ADOdb < 4.71 - Cross Site Scripting

ADOdb Cross Site Scripting Vendor: John Lim Product: ADOdb Version: currpage = $SESSION$currpage; The above code is taken from adodb-pager.inc.php @ lines 72-77 and ultimately set's the $this-currpage variable to unsanitized user supplied input. Later on this variable is used when drawing the lin...

Stable Channel Update for Chrome OS

The Stable channel has been updated to 48.0.2564.116 Platform version: 7647.84.0 for all Chrome OS devices. This build contains a number of bug fixes, and security fixes. Systems will be receiving updates over the next several days. Security Fixes Note: Access to bug details and links may be kept...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2016:0175 Updated glibc packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base...

Commerce Authorize.Net SIM/DPM Payment Methods - Access Bypass - DRUPAL-SA-CONTRIB-2016-006

This module enables you to make credit card payments for Drupal Commerce orders via the Authorize.Net payment gateway using either their SIM hosted payment page or DPM direct post method mechanisms. The module doesn't sufficiently protect against the premature triggering of order completion witho...

RHEL 6 : glibc (RHSA-2016:0175)

Updated glibc packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Dimofinf CMS 3.0.0 Cross Site Scripting

Exploit Title : Dimofinf CMS 3.0.0 Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.dimofinf.net/index.php Google Dork : "Powered by Dimofinf cms Version 3.0.0" Date: 2016/02/17 Version = 3.0.0 PoC: Username: MobhaM" onmouseover=alert"MobhaM" bad=" Password : 0...

RHEL 6 / 7 : glibc (RHSA-2016:0225)

Updated glibc packages that fix one security issue are now available for Red Hat Enterprise Linux 6.2, 6.4, and 6.5 Advanced Update Support, and Red Hat Enterprise Linux 6.6 and 7.1 Extended Update Support. Red Hat Product Security has rated this update as having Critical security impact. A Commo...

CentOS 6 : glibc (CESA-2016:0175)

Updated glibc packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Critical: Red Hat Security Advisory: glibc security and bug fix update

Updated glibc packages that fix two security issues and two bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Critical: Red Hat Security Advisory: glibc security update

Updated glibc packages that fix one security issue are now available for Red Hat Enterprise Linux 6.2, 6.4, and 6.5 Advanced Update Support, and Red Hat Enterprise Linux 6.6 and 7.1 Extended Update Support. Red Hat Product Security has rated this update as having Critical security impact. A Commo...

DLA-416-1 eglibc - security update

Bulletin has no description...

A.Shop 3.9.3 Cross Site Scripting

Exploit Title : A.Shop 3.9.3 Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.ashopsoftware.com/tour-dx/shopping-cart-catalog.htm Google Dork : inurl:"/ashop/catalogue.php?cat= " Date: 2016/02/12 Version = 3.9.3 PoC: msg=XSS Payload = alert1;...

PivotX CMS 2.3.10 Cross Site Request Forgery / Cross Site Scripting

" " " " "...

CAS - Moderately Critical - Information Disclosure - DRUPAL-SA-CONTRIB-2016-005

This module enables you to use your Drupal site as a client or server for the single sign on protocol CAS. This vulnerability only affects sites that use the "CAS Server" sub module. The module doesn't allow an administrator to restrict which CAS clients are allowed authenticate with the Drupal C...

Exponent 2.3.7 RCE

Remote command execution vulnerability in Exponent /install/index.php Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Embedded Media Field - Moderately Critical - Access Bypass - DRUPAL-SA-CONTRIB-2016-004

This module enables you to to display video, image, and audio files from various third party providers The module doesn't sufficiently sanitize path arguments under certain scenarios. This vulnerability is mitigated by the fact that an attacker must be able to trick an administrator into visiting...

Joomla Component com_mydyngallery SQL Injection

SQL Injection vulnerability in Joomla Mydyngallery Component directory parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

Vigilante Hackers Aim to Hijack 200,000 Routers to Make Them More Secure

The same "Vigilante-style Hacker," who previously hacked more than 10,000 routers to make them more secure, has once again made headlines by compromising more than 70,000 home routers and apparently forcing their owners to make them secure against flaws and weak passwords. Just like the infamous...

February 2016 Security Update Release Summary

Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month’s security updates and advisories can be found in the Security...

SMEweb 1.5f Cross Site Scripting / SQL Injection

Exploit Title : SMEweb 1.5f Multiple Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://www.ebizzi.net/ Google Dork : "Powered by SMEweb" Date: 2016/02/07 Version: 1.5f PoC: 1-Admin Page Bypass Username : '=''or' Password : '=''or' Demo :...