PDF Album 1.7 Local File Inclusion

Document Title: =============== PDF Album v1.7 iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1255 Release Date: ============= 2014-04-11 Vulnerability Laboratory ID VL-ID: ==================================== 1255...

U.S. Government Seeks Laxer Hacking Rules for Law Enforcement

The federal government is looking for a way to relax the laws to make it simpler for law enforcement agents to target and compromise the computers of suspects involved in criminal cases. The Department of Justice has forwarded a request to the body that considers such changes, asking that judges ...

Lazybone Studios WiFi Music 1.0 iOS - Multiple Vulnerabilities

Lazybone Studios WiFi Music 1.0 iOS - Multiple Vulnerabilities Document Title: =============== Lazybone Studios WiFi Music 1.0 iOS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1233 Release Date: ============= 2014-03-21...

ePhone Disk v1.0.2 iOS - Multiple Web Vulnerabilities

Document Title: =============== ePhone Disk v1.0.2 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1230 Release Date: ============= 2014-03-25 Vulnerability Laboratory ID VL-ID: ==================================== 1230...

Slack: Slack OAuth2 "redirect_uri" Bypass

Hi, I've found a way to circumvent redirecturi restrictions imposed by the web application using domain-suffix/subdomain technique. I created an OAuth application under https://api.slack.com/applications/new. That has OAuth redirecturi configured to http://www.google.com. So technically Allowed...

Barracuda Networks Backup Appliance Cross Site Scripting

Document Title: =============== Barracuda Networks Backup Appliance Application - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=784 BARRACUDA NETWORK SECURITY ID: BNSEC-885 Release Date: ============= 2014-02-26 Vulnerabili...

Complete Microsoft EMET Bypass Developed

SAN FRANCISCO — Researchers at Bromium Labs are expected to announce today they have developed an exploit that bypasses all of the mitigations in Microsoft’s Enhanced Mitigation Experience Toolkit EMET. Principal security researcher Jared DeMott is scheduled to deliver a presentation this morning...

File Hub 1.9.1 Code Execution / Local File Inclusion

Document Title: =============== File Hub v1.9.1 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1195 Release Date: ============= 2014-02-15 Vulnerability Laboratory ID VL-ID: ==================================== 1195...

[Azazel] Userland Anti-debugging & Anti-detection Rootkit

Azazel is a userland rootkit based off of the original LDPRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily around anti-debugging and anti-detection. Features Anti-debugging Avoids unhide, lsof, ps, ldd detection Hides files and directories Hid...

Office Assistant Pro 2.2.2 iOS - Local File Inclusion

Document Title: =============== Office Assistant Pro v2.2.2 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1197 Release Date: ============= 2014-02-13 Vulnerability Laboratory ID VL-ID: ==================================...

400 Gbps NTP Amplification DDoS Attack Alarmingly Simple

The largest distributed denial of service attack on public record was reported this week, and with it came many alarming numbers, not only in the volume of traffic generated 400 Gbps at its peak, but in the number of Network Time Protocol servers involved 4,592 on 1,298 networks as well as the...

jDisk (stickto) v2.0.3 iOS - Multiple Web Vulnerabilities

Document Title: =============== jDisk stickto v2.0.3 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1196 Release Date: ============= 2014-02-11 Vulnerability Laboratory ID VL-ID: ==================================== 11...

doorGets CMS 5.2 SQL Injection

Advisory ID: HTB23197 Product: doorGets CMS Vendor: doorGets Vulnerable Versions: 5.2 and probably prior Tested Version: 5.2 Advisory Publication: January 15, 2014 without technical details Vendor Notification: January 15, 2014 Vendor Patch: January 15, 2014 Public Disclosure: February 5, 2014...

Ammyy Admin 3.2 - Authentication Bypass Vulnerability

Exploit for windows platform in category local exploits Title: ==== Ammyy Admin - Hidden hard-coded option and Access Control vulnerability. Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ==== - CVE-2013-5581 for hidde...

Ammyy Admin 3.2 - Authentication Bypass

Title: ==== Ammyy Admin - Hidden hard-coded option and Access Control vulnerability. Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ==== - CVE-2013-5581 for hidden hard-coded option CWE-255. - CVE-2013-5582 for failure...

Ammyy Admin 3.2 - Authentication Bypass

Ammyy Admin 3.2 - Authentication Bypass Title: ==== Ammyy Admin - Hidden hard-coded option and Access Control vulnerability. Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ==== - CVE-2013-5581 for hidden hard-coded...

Facebook Bug Bounty - Redirect Web Vulnerabilities

Document Title: =============== Facebook Bug Bounty - Redirect Web Vulnerabilities References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1180 View Video1: http://www.youtube.com/watch?v=xBQYb5MUkk View Video2: http://www.youtube.com/watch?v=3P10Kd8m9bY View Video3:...

QuickHeal AntiVirus 7.1 PRO - Stack Overflow Vulnerability

Document Title: =============== QuickHeal AntiVirus 7.1 PRO - Stack Overflow Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1173 View: http://www.youtube.com/watch?v=6aQR8H6HoCs http://www.vulnerability-lab.com/getcontent.php?id=1171 Resources:...

Song Exporter v2.1.1 RS iOS - File Include Vulnerabilities

Document Title: =============== Song Exporter v2.1.1 RS iOS - File Include Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1172 Release Date: ============= 2013-12-18 Vulnerability Laboratory ID VL-ID: ====================================...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to hijack the authentication of administrators for requests that modify the disk erase technique settings via unspecified vectors...