Showing 70 results for: Advisories ×

Cracking IKE Mission:Improbable (Part 2)

A couple of weeks ago I posted Part 1 of Cracking IKE, detailing some useful techniques when cracking Aggressive Mode PSK hashes. In that post we saw that a hash is not always 'crackable' and additional steps are required in...

TWSL2012-016: Multiple Vulnerabilities in Bitweaver

The Trustwave SpiderLabs team has published a new advisory for multiple vulnerabilities in Bitweaver. Bitweaver is a Content Management System (CMS) developed in PHP that can be used with a Firebird DB back-end. David Aaron and Jonathan Claudius from the...

TWSL2012-004: Multiple Vulnerabilities in Zen Cart

The SpiderLabs team at Trustwave published a new advisory yesterday, which details multiple vulnerabilities identified in Zen Cart (version 1.5.0). These findings include two Local File Inclusion (LFI) vulnerabilities and a Cross-Site Scripting (XSS) in the installation scripts. All of...

WordPress 3.3.2 Addresses Setup XSS Vulnerabilities

Back in January we released a security advisory for WordPress, which included four vulnerabilities in the installation scripts. After discussing these issues with the WordPress team, it was decided that the vulnerabilities were not going to be fixed immediately in...

RCE root in all current Samba versions

While perusing the change log for the release of SAMBA that was pushed out today a member of the SpiderLabs team (Rodrigo Montoro) noticed a CVE number in the change log. When we dug a little deeper we found that...

Virtual Patch for Movable Types XSS (CVE 2012-1262)

My SpiderLabs Research colleague Jonathan Claudius recently identified an XSS flaw in the Movable Types application which was outlined in Trustwave Security Advisory TWSL2012-003. Here is the quick overview of the issue: After extracting the Moveable Type CGI files and...

TWSL2012-002: Multiple Vulnerabilities in WordPress

Trustwave SpiderLabs has published a new advisory today for multiple vulnerabilities discovered in the WordPress 'setup-config.php' page. These include PHP code execution/persistent cross site scripting (XSS) vulnerabilities and a MySQL server username/password disclosure weakness. All of these vulnerabilities were discovered...

TWSL2011-019: Cross-Site Scripting Vulnerability in phpMyAdmin

The Spiderlabs team at Trustwave published a new advisory for a Cross-Side-Scripting (XSS) found in phpMyAdmin 3.4.8 and previous versions. phpMyAdmin is an open source tool developed in PHP to manage and administer MySQL databases remotely. The vulnerability was discovered...

Microsoft Patch Tuesday, December 2011

This Patch Tuesday, there are 3 new Critical and 10 new Important Bulletins. With this many high-urgency bulletins, it's tough to get a handle on which ones to tackle first. Of course, "all of them" is the standard answer, but...

TWSL2011-013: Multiple Vulnerabilities in IceWarp Mail Server

The Spiderlabs team at Trustwave published a new advisory today which detail issues discovered in the IceWarp Mail Server. IceWarp Mail Server solution supports SMTP, POP & IMAP standards and integrates anti-virus and anti-spam protection for email users. Administrators can...

What Do Bug Bounties Cover?

Over the past few days in the UK we have been bombarded with arguments and debates over the use of Facebook and other social networking sites due to the riots that we witnessed all over the country. However, in the...

TWSL2011-008: Focus Stealing Vulnerability in Android

The SpiderLabs team at Trustwave published a new advisory today, which details an issue identified in Android. Android is an open-source software stack for mobile devices which includes an operating system, key applications, and middleware. The vulnerability was discovered by...