Authentication flaw

Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768...

CVE-2012-0333

Cisco Small Business IP phones (SPA 500 series) with firmware 7.4.9 and earlier are affected by CVE-2012-0333 because Push XML requests do not require authentication, enabling remote attackers to initiate calls via crafted XML (Bug CSCts08768). Affected product: SPA 500 series; root cause: unauth...

Cisco Security Advisory: Cisco Small Business SRP 500 Series Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Small Business SRP 500 Series Multiple Vulnerabilities Advisory ID: cisco-sa-20120223-srp500 Revision 1.0 For Public Release 2012 February 23 16:00 UTC GMT Summary ======= Cisco Small Business SRP 500 Series Services Ready Platforms contain th...

Cisco SRP 500 multiple security vulnerabilities

Commands injection, directory traversal, unauthorized configuration uplooad...

Ruby On Rails Attributes Mass Assignment Scanner

This module scans Ruby On Rails sites for models with attributes not protected by attrprotected or attraccessible. After attempting to assign a non-existent field, the default rails with activerecord setup will raise an ActiveRecord::UnknownAttributeError exception, and reply with HTTP code 500...

LivePerson Cross Site Scripting

Exploit Title: LivePerson Cross Site Scripting Date: 15.03.2012 Author: Sony Software Link: http://liveperson.com/ Google Dorks: inurl:/window/top.asp?site= or inurl:/window/main.asp?site= Web Browser : Mozilla Firefox Site : http://insecurity.ro PoC:...

#WikiLeaks publishes millions of Hacked Stratfor E-mails #gifiles

WikiLeaks publishes millions of Hacked Stratfor E-mails gifiles WikiLeaks today began publishing more than five million confidential e-mails from US-based Intelligence firm Stratfor. About 5.5m emails obtained from the servers of Stratfor, a US-based intelligence gathering firm with about 300,000...

Cisco Small Business SRP 500 Series Multiple Vulnerabilities

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Groupon Piggyback Site Offers $500 Voucher, Charges Users for Allegedly 'Free' Trial Offers

A domain registered two days ago as groupon500.com, which claims to offer a $500 voucher toward Groupon or its primary competitor, LivingSocial, is actually registering users for ‘free’ trial offers that aren’t free at all. The best part, however, is that everything about this scam is perfectly...

Firm Finds DNS Changer Infections Linger Inside Fortune 500

A report finds that around half of the Fortune 500 corporations and government agencies infected with the DNS Changer malware are still infected, two months after authorities moved to shut down the massive botnet. The report, by Krebsonsecurity.com, raises troubling questions about the security o...

Fortune 500 Gets "F" In Social Engineering Hacking Test

It was another year, another “F” for the top, U.S. firms targeted in the annual Social Engineering Capture the Flag CTF Contest at the DEFCON hacking conference, according to a report released on Monday. Some of the U.S.’s top firms, including Apple Computer, IBM, AT&T, McDonald’s and retail gian...

SpyEye 1.3.45 Download - Loader source code

SpyEye 1.3.45 Download - Loader source code A new fresh and sophisticated web-based bot named SpyEye is around in the markets and looks like to be the possible successor of the famous Zeus Trojan due to its very interesting features, with the main objective to steal bank accounts, credit cards, f...

Facebook Launches Bug Bounty Program

Social networking giant Facebook has finally boarded the bug bounty bandwagon. The company announced late last week they’ll award $500 for each bug to those who share information about flaws that could compromise the site’s privacy. The news confirms rumors that began to bubble at a Hack in the B...

Cisco SA 500 security vulnerabilities

SQL injection, privilege escalation...

CVE-2011-2546

SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669...

CVE-2011-2547

The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via crafted parameters to web forms, aka Bug ID CSCtq65681...

Sql injection

SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669...

Design/Logic Flaw

The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via crafted parameters to web forms, aka Bug ID CSCtq65681...

CVE-2011-2546

The CVE-2011-2546 issue affects Cisco SA 500 Series Security Appliances prior to firmware 2.1.19. The vulnerability is a SQL Injection in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary SQL commands and potentially obtain usernames and ...

CVE-2011-2547

The CVE-2011-2547 issue affects Cisco SA 500 Series Security Appliances running software before 2.1.19. The Privilege Escalation vulnerability allows an authenticated user to inject arbitrary commands into the underlying OS via crafted parameters in web forms, enabling execution with root-equival...