15747 matches found
Updated perl packages fix security vulnerability
John Lightsey and Todd Rinaldo reported that the opportunistic loading of optional modules can make many programs unintentionally load code from the current working directory which might be changed to another directory without the user realising and potentially leading to privilege escalation...
Joomla SP Movie Database 1.4 SQL Injection
Exploit Title: SP Movie Database - SQL Injection Vulnerability Google Dork: inurl:option=comspmoviedb Date: 29.12.2017 Author: pwny Source Component : https://extensions.joomla.org/extension/sp-movie-database/ Version : 1.4 Tested on: Kali Linux proof : https://ibb.co/cjdiZw Search Form in Home...
libreoffice/htmlfuzzer: Bad-cast to SdrObject from SwTextFormatColl in SwHTMLParser::ResizeDrawObject
Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=6745890124464128 Project: libreoffice Fuzzer: libFuzzerlibreofficehtmlfuzzer Fuzz target binary: htmlfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash...
IBM Rational Team Concert and Rational Collaborative Lifecycle Management Cross-Site Scripting Vulnerability
IBM Rational Team Concert RTC and Rational Collaborative Lifecycle Management CLM are both collaborative lifecycle management solutions from IBM USA. A cross-site scripting vulnerability exists in IBM RTC and Rational CLM. A remote attacker could exploit this vulnerability to inject arbitrary...
CVE-2017-1365
IBM Team Concert RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...
Cross site scripting
IBM Team Concert RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...
CVE-2017-1365
IBM Team Concert (RTC) and IBM Rational CLM are affected by a cross-site scripting vulnerability in the Web UI that can allow an attacker to inject arbitrary JavaScript and potentially disclose credentials within a trusted session. The CVE entry covers IBM Rational CLM/RRC components including CL...
VIDEO: Carbon Black’s Agile Transformation
In 2017, our product team went through a major "Agile Transformation." All employees adopted this new way of working to establish better collaboration within and across teams. We’ve restructured our teams to be smaller and more cross-functional. We’ve hired Agile Coaches and Scrum Masters to keep...
Xbox 360 Aurora 0.6b Default Credentials / FTP BruteForce Exploit
Exploit for linux platform in category remote exploits Exploit Title: XBOX 360 Aurora 0.6b Default Credentials / FTP BruteForce Date: 20/12/2017 Exploit Author: Daniel Godoy Vendor Homepage: http://phoenix.xboxunity.net//news Tested on: XBOX 360 GREETZ: Iker Legorreta, RemoteExecution Team...
Trend Micro InterScan Messaging Security Virtual Appliance WizardSetting_sys.imss RCE
Remote command execution vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance WizardSettingsys.imss sysdesname parameter Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...
vBulletin LFI
Local file include vulnerability in vBulletin routestring parameter Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...
libreoffice/fodsfuzzer: Heap-buffer-overflow in rtl_string_newFromStr
Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5008090362544128 Project: libreoffice Fuzzer: libFuzzerlibreofficefodsfuzzer Fuzz target binary: fodsfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...
ruby -- Command injection vulnerability in Net::FTP
Etienne Stalmans from the Heroku product security team reports: There is a command injection vulnerability in Net::FTP bundled with Ruby. Net::FTPget, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernelopen to open a local file. If the localfile argument starts with the pip...
Fixed in Apache Tomcat 8.0.48
Low: Incorrectly documented CGI search algorithm CVE-2017-15706 As part of the fix for bug 61201, the description of the search algorithm used by the CGI Servlet to identify which script to execute was updated. The update was not correct. As a result, some scripts may have failed to execute as...
IT Security Team Staffing Shortages: Managing Risks and Attracting Talent
A company's C-suite has multiple priorities during this time of year: Getting next year's budget squared away while also ensuring the business is on a path toward its upcoming goals are two items high on this list. Another key element that executives must consider heading into 2018 is staffing...
open62541/fuzz_binary_message: Crash in copyAttributeIntoNode
Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=6657398270853120 Project: open62541 Fuzzer: aflopen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: aflasanopen62541 Platform Id: linux Crash Type: UNKNOWN WRITE Crash...
Infogram: New team invitation functionality allows extend team without upgrade
Privilege escalation vulnerability was found, which allowed to bypass the limitation of team members...
team-lab.com XSS vulnerability
Open Bug Bounty ID: OBB-449554 Description| Value ---|--- Affected Website:| team-lab.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
X (Formerly Twitter): Improper Host Detection During Team Up on tweetdeck.twitter.com
Hi Give this url https://twitter.com/teams/authorize?targetscreenname=&authorizecallback=https%3A%2F%2F%0Agoogle.com%[email protected] to any authorised user for team up and after authorization of his 2nd account he will be redirected to google.com . First I tried to make it malicious with adding...