Showing 1 - 2 of 2

Files from Matias Blanco

First Active	2011-09-14
Last Active	2011-10-24

Core Security Technologies Advisory 2011.0810: Posted Oct 24, 2011; Authored by Core Security Technologies, Matthew Bergin, Matias Blanco | Site coresecurity.com; Core Security Technologies Advisory - When the install script for e107 CMS has not been removed, an attacker can "reinstall" the application using arbitrary parameters. If the attacker puts a valid MySql server followed a semicolon and PHP code, this will be executed when the config file gets requested. This parameters are stored in the config file "e107_config.php". Version 0.7.24 is affected.; tags | exploit, arbitrary, php; advisories | CVE-2011-1513; SHA-256 | f1aa6364a9b7aec87affa0e57cc0ec5d09d69d9a12a32fe5e884c8288d964039; Download | Favorite | View

Core Security Technologies Advisory 2011.0506: Posted Sep 14, 2011; Authored by Core Security Technologies, Matias Blanco | Site coresecurity.com; ManageEngine ServiceDesk Plus is a complete web based and ITIL ready service desk software with integrated asset management developed by ManageEngine, the Enterprise IT Management Software division of Zoho Corporation. The authentication process of ServiceDesk Plus obfuscates user passwords using a trivial and symmetrical algorithm in Javascript code with no secret. Given that user passwords are locally stored in user cookies and having the Javascript code to encrypt and decrypt passwords in a .js file, the authentication process of ServiceDesk Plus can be bypassed allowing an attacker to get usernames+passwords of registered users. Additionally, a cross site scripting vulnerability related to search functions was found.; tags | exploit, web, javascript, xss; advisories | CVE-2011-1509, CVE-2011-1510; SHA-256 | dde4e80049f630498c5dd4ccfcde206197f20795d0ce966d739e63494ef820c8; Download | Favorite | View

Page 1 of 1 Back 1 Next

Top Authors In Last 30 Days