross site scripting (XSS)

This module extends Organic Groups to allow the manager of a group to select a new manager for their group ie if they want to leave the group. The autocomplete field for selecting a new manager didn't properly filter usernames. The vulnerability is mitigated by the fact that Drupal's default...

Distributed Red Team Operations with Cobalt Strike

What if you could easily host malicious websites, send phishing emails, and manage compromised hosts across diverse internet addresses? This week's Cobalt Strike adds the ability to manage multiple attack servers at once. Here's how it works: When you connect to two or more servers, Cobalt Strike...

Apache OFBiz 10.04.01 RCE (Windows)

Remote command execution vulnerability in ApacheOFBiz FlexibleStringExpander Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Basilic 1.5.14 RCE

Remote command execution vulnerability in Basilic diff.php Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Symantec Web Gateway 5.0.3 RCE

Remote command execution vulnerability in Symantec Web Gateway fromha.php Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

SA-CONTRIB-2013-027 - Professional theme - Cross Site Scripting (XSS)

This third-party contributed theme change Drupal's interface. The theme doesn't properly sanitize user-entered content in the 3 slide gallery on the homepage leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would have to have the...

How the RSA Attackers Swung and Missed at Lockheed Martin

SAN JUAN, PUERTO RICO–The attack that resulted in the compromise of RSA’s SecurID database in 2011 had a lot of ramifications and sent shockwaves through much of the security industry. But it could have had much broader consequences had the security team at Lockheed Martin not discovered the same...

[security bulletin] HPSBST02839 SSRT101077 rev.1 - HP XP P9000 Command View Advanced Edition, Remote Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03650706 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03650706 Version: 1 HPSBST02839...

Cisco Unity Express Cross-Site Scripting Vulnerabilities

Cisco Unity Express contains multiple vulnerabilities that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerabilities are due to insufficient sanitization of user-supplied input processed by the Cisco Unity Express software. An unauthenticated,...

Wordpress plugins ForumConverter SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Important: Red Hat Security Advisory: mingw32-libxml2 security update

Updated mingw32-libxml2 packages that fix several security issues are now available for Red Hat Enterprise Linux 6. This advisory also contains information about future updates for the mingw32 packages, as well as the deprecation of the packages with the release of Red Hat Enterprise Linux 6.4. T...

Eugene Kaspersky

Costin Raiu, the head of the Kaspersky Lab Global Research and Analysis Team, Petr Merkulov, chief product officer, and CEO Eugene Kaspersky, discussed the need for better awareness of security threats and more comprehensive protection...