Full Disclosure

Syndicate content
A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.
Updated: 6 min 38 sec ago

[RCESEC-2016-004][CVE-2016-5005] Apache Archiva 1.3.9 admin/addProxyConnector_commit.action connector.sourceRepoId Persistent Cross-Site Scripting

12 July, 2016 - 18:41

Posted by Julien Ahrens on Jul 12

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: Apache Archiva
Vendor URL: https://archiva.apache.org
Type: Cross-Site Scripting [CWE-79]
Date found: 2016-05-31
Date published: 2016-07-11
CVSSv3 Score: 5.5 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)
CVE: CVE-2016-5005

2. CREDITS
==========
This vulnerability was discovered and researched by...

[RCESEC-2016-003][CVE-2016-4469] Apache Archiva 1.3.9 Multiple Cross-Site Request Forgeries

12 July, 2016 - 18:41

Posted by Julien Ahrens on Jul 12

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: Apache Archiva
Vendor URL: https://archiva.apache.org
Type: Cross-Site Request Forgery [CWE-253]
Date found: 2016-05-31
Date published: 2016-07-11
CVSSv3 Score: 5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
CVE: CVE-2016-4469

2. CREDITS
==========
This vulnerability was discovered and researched...

WSO2 SOA Enablement Server - Reflected Cross Site Scripting vulnerability

12 July, 2016 - 18:41

Posted by Paweł Gocyla on Jul 12

Title: WSO2 SOA Enablement Server - Reflected Cross Site Scripting
Authors: Pawel Gocyla
Date: 08. June 2016

Affected Software:
==================
WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616
Probably other versions are also vulnerable.

Vulnerability:
**************

Reflected Cross Site Scripting:
==============================

Proof of Concept:
https://WSO2SOA_IP:6443/invocationConsole?p.wsdlUrl=...

WSO2 SOA Enablement Server - XML External Entity Injection

12 July, 2016 - 18:41

Posted by Paweł Gocyla on Jul 12

Title: WSO2 SOA Enablement Server - XML External Entity Injection
Authors: Pawel Gocyla, Jakub Palaczynski
Date: 08. June 2016

Affected Software:
==================
WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616
Probably other versions are also vulnerable.

Vulnerability:
**************

XML External Entity Injection:
==============================

It must be noted that this vulnerability is exploitable without...

WSO2 SOA Enablement Server - Server Side Request Forgery

12 July, 2016 - 18:41

Posted by Paweł Gocyla on Jul 12

Title: WSO2 SOA Enablement Server - Server Side Request Forgery
Authors: Pawel Gocyla
Date: 10. June 2016

Affected Software:
==================
WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616
Probably other versions are also vulnerable.

Vulnerability:
**************

Server Side Request Forgery (SSRF):
===================================

Using this vulnerability it is possible for example to expose service user
credentials....

RCE by abusing NAC to gain Domain Persistence.

12 July, 2016 - 18:41

Posted by Alexander Korznikov on Jul 12

link:
http://www.korznikov.com/2016/07/rce-by-abusing-nac-to-gain-domain.html

Hi there!
I want to share how to compromise whole enterprise network in less than ONE
minute :)

Let's begin... As security consultants, we often advice to our clients to
implement Network Access Control systems to prevent some nasty people to do
their nasty things...

This article is not about how to bypass Network Access Control systems, but
if you're...

RootExplorer remote code execution

12 July, 2016 - 18:41

Posted by 0x3d5157636b525761 iddqd on Jul 12

Disclosure timeline
=====================
June 11th: discovered issues.
June 12th: contacted App developer.
June 12th: App developer replies that the new App is not ready yet, but
will not download assets from HTTP.
June 13th: asked how much time it'll take to fix, App developer didn't
respond.
July 2nd: App developer queried again, but failed to respond.
July 8th: App developer got his 3rd notice, but failed to respond.
July 9th: full...

[CVE-2016-1014, CVE-2016-4247] Executable installers are vulnerable^WEVIL (case 35): Adobe's Flash Player (un)installers

12 July, 2016 - 18:38

Posted by Stefan Kanthak on Jul 12

Hi @ll,

the executable installers of Flash Player released 2016-06-15
fixed CVE-2016-1014 in the second attempt, but another vulnerability
remained: they create(d) and use(d) UNSAFE temporary subdirectories
into which they copy/ied themselves and extract(ed) a file "fpb.tmp"
which they load(ed) and execute(d) later with elevated privileges.

An unprivileged user can/could overwrite both files between creation
and execution and gain...

Easy Forms for MailChimp Local File Inclusion vulnerability

12 July, 2016 - 11:38

Posted by Summer of Pwnage on Jul 12

------------------------------------------------------------------------
Easy Forms for MailChimp Local File Inclusion vulnerability
------------------------------------------------------------------------
Yorick Koster, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
It was discovered that the Easy Forms for MailChimp WordPress...

WP Fastest Cache Member Local File Inclusion vulnerability

12 July, 2016 - 11:37

Posted by Summer of Pwnage on Jul 12

------------------------------------------------------------------------
WP Fastest Cache Member Local File Inclusion vulnerability
------------------------------------------------------------------------
Yorick Koster, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
It was discovered that the WP Fastest Cache WordPress plugin is...

Cross-Site Scripting vulnerability in Profile Builder WordPress Plugin

12 July, 2016 - 11:37

Posted by Summer of Pwnage on Jul 12

------------------------------------------------------------------------
Cross-Site Scripting vulnerability in Profile Builder WordPress Plugin
------------------------------------------------------------------------
Yorick Koster, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A Cross-Site Scripting vulnerability was found in...

Cross-Site Scripting vulnerability in Master Slider WordPress Plugin

12 July, 2016 - 11:36

Posted by Summer of Pwnage on Jul 12

------------------------------------------------------------------------
Cross-Site Scripting vulnerability in Master Slider WordPress Plugin
------------------------------------------------------------------------
Yorick Koster, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A Cross-Site Scripting vulnerability was found in the...

Cross-Site Scripting vulnerability in Email Users WordPress Plugin

12 July, 2016 - 11:35

Posted by Summer of Pwnage on Jul 12

------------------------------------------------------------------------
Cross-Site Scripting vulnerability in Email Users WordPress Plugin
------------------------------------------------------------------------
Yorick Koster, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A Cross-Site Scripting vulnerability was found in the...

Persistent Cross-Site Scripting in WordPress Activity Log plugin

11 July, 2016 - 14:45

Posted by Summer of Pwnage on Jul 11

------------------------------------------------------------------------
Persistent Cross-Site Scripting in WordPress Activity Log plugin
------------------------------------------------------------------------
Han Sahin, July 2016

https://sumofpwn.nl/advisory/2016/activity-log-plugin.png

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A...

Persistent Cross-Site Scripting in WP Live Chat Support plugin

11 July, 2016 - 09:53

Posted by Securify B.V. on Jul 11

------------------------------------------------------------------------
Persistent Cross-Site Scripting in WP Live Chat Support plugin
------------------------------------------------------------------------
Han Sahin, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A persistent Cross-Site Scripting (XSS) vulnerability has been...

Persistent Cross-Site Scripting in All in One SEO Pack WordPress Plugin

10 July, 2016 - 01:46

Posted by Summer of Pwnage on Jul 09

------------------------------------------------------------------------
Persistent Cross-Site Scripting in All in One SEO Pack WordPress Plugin
------------------------------------------------------------------------
David Vaartjes, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A stored Cross-Site Scripting vulnerability was...

Ultimate Member Local File Inclusion vulnerability

10 July, 2016 - 01:41

Posted by Summer of Pwnage on Jul 09

------------------------------------------------------------------------

Ultimate Member Local File Inclusion vulnerability

------------------------------------------------------------------------

Burak Kelebek, July 2016

------------------------------------------------------------------------

Abstract

------------------------------------------------------------------------

It was discovered that Ultimate Member is vulnerable to PHP File...

BMW ConnectedDrive - (Update) VIN Session Vulnerability

8 July, 2016 - 03:29

Posted by Vulnerability Lab on Jul 08

Document Title:
===============
BMW ConnectedDrive - (Update) VIN Session Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1736

Release Date:
=============
2016-07-07

Vulnerability Laboratory ID (VL-ID):
====================================
1736

Common Vulnerability Scoring System:
====================================
6

Product & Service Introduction:...

BMW - (Token) Client Side Cross Site Scripting Vulnerability

8 July, 2016 - 03:27

Posted by Vulnerability Lab on Jul 08

Document Title:
===============
BMW - (Token) Client Side Cross Site Scripting Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1737

Release Date:
=============
2016-07-06

Vulnerability Laboratory ID (VL-ID):
====================================
1737

Common Vulnerability Scoring System:
====================================
3.6

Product & Service Introduction:...

[KIS-2016-11] IPS Community Suite <= 4.1.12.3 Autoloaded PHP Code Injection Vulnerability

7 July, 2016 - 10:56

Posted by Egidio Romano on Jul 07

---------------------------------------------------------------------------
IPS Community Suite <= 4.1.12.3 Autoloaded PHP Code Injection Vulnerability
---------------------------------------------------------------------------

[-] Software Link:

https://invisionpower.com/

[-] Affected Versions:

Version 4.1.12.3 and prior versions.

[-] Vulnerability Description:

The vulnerable code is located in the...