SA-CONTRIB-2014-050 - Commerce Postfinance ePayment - Access Bypass

The Commerce Postfinance ePayment module provides commerce payment methods for the Postfinance e-Payment service provider. The module doesn't sufficiently validate incoming payment notification IPN messages. Sending a specifically crafted IPN message to an affected site allows an attacker to crea...

SA-CONTRIB-2014-052 - AddressField Tokens - Cross Site Scripting (XSS)

The AddressField Tokens module extends the addressfield module by adding token support. It also adds some convenient addressfield formatters and provides Webform addressfield integration. The module does not properly filter address field values, resulting in a Cross Site Scripting XSS vulnerabili...

Iranian Hackers Target US Defense Contractors

An Iranian hacking group has moved from politically motivated website defacements to a new specialty – cyberespionage. The group known as the Ajax Security Team has been outed as the perpetrators of a number of espionage operations against U.S.-based defense contractors in addition to targeting...

Zabbix httpmon.php SQL Injection

SQL Injection vulnerability in OpenEMR Zabbix httpmon.php applications parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

libXfont -- X Font Service Protocol and Font metadata file handling issues

Alan Coopersmith reports: Ilja van Sprundel, a security researcher with IOActive, has discovered several issues in the way the libXfont library handles the responses it receives from xfs servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues. Most of these...

Xshop Cross Site Scripting

Exploit Title: Iran XshoP XSS Vulnerability Google Dork: Dork Is PerSian ! See End Of Demo ! Date: 2014-03-27 Exploit Author: Medrik Vendor Homepage: http://www.xshopsaz.ir/ Tested on: Windows ----------------- Proof : Vulnerability in : index.php Page With ftp Paramter ! Exploit :...

WordPress Bonuspressx Cross Site Scripting

Exploit Title : Wordpress Bonuspressx Plugin Cross Site Scripting + Exploit Author : Ashiyane Digital Security Team + Vendor Homepage : http://wordpress.org + Google Dork : inurl:/wp-content/plugins/bonuspressx + Date : 2014-04-23 + Tested on : Windows 7 , Mozilla FireFox + Exploit : Cross Site...

Wordpress Search Everything SQL Injection

SQL Injection vulnerabilty in Wordpress Search Everything plugin Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

For the recent Bosch global eye OAuth vulnerability analysis and preventive recommendations-vulnerability warning-the black bar safety net

According to CnetreportsSingapore Nanyang Technological University, a man named Wang Jing PhD student, found that the OAuth and OpenID open source login tools the“covert redirect”vulnerabilityCovert Redirect to. First of all need to clear point is that the vulnerability is not present in the OAut...

AssistMyTeam Team Helpdesk - Multiple Information Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/67271/info AssistMyTeam Team Helpdesk is prone to multiple information-disclosure vulnerabilities. Successfully exploiting these issues may allow an attacker to obtain sensitive information that may aid in further attacks. Team Helpdesk 8.3.5 is vulnerabl...

AssistMyTeam Team Helpdesk - Multiple Information Disclosure Vulnerabilities

AssistMyTeam Team Helpdesk - Multiple Information Disclosure Vulnerabilities source: https://www.securityfocus.com/bid/67271/info AssistMyTeam Team Helpdesk is prone to multiple information-disclosure vulnerabilities. Successfully exploiting these issues may allow an attacker to obtain sensitive...

TeamHelpdesk Customer Web Service (CWS) 8.3.5 Technician Web Access (TWA) 8.3.5 - Remote User Credential Dump

TeamHelpdesk Customer Web Service CWS 8.3.5 Technician Web Access TWA 8.3.5 - Remote User Credential Dump Exploit Title: Team Helpdesk Customer Web Service CWS Remote User Credential Dump exploit Exploit Title: Team Helpdesk Technician Web Access TWA Remote User Credential Dump exploit Date: May ...

Wordpress all_in_one_carousel Plugin /XSS/CSRF/ Vuln

Exploit : centerbWordpress allinonecarousel Plugin Xss & Csrf Vulnerability /centerbrbr html head titleWordpress allinonecarousel Plugin Xss & Csrf Vulnerability IeDb TeaM/title /headbody form action="http://YourTarget.Com" id="formid" method="post" input name="name"...

CH Radyo 2 Cross Site Scripting

===================================================== CH Radyo v.2 php script Cross Site Scripting Vulnerability ----------------------------------------------------------- foun by :kurdish hackers team group : kurd-team contact : [email protected] site : kurdteam.org...

HFC MiniBlog Cross Site Scripting

===================================================== HFCMiniBlog php script Cross Site Scripting Vulnerability ----------------------------------------------------------- foun by :kurdish hackers team group : kurd-team contact : [email protected] site : kurdteam.org...

Localize: XSS in Team Only Area

Hello Marco, Remember this https://github.com/delight-im/Localize/commit/d32d07af0c81c65aa802fe389979f8fea6625e13? Can you resolved that bug here? Thanks!...

Restrictions do not apply in calendar macro

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-49762. panel Team Calendar restrictions do not apply if the calendar is in a Calendar Macro withing a Confluence page. +Repro...

Restrictions do not apply in calendar macro

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-49762. panel Team Calendar restrictions do not apply if the calendar is in a Calendar Macro withing a Confluence page. +Repro...

Restrictions do not apply in calendar macro

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-49762. panel Team Calendar restrictions do not apply if the calendar is in a Calendar Macro withing a Confluence page. +Repro...

Apple iOS 7 Updates Silently Remove Encryption for Email Attachments

There is no question that Mobile devices have become a staple in everyday living around the world. But have you ever asked yourself, How Secure are the Android, iPhone or any other Smart devices? It is really important for us to think about the Security and Privacy of our Data stored in...