[FD] LSE Leading Security Experts GmbH - LSE-2014-07-13 - Granding Grand MA 300 - Weak Pin Verification

=== LSE Leading Security Experts GmbH - Security Advisory 2014-07-13 === Grand MA 300 Fingerprint Reader - Weak Pin Verification Affected Versions = Grand MA 300/ID with firmware 6.60 Issue Overview ===

[FD] CVE-2014-5119 glibc __gconv_translit_find() exploit

List, back in July, I described CVE-2014-5119, a fiendish single-fixed-byte heap metadata overflow in the glibc internal routine __gconv_translit_find(). This is caused by the file extension being incorrectly appended to the transliteration module filename. The result is one too few bytes are allo

[FD] RCE in dragonfly gem

RCE in the Dragonfly gem for image uploading & processing in rails/sinatra, in version 1.0.5. (https://github.com/markevans/dragonfly) The underlaying vulnerability is that you can pass arbitrary commands to imagemagicks convert, thus granting arbitrary read/write for the filesystem. Additionally

[FD] MyBB 1.6 - MyAwards CSRF

# Google Dork: allinurl:myawards.php # Date: 08/17/2014 # Exploit Author: Vagineer https://vagineering.me # Version: ALL VERSIONS # Tested on: MyBB 1.6.15 PoC(set this as your signature or iframe it) Add awards [img] https://website.com/forum/admin/index.php?module=user-awards&action=awards_delete

Re: [FD] Hilariously Bad SQRL Implementation

> Why would any sane rational human being implement something from Gibson? On that note, I did come across the attrition charlatan page after I started this project. But as far as I'm concerned, I'm only implementing an Ed25519 signature. That the specific client application is one of Steven Gibso

[FD] ntopng 1.2.0 XSS injection using monitored network traffic

ntopng 1.2.0 XSS injection using monitored network traffic ntopng is the next generation version of the original ntop, a network traffic probe and monitor that shows the network usage, similar to what the popular top Unix command does. The web-based frontend of the software is vulnerable to i

[FD] CVE-2014-2081 - VTLS Virtua InfoStation.cgi SQLi.

=[Alligator Security Team - Security Advisory] - VTLS Virtua InfoStation.cgi SQLi - CVE-2014-2081 - Author: José Tozo < juniorbsd () gmail com > =[Table of Contents]== 1. Background 2. Detailed descr

[FD] Barracuda Networks Web Security Flex v4.1 - Persistent Vulnerabilities (BNSEC-699)

Document Title: === Barracuda Networks Web Security Flex v4.1 - Persistent Vulnerabilities (BNSEC-699) References (Source): http://www.vulnerability-lab.com/get_content.php?id=750 BARRACUDA NETWORK SECURITY ID: BNSEC-699 Release Date: = 2014-08-22

[FD] Barracuda Networks Web Security Flex Appliance Application v4.x - Filter Bypass & Persistent Vulnerabilities (BNSEC 707)

Document Title: === Barracuda Networks Web Security Flex Appliance Application v4.x - Filter Bypass & Persistent Vulnerabilities (BNSEC 707) References (Source): http://www.vulnerability-lab.com/get_content.php?id=749 Barracuda Networks Security ID (BNSEC): 707