CVE-2014-9037

WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash...

WordPress <= 4.0.0 - Multiple Vulnerabilities #2

Because of multiple vulnerabilities in WordPress 4.0.0 and previous versions, the attackers can obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash. Related records:...

Paypal Two-Factor Authentication Bypass

Today, the 5th of August, I release my Paypal 2FA bypass exploit. It's been exactly 2 months since I've reported this bug, and due to the simplicity of it, I believe I've given Paypal long enough to fix it. It's still not fixed. Full blog can be found here: http://blog.internot.info/ My website:...

FlatNuke 2.5.x Index.PHP Multiple Remote File Include Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/15172/info FlatNuke is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues to...

PHPmotion <= 2.1 CSRF Vulnerability

No description provided by source. PHPmotion = 2.1 CSRF vulnerability Author: Ausome1 Email: [email protected] Website: http://www.enigmagroup.org Description: Change a member's password and/or email...

CVE-2013-6171

checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the...

Twitter OAuth Data Leaked From Third-Party App

An attacker, who may have gotten the information from the database of a third party, claims to have access to the OAuth login tokens and secrets for every Twitter user. He has posted more than 15,000 of the entries online and claims that he can now access the account of any user he wishes. Twitte...

Google WebLogin Tokens Expose Google Apps, User Data

An exposure in the way Google handles authentication is an illustration of the unintended consequences of trading security for a little bit of convenience. Craig Young, a researcher from security company Tripwire, demonstrated at Def Con over the weekend how an Android single sign-on token known ...

Researchers Bypass Google Two-Factor Authentication

For some time, attackers had the ability to bypass Google’s two-step authentication system through access to users’ app-specific passwords, giving them full access to victims’ Google accounts, including Gmail. The vulnerability that enables this attack, discovered by researchers from DuoSecurity,...

jira 4.4.3 greenhopper 5.9.8 - Multiple Vulnerabilities

jira 4.4.3 greenhopper 5.9.8 - Multiple Vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CVE-2012-1500, Stored XSS in JIRA v4.4.3663-r165197, GreenHopper Resolved in Version 5.9.8, Proof of Concept External References: CVE-2112-1500 CVE-2112-1500 XSS.Cx Blog GHS-5642 Reported to...

Gizmodo gets hacked via Apple tech support

Is your iCloud account secured by a good password? Please Don't rely on the cloud. Here's a terrifying tale of modern hacking. Mat Honan, a reporter at tech site Gizmodo, was playing with his daughter when his phone went dead. Thinking it was a software glitch, he rebooted, and went to log in to...

GLSA-201206-03 : Opera: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201206-03 Opera: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Opera. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially...

CVE-2011-2084

Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to read 1 hashes of former passwords and 2 ticket correspondence history by leveraging access to a privileged account...

CVE-2011-2084

Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to read 1 hashes of former passwords and 2 ticket correspondence history by leveraging access to a privileged account...

Free Reality v3.1-0.6 - Multiple Web Vulnerabilities

Document Title: =============== Free Reality v3.1-0.6 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=513 Release Date: ============= 2012-05-06 Vulnerability Laboratory ID VL-ID: ==================================== 513...

0Day Remote Password Reset Vulnerability in MSN Hotmail patched

Microsoft's MSN Hotmail Live email service currently hosts over 350 million unique users. A Vulnerability Laboratory senior researcher, Benjamin Kunz Mejri, identified a critical security vulnerability in Microsoft's official MSN Hotmail Live service. A critical vulnerability was found in the...

Flatnux CMS 2011 08.09.2 - Multiple Web Vulnerabilities

Document Title: =============== Flatnux CMS 2011 08.09.2 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=487 Release Date: ============= 2012-03-31 Vulnerability Laboratory ID VL-ID: ==================================== 487...

CVE-2011-1711

Unspecified vulnerability in the Mobility Pack 1.1.2 and earlier in Novell Data Synchronizer 1.0.x, and 1.1.x through 1.1.1 build 428, allows remote authenticated users to access the accounts of other users via unknown vectors...

CVE-2011-0685

CVE-2011-0685 affects Opera before 11.01 where the Delete Private Data feature’s Clear all email account passwords option was not properly implemented, potentially allowing a physically proximate attacker to access an email account on an unattended workstation. Connected advisories (SUSE/OpenSUSE...

Default credentials

The myrand function in functions.php in MyBB aka MyBulletinBoard before 1.4.12 does not properly use the PHP mtrand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force atta...