Senate Considers Using Mob Law To Go After Cybercriminals

Members of the Senate Judiciary Committee listened as one of the nation’s top cyber cops asked for expanded powers to go after cybercriminal groups, including the use of statutes written to combat the mafia. But confronted with the prospect of a major face lift for the U.S.’s preeminent cyber...

Tencent 3. vulnerability is a combination of use and solution-vulnerability warning-the black bar safety net

Author: onlyguest Brief description: Permissions bypass+Cross Site+Service end of not verify the=night between 4 million users tragedy Detailed description: The first landing Have a cookie after you open the following page A class=keylink href="http://faxin.soso.com/JSONPageUserGetgold.a%20href= ...

DDoS Attack Using Google Plus Servers

A Security expert at Italian security firm AIR Sicurezza Informatica has claimed that Google's servers vulnerability allows a hacker to exploit the search giant's bandwidth to launch a distributed denial-of-service DDoS attack on any targeted server. On the IHTeam Security Blog , the author of th...

History Sniffing Case Dismissed Because Defendant Fails to Quantify Losses

A federal court in New York has dismissed a case in which the plaintiff claimed that a third-party advertiser had violated the Computer Fraud and Abuse Act CFAA by sniffing her browser history and using flash cookies, ruling that the plaintiff didn’t prove that the actions were harmful enough...

Anonymous Shifts Attention to Big Oil, Monsanto

Just days after infiltrating military contractor Booz Allen Hamilton, hacktivist group Anonymous has confirmed they’ve set their next target: Big oil. In a post on the AnonNews website, the group has announced their intent to shift their ongoing Operation Green Rights initiative to “protest...

Official Website of Amy Winehouse - Songer/Songwriter Defaced

Official Website of Amy Winehouse - Songer/Songwriter Defaced Amy Jade Winehouse official website https://www.amywinehouse.com/ defaced by Anonymous hackers for Antisec . Amy Jade Winehouse born 14 September 1983 is an English singer-songwriter, known for her powerful contralto vocals and her...

XSS и AoF уязвимости в Drupal

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting и Abuse of Functionality уязвимостях в Drupal. XSS WASC-08: При добавлении или изменении данных в любых внутренних формах добавление/изменение поста и т.д. можно провести persistent XSS атаку. XSS код выполнится при посещении...

China-Based Attacks Targeted Gmail of U.S. Officials, Activists

Search giant Google has again sounded the alarm about sophisticated attacks emanating from mainland China and targeting officials within the U.S. and Asian governments, as well as human rights activists and journalists. Samples of some of the messages posted on an independent researcher’s blog...

FreeBSD : mod_pubcookie -- Empty Authentication Security Advisory (1ca8228f-858d-11e0-a76c-000743057ca2)

Nathan Dors, Pubcookie Project reports : An Abuse of Functionality vulnerability in the Pubcookie authentication process was found. This vulnerability allows an attacker to appear as if he or she were authenticated using an empty userid when such a userid isn't expected. Unauthorized access to we...

Уязвимости в Easy Contact для WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation, Abuse of Functionality и Cross-Site Scripting уязвимостях в плагине Easy Contact для WordPress. Insufficient Anti-automation WASC-21: Отсутствие капчи на странице контактов позволяет слать автоматизированные сообщения...

Easy Contact 0.1.2 WordPress Plugin Cross Site Scripting

Hello list! I want to warn you about Insufficient Anti-automation, Abuse of Functionality and Cross-Site Scripting vulnerabilities in plugin Easy Contact for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are Easy Contact 0.1.2 and previous versions...

Cetera eCommerce 15.0 SQL Injection / Disclosure

Hello list! I want to warn you about SQL Injection, Full path disclosure, Abuse of Functionality and Insufficient Anti-automation vulnerabilities in Cetera eCommerce. It's engine for online shops. ------------------------- Affected products: ------------------------- Vulnerable are Cetera eCommer...

kernel: ebtables stack infoleak

The doreplace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAPNETADMIN capability ...

Уязвимости в Silverstripe CMS

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Brute Force, Insufficient Anti-automation и Abuse of Functionality уязвимостях в Silverstripe CMS. Brute Force WASC-11: http://site/Security/login Insufficient Anti-automation WASC-21: http://site/contact-us/ http://site/Security/lostpassword В...

XSS, Redirector и IAA уязвимости в MyBB

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, URL Redirector Abuse и Insufficient Anti-automation уязвимостях в MyBB. Для XSS и URL Redirector Abuse используется рабочий аккаунт на уязвимом сайте. О подобных атаках я писал в статье Атаки на незащищённые логин формы...

Уязвимости в теме Magazeen для WordPress и Dotclear

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Full path disclosure, Abuse of Functionality и Denial of Service уязвимостях в теме Magazeen для WordPress и Dotclear. Подобно уязвимостям во многих темах для WordPress, Drupal, ExpressionEngine и Joomla, также уязвимой...

Уязвимости во многих темах и компонентвх для Joomla

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Full path disclosure, Abuse of Functionality и Denial of Service уязвимостях во многих темах и компонентах для Joomla. Подобно уязвимостям во многих темах для WordPress, Drupal и ExpressionEngine, также уязвимыми являются...

WordPress User Enumeration

+Exploit Title: Wordpress Abuse of Functionality Vulnerability +Created By: ^Xecuti0n3r + Date : 23.04.2011 + Hour : 13:37 PM + E-mail : xecuti0n3ryahoo.com Abuse of Functionality WASC-42:- Login Username enumeration is possible in Wordpress using a functionality provided by Wordpress itself ;...

Joomla Themes Cross Site Scripting / Denial Of Service

Hello list! I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse of Functionality and Denial of Service vulnerabilities in multiple themes and components for Joomla. ------------------------- Affected products: ------------------------- Similarly to vulnerabilities in multip...

Многочисленные уязвимости в MyBB

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Information Leakage, Abuse of Functionality, Insufficient Anti-automation и Brute Force уязвимостях в MyBB. Information Leakage WASC-13: Логины есть именами пользователей на форуме и соответственно на страницах форума можно выявить логины. Abuse o...