[FD] SEC Consult SA-20140430-0 :: SQL injection and persistent XSS in the Typo3 3rd party extension si_bibtex

SEC Consult Vulnerability Lab Security Advisory < 20140430-0 > === title: SQL injection and persistent XSS product: Typo3 3rd party extension si_bibtex vulnerable version: si_bibtex 0.2.3

Re: [FD] Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin)

Hi Illwill, What circumstance would a WordPress admin not usually have this kind of access anyhow? As Dave said, there are various levels of administrator in WordPress. But our perspective on these issues is just that a WordPress administrator is not necessarily also a server administrator. P

Re: [FD] Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin)

no, it doesnt matter. the vulnerability is yours and there is absolutely no requirement for you to have reported in x amount of time. you do not need to justify any amount of time. Yeah, I know. I generally do intend to get things out promptly though, and this was a whoops. H On 30/04/2014 1

[FD] LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access

=== LSE Leading Security Experts GmbH - Security Advisory 2014-04-10 === Sitepark Information Enterprise Server (IES) - Unauthenticated Access - Affected Versions = Information Enterprise Server (IES) Version 2.9

[FD] Syhunt Advisory: CGILua session.lua Predictable Session ID Vulnerability

Syhunt Advisory: CGILua session.lua Predictable Session ID Vulnerability Advisory-ID: 201404301 Discovery Date: 03.27.2014 Release Date: 04.30.2014 Affected Applications: CGILua 5.0.x, CGILua 5.1.x., CGILua 5.2 alpha 1 & CGILua 5.2 alpha 2 Class: Predictable Session ID Status: Unpatched/Vendor inf

Re: [FD] lxml (python lib) vulnerability

FYI -- this seems to be patched with 3.3.5. [0] Cheers, Z. References: [0] http://lxml.de/3.3/changes-3.3.5.html 2014-04-15 20:30 GMT+02:00 Максим Кочкин : > Hi, all > > I've accidentally found vulnerability in clean_html function of lxml python > library. User can break schema of url with nonp

[FD] Beginners error: iTunes for Windows runs rogue program C:\Program.exe when opening associated files

Hi @ll, the current version of iTunes for Windows (and of course older versions too) associates the following vulnerable command lines with some of the supported file types/extensions: daap=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1" itls=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"

Re: [FD] Beginners error: iTunes for Windows runs rogue program C:\Program.exe when opening associated files

Hi Stefan, SANS had a good post on this a few years ago ( https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464), which led to large number of services on windows machines with unquoted paths being discovered and fixed. At that time I discovered that Windows Defender on Wi

Re: [FD] Beginners error: iTunes for Windows runs rogue program C:\Program.exe when opening associated files

Well spotted. That said, don't you have to be an admin to be able to create files in these directories anyway? So this is only exploitable on FAT, or by admin, or if the ACLs are set incorrectly right? -- Gynvael Coldwind ___ Sent through the Full Dis

Re: [FD] Beginners error: iTunes for Windows runs rogue program C:\Program.exe when opening associated files

Hi Mike, It's probalby better seen as a way of keeping persistence on a machine than a full-blown exploit. Alton(ius) altonblom.com @altonius_au On Thu, May 1, 2014 at 8:05 AM, Mike Cramer wrote: > I would like to know how this is a vulnerability. > > In order to write to the root of C:\, you

Re: [FD] Beginners error: iTunes for Windows runs rogue program C:\Program.exe when opening associated files

I would like to know how this is a vulnerability. In order to write to the root of C:\, you need elevated privileges in Windows. Once someone gains elevated access, what does creating "C:\program.exe" offer them that they couldn't otherwise obtain? I have never actually seen malware take advantag