April 2016 Security Update Release

Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month’s security updates and advisories can be found in the Security...

DirectAdmin Control Panel 1.50.0 Cross Site Scripting

@@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@...

Drupal Commerce - Less Critical - Information disclosure - SA-CONTRIB-2016-019

This module enables you to build an online store that uses nodes to display products through the use of product reference fields. The default widget for those fields is an autocomplete textfield similar to the taxonomy term reference field's autocomplete widget. As you type in the textfield, the...

Trello: Payments informations are sent to the webhook when a team changes its visibility

If an attacker installed a webhook on an team, and the team subsequently changed it's visibility from private to public, the payload sent to the webhook to notify it of the visibility change could potentially have disclosed some information that the attacker shouldn't have had access to. For paid...

FIFA 15 Ultimate Team - Base64 encoded String, Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application FIFA 15 Ultimate Team published at the 'play' market has multiple vulnerabilities...

Skylanders Trap Team Quiz - Dangerous filesystem permissions, Exported ContentProvider, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Skylanders Trap Team Quiz published at the 'play' market has multiple vulnerabilities...

Ultimate Team Quiz - Demo - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Ultimate Team Quiz - Demo published at the 'play' market has multiple vulnerabilities...

Soccer Team Bus Battle Brazil - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Soccer Team Bus Battle Brazil published at the 'play' market has multiple vulnerabilities...

Fit Girls: Gymnastic Team Star - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Fit Girls: Gymnastic Team Star published at the 'play' market has multiple vulnerabilities...

SWAT Sniper Team - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application SWAT Sniper Team published at the 'play' market has multiple vulnerabilities...

Modern Air Combat: Team Match - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Modern Air Combat: Team Match published at the 'play' market has multiple vulnerabilities...

FUT 15 Ultimate Team Companion - Dynamic Code Loading, External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application FUT 15 Ultimate Team Companion published at the 'play' market has multiple vulnerabilities...

Joomla! Administrator File Upload [Templates]

Joomla! allows administrators to create and edit files using the template management page Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Joomla! Administrator File Upload [Extensions]

Joomla! allows administrators to upload extensions. Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Threat Outbreak Alert RuleID22013: Email Messages Distributing Malicious Software on March 31, 2016

Medium Alert ID: 44382 First Published: 2016 March 31 14:14 GMT Last Updated: 2016 April 1 12:36 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22013 and...

Axil CMS 0.1 SQL Injection

Exploit Title : Axil CMS 0.1 Authentication bypass Exploit Author : Persian Hack Team Vendor Homepage : http://www.axilcreations.com/ Date: 2016/03/31 Version : 0.1 PoC: User And Pass : '=' 'or' Demo : http://www.mets.com.np/myadmin/ http://www.princeies.com/myadmin/...

Apple QuickTime < 7.7.79.80.95 - FPX File Parsing Memory Corruption 2

Exploit for multiple platform in category dos / poc Application: Apple Quicktime Platforms: Windows, OSX Versions: before version 7.7.79.80.95 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG @protekresearch CVE-2016-1768 1 Introduction 2 Report...

PayPal Bug Bounty #121 - Bypass & Persistent Vulnerability

Document Title: =============== PayPal Bug Bounty 121 - Bypass & Persistent Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1696 Video: https://www.youtube.com/watch?v=ilLmbVC7RVY Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1627 Release...

Trello: If a team is public, the web socket receives data about the Team visible boards

When viewing a public team, users are allowed to connect to an update channel that notifies them of changes made to the team. When a "team visible" not public board was added or removed from a public team, an update with the name of the team would be sent to all subscribers, potentially including...

99 Problems but Two-Factor Ain’t One

Two-factor authentication is a best practice for securing remote access, but it is also a Holy Grail for a motivated red team. Hiding under the guise of a legitimate user authenticated through multiple credentials is one of the best ways to remain undetected in an environment. Many companies rega...