WordPress Avenir-Soft Direct Download 1.0 XSS / CSRF Vulnerability

WordPress Avenir-Soft Direct Download plugin version 1.0 suffers from cross site request forgery and cross site scripting vulnerabilities. Exploit Title: Wordpress Avenir-Soft Direct Download Plug-in XSS/CSRF Exploit Author: Ashiyane Digital Security Team Vendor Homepage:...

CodoForum 3.3.1 SQL Injection

CodoForum 3.3.1: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team http://blog.curesec.com/article/blog/CodoForum-331-Multiple-SQL-Injection-Vulnerabilities-42.html 1. Introduction Affected Product: CodoForum 3.3.1 Fixed in: 3.4 Fixed Version Link:...

Havij Pro - Crash (PoC)

!/usr/bin/env python Exploit Title:Havij Pro Crash POC Tested:windows7 Sofrware Link:http://www.itsecteam.com/ Version:1.17 Email:[email protected] Author:M1x7e1@Safeye Team run python poc.py copy content to target click Analyze EDB-Note: tested and verified using version 1.6 Pro content = “\x41”...

Wordpress Avenir-Soft Direct Download Plug-in XSS/CSRF Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Wordpress Avenir-Soft Direct Download Plug-in XSS/CSRF Exploit Author: Ashiyane Digital Security Team Vendor Homepage: https://wordpress.org/plugins/avenirsoft-directdownload/ Date: 2015-08-06 Tested On: Kali Linux - FireFox...

WordPress Monetize 1.03 Cross Site Request Forgery / Cross Site Scripting

Exploit Title : Wordpress Monetize Plug-in XSS/CSRF Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/monetize/ Date: 2015-08-07 Tested On : Kali Linux - FireFox Software Link : https://downloads.wordpress.org/plugin/monetize.zip Version : 1.03...

Magento ShopLift RCE

Magento "ShopLift" vulnerability allows RCE Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

WordPress Avenir-Soft Direct Download 1.0 XSS / CSRF

Exploit Title: Wordpress Avenir-Soft Direct Download Plug-in XSS/CSRF Exploit Author: Ashiyane Digital Security Team Vendor Homepage: https://wordpress.org/plugins/avenirsoft-directdownload/ Date: 2015-08-06 Tested On: Kali Linux - FireFox Software Link:...

Microweber 1.0.3 Cross Site Request Forgery / Cross Site Scripting

Microweber v1.0.3 Stored XSS And CSRF Add Admin Exploit in...

Commerce Commonwealth (CBA) - Moderately Critical - Insufficient Verification of API Data - SA-CONTRIB-2015-136

This module enables you to pay for items on Drupal Commerce, using Commerce Commonwealth payment gateway. The module doesn't sufficiently validate the payment under certain specific scenarios. A malicious user can modify the urls used in gateway interaction with Commbank to make a failed payment...

Rig Exploit Kit 3.0 Claims 1 Million Malvertising Victims

LAS VEGAS – A rampant malvertising campaign fueled by a new version of the Rig Exploit Kit has claimed at least 950,000 victims worldwide and is doing so with an unprecedented success rate. Researchers at Trustwave said in advance of this week’s Black Hat conference that they have been watching...

WebStorm Web Design SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : WebStorm Web Design SQL Injection Vulnerability Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://www.webstorm.ca Google Dork 1 : "Web Design and Hosting by WebStorm" inurl:listingdetail.php?id= Google Do...

CVE-2 0 1 5-3 1 1 3 analysis-vulnerability warning-the black bar safety net

Fireeye in its 6-month 2 3 day post“Operation ceeinject. Gen! g Wolf”are discussed in a cyber-espionage group, known as APT3, in Adobe Flash using a 0day vulnerability. Unit42 also use the UPS tracking APT3 group, it was originated in China the invasion of the toolset, with the earlier of 0day...

ManageEngine Exchange Reporter Plus 4.7 SQL Injection

Arbitrary SQL statement execution in ManageEngine Exchange Reporter Plus RunQuery.jsp Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

Medical Website Design SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Medical Website Design SQL Injection Vulnerability Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://www.medicalpracticewebsitedesign.com/ Google Dork : "Medical Practice Website Design" inurl:.php?newsid...

Seawind Solution Bypass Admin Page Vulnerability

Exploit for php platform in category web applications Exploit Title : Seawind Solution Bypass Admin Page Vulnerability Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://india.seawindsolution.com/ Google Dork : intext:"Design & Developed By Seawind Solution Pvt.Ltd." Date:...

Meinestadt24 SQL Injection Vulnerability

Exploit for php platform in category web applications ------------------------ Exploit Title : Meinestadt24 SQL Injection Vulnerability Exploit Author : Ashiyane Digital Security Team Google Dork One : intext:© 2015 meinestadt24 Google Dork Two : inurl:nachrichten.php?artikelid= Date : 2015-7-25...

DSA-3315-1 chromium-browser - security update

Bulletin has no description...

wordpress -- XSS vulnerability

Gary Pendergast reports: WordPress versions 4.2.2 and earlier are affected by a cross-site scripting vulnerability, which could allow users with the Contributor or Author role to compromise a site. This was reported by Jon Cave and fixed by Robert Chapin, both of the WordPress security team...

Hacking Team Says It Always Sold 'Strictly Within the Law'

Hacking Team officials are disputing reports that the company sold its surveillance and intrusion software to oppressive regimes in countries that were under sanction. The company said it sold its products “strictly within the law and regulation as it applied at the time any sale was made.” The n...

Hacking Team: We're Victim of a Criminal Cyber Attack

Hacking Team, the Italy-based spyware company that sells spying software to law enforcement agencies worldwide, says the company has always operated with the law and regulation in an ethical manner. However, there was only one Violation of Law in this entire event, and that is – "the massive cybe...