BlackPOS Malware used in TARGET Data Breach developed by 17-Year Old Russian Hacker

The Holiday data breach at TARGET appeared to be part of a broad and highly sophisticated international hacking campaign against multiple retailers, involving the heist of possibly 110 million Credit-Debit cards, and personal information. Target confirmed last weekend that a malicious software wa...

MS13-090 CardSpaceClaimCollection ActiveX Integer Underflow

This Metasploit module exploits a vulnerability on the CardSpaceClaimCollection class from the icardie.dll ActiveX control. The vulnerability exists while the handling of the CardSpaceClaimCollection object. CardSpaceClaimCollections stores a collection of elements on a SafeArray and keeps a size...

MS13-090 CardSpaceClaimCollection ActiveX Integer Underflow

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS13-090 CardSpaceClaimCollection ActiveX Integer Underflow", 'Description' = %q This module exploits a vulnerability on the...

MS13-090 CardSpaceClaimCollection ActiveX Integer Underflow

This module exploits a vulnerability on the CardSpaceClaimCollection class from the icardie.dll ActiveX control. The vulnerability exists while the handling of the CardSpaceClaimCollection object. CardSpaceClaimCollections stores a collection of elements on a SafeArray and keeps a size field,...

CVE-2013-3106: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev18, 6.22.0 before rev16, 6.22.1 before rev19, 7.0.1 before rev7, 7.0.2 before rev11, and 7.2.0 before rev8 allow remote attackers to inject arbitrary web script or HTML via 1 embedded VBScript, ...

KingView 6.53 - 'KChartXY' ActiveX File Creation / Overwrite

arg1="..................................\WINDOWS\win.ini" target.SaveToFile arg1...

Information disclosure

Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript, which allows remote attackers to perform cross-domain reading of JSON files via a crafted web site, aka "JSON Array Information Disclosure Vulnerability."...

CVE-2013-1297

Summary of CVE-2013-1297 details (from connected docs): Microsoft Internet Explorer versions 6–8 contain a data-access restriction flaw in VBScript that allows remote attackers to perform cross-domain reading of JSON files from a crafted site, described as the JSON Array Information Disclosure Vu...

CVE-2013-1297: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript, which allows remote attackers to perform cross-domain reading of JSON files via a crafted web site, aka "JSON Array Information Disclosure Vulnerability."...

Adobe InDesign Server RunScript Arbitrary Command Execution

The version of Adobe InDesign Server running on the remote host has an arbitrary command execution vulnerability. When the SOAP service is enabled, it processes requests for the RunScript method without requiring authentication. This method can be used to execute arbitrary VBScript on Windows, or...

CVE-2012-6121

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a 1 data:text or 2 vbscript link...

CVE-2012-6121

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a 1 data:text or 2 vbscript link...

UBUNTU-CVE-2012-6121

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a 1 data:text or 2 vbscript link...

Cross site scripting

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a 1 data:text or 2 vbscript link...

CVE-2012-6121

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a 1 data:text or 2 vbscript link...

CVE-2012-6121

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a 1 data:text or 2 vbscript link...

CVE-2012-6121

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a 1 data:text or 2 vbscript link...

PT-2013-1905

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 0.8.5 ALT Linux affected versions not specified Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML. Specifically...

CVE-2012-6121: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a 1 data:text or 2 vbscript link...

IE generic JSON hijacking vulnerabilities-vulnerability warning-the black bar safety net

Brief description: Due to the certain resource container data improper handling lead to json hijacking vulnerabilities. Detailed description: Since ie supports vbscript,so the script elements may be specified to the vbscript language: script language=vbscript/script When but we specify that a js...