Monstra CMS 3.0.3 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Monstra CMS 3.0.3 - Privilege Escalation / Remote Password Change Google Dork: intext:"Powered by Monstra"/users/registration Date: 2016-03-28 Exploit Author: Sarim Kiani Vendor Homepage: http://monstra.org Software Link:...

Monstra CMS 3.0.3 - Multiple Vulnerabilities

Exploit Title: Monstra CMS 3.0.3 - Privilege Escalation / Remote Password Change Google Dork: intext:"Powered by Monstra"/users/registration Date: 2016-03-28 Exploit Author: Sarim Kiani Vendor Homepage: http://monstra.org Software Link: http://monstra.org/download Version: 3.0.3 Tested on: Window...

The vulnerability of the microprogramming software of Schneider Electric’s Modicon M340 allows a hacker to redirect users to a malicious website.

The vulnerability of the microprogramming software of Schneider Electric’s Modicon M340 allows a malicious actor to execute a script within the context of the current user’s security, using a specially created website...

Microsoft Internet Explorer CVE-2015-6046 Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to an information disclosure vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Successful exploits will allow attackers to obtain sensitive information that may aid in further...

WordPress Job Manager Plugin 0.7.22 - Persistent XSS Vulnerability

Exploit for php platform in category web applications Job Manager Persistent XSS Details ======================================================================================== Product: Job Manager Plugin For Wordpress Vendor-URL: www.wp-jobmanager.com CVE-ID: CVE-2015-2321 Credits...

WordPress Plugin Job Manager 0.7.22 - Persistent Cross-Site Scripting

Job Manager Persistent XSS Details ======================================================================================== Product: Job Manager Plugin For Wordpress Vendor-URL: www.wp-jobmanager.com CVE-ID: CVE-2015-2321 Credits...

Cisco FireSIGHT Management Center Cross-Site Scripting Vulnerability

A vulnerability in the Cisco FireSIGHT Management Center could allow an authenticated, remote attacker to perform cross-site scripting XSS attacks. The vulnerability is due to insufficient input validation of some parameters passed via HTTP GET or POST methods. An attacker could exploit this...

Microsoft PowerPoint Malformed Record Code Execution (MS06-058) - ver 2 (CVE-2006-4694)

A memory corruption vulnerability has been reported in Microsoft PowerPoint. The flaw is caused by an insufficient checks of a malformed record contained within a PowerPoint file. An attacker can exploit this vulnerability to inject and execute arbitrary code in the security context of the...

The financial industry platform for common security vulnerabilities and prevention-vulnerability and early warning-the black bar safety net

A Foreword Internet Finance is the two years in the financial sector of emerging terminology, but also the Internet industry is an important branch, but the Internet Finance is not the Internet and the financial industry of simple binding, but in achieving security, mobile, etc. network technolog...

Feedback and data-driven updates to Google’s disclosure policy

Posted by Chris Evans and Ben Hawkes, Project Zero; Heather Adkins, Matt Moore and Michal Zalewski, Google Security; Gerhard Eschelbeck, Vice President, Google Security Disclosure deadlines have long been an industry standard practice. They improve end-user security by getting security patches to...

Microsoft Internet Explorer CVE-2014-2819 Remote Privilege Escalation Vulnerability

Description Microsoft Internet Explorer is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Internet Explorer 7, 8, 9, 10, and 11 are vulnerable. Technologies Affected Microsoft...

OpenSSH 1.2 scp File Create/Overwrite Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1742/info A vulnerability exists in the 1.2.x releases of scp which, if properly exploited using a modified scp binary on the server end, can permit the remote server to spoof local pathnames and overwrite files belonging...

SA-CONTRIB-2014-057 - Password policy - General logic error

This module enables you to define password policies with various constraints on allowable user passwords. The history constraint, when enabled, disallows a user's password from being changed to match a specified number of their previous passwords. Beginning with Password Policy 7.x-1.4, the histo...

Google Recommends Developers Support OAuth 2.0

Google announced today that in the coming months it will be more stringent in securing users when they log in to their accounts by applying additional authorization checks. “These additional checks will ensure that only the intended user has access to their account, whether through a browser,...

Threat Modeling, Legos and Dancing Babies

SAN FRANCISCO–The concept of threat modeling has evolved quite a lot in the last few years, moving from an activity that massive software companies such as Microsoft and Google use to anticipate and defend against potential threats to their products to something that many smaller organizations...

BlackBerry Releases Guidelines to Deter Privacy-Infringing Apps

Aiming to shore up user security BlackBerry this week released a new set of privacy guidelines it’s encouraging third-party app developers to follow to better protect their customers. The guidelines apply to customers’ personally identifiable information PII – the bits of information that apps...

Ditto Forensic FieldStation 2013Oct15a - Multiple Vulnerabilities

Ditto Forensic FieldStation 2013Oct15a - Multiple Vulnerabilities Title: Ditto Forensic FieldStation, multiple vulnerabilities Versions affected: = 2013Oct15a all Vendor: CRU Wiebetech Discovered by: Martin Wundram Email: [email protected] Date found: 2013-04-22 Date published: 2013-12-12...

XAMPP 1.8.1 Local Write Access

============================================= INTERNET SECURITY AUDITORS ALERT 2013-007 - Original release date: March 14th, 2013 - Last revised: March 19th, 2013 - Discovered by: Manuel García Cárdenas - Severity: 6,8/10 CVSS Base Score - CVE-ID: CVE-2013-2586...

Hack Windows 8.1 to earn $100,000 bounty from Microsoft

If you don't know yet, Microsoft is offerings up to $100,000 in exchange for finding vulnerabilities and exploits in the upcoming Windows 8.1 Preview which is expected to launch on June 26, the same time as the Microsoft Build Developer Conference. Qualifying submissions with accompanying defensi...

Google Sheds Light on New Android App Scanner

Google has divulged more information about its forthcoming application verifier for the Android operating system. The feature is being rolled out over the air alongside the latest build of the OS, Jelly Bean 4.2, on Nexus 7 and Galaxy Nexus devices as of yesterday. While it can be disabled, the a...