448 matches found
Expinion.net News Manager Lite 2.5 more.asp ID Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/9935/info Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks. The issues exist in the...
A large dial vulnerability struck, eBAY Black a week-vulnerability warning-the black bar safety net
eBay does not protect their user's data, before he also committed a similar error, but this time apparently eBay's security team not draw the lesson. This time they also want to Own the security of the negative attitude to pay. Text: In less than 3 within 6 hours, eBAY again reported out 3 a...
WordPress Cookie handling process can lead to account hijacking-vulnerability warning-the black bar safety net
! Write ahead: This is actually a cookie transmission does not use the https problem, the most natural of seemingly unrelated picture, but in front of a burst of lead to ebay account disclosure of intrusion events, also has this vulnerability in the shadow. ps: looks like this hack was a girl...
reg.ebay.com Cross Site Scripting
Advisory: reg.ebay.com - Cross-site Scripting vulnerability Advisory ID: SSCHADV2014-004 Author: Stefan Schurtz Affected Software: Successfully tested on reg.ebay.com Vendor URL: http://www.ebay.com/ Vendor Status: informed ========================== Vulnerability Description...
Faceless: Account hijacking possible through ADB backup feature
It was found that if an attacker had access to an unlocked phone, they could take any data from the application's sandbox through ADB's backup feature. Normally ADB backup allows applications to be backed up to the cloud. This means that if a user replaces or wipes their phone, they can restore a...
PayPal Fixes Serious Account Hijacking Bug in Manager
PayPal patched a hole in its Manager portal this week that could have made it easy for an attacker to hijack an admin’s account, change their password and steal their personal information — not to mention their savings. Manager is a feature of the service that allows users to manage their Payflow...
No-CMS 0.6.6 rev 1 - Admin Account Hijacking / RCE Exploit via Static Encryption Key
Exploit for php platform in category web applications ?php / Static encryptionkey of No-CMS lead to Session Array Injection in order to hijack administrator account then you will be able for upload php files to server via theme/module upload. This exploit generates cookie for administrator access...
No-CMS 0.6.6 rev 1 - Admin Account Hijacking / Remote Code Execution via Static Encryption Key
mcryptexists = functionexists'mcryptencrypt'; logmessage'debug', 'Enc...
No-CMS 0.6.6 Rev 1 Account Hijack / Remote Command Execution
mcryptexists = functionexists'mcryptencrypt';...
No-CMS 0.6.6 rev 1 - Admin Account Hijacking Remote Code Execution via Static Encryption Key
No-CMS 0.6.6 rev 1 - Admin Account Hijacking Remote Code Execution via Static Encryption Key ?php / Static encryptionkey of No-CMS lead to Session Array Injection in order to hijack administrator account then you will be able for upload php files to server via theme/module upload. This exploit...
Office 365 Account Hijacking
Title: Office 365 - Account Hijacking Cookie Re-Use Flaw, extended Vendor: - Microsoft Products affected: - Office 365 E3 package version as of February 22nd, 2014 - Sharepoint Online Services Abstract: The well-known account hijacking through cookie re-use flaw was originally reported in July 20...
MyBB < 1.6.11 Multiple Vulnerabilities
According to its version number, the MyBB install running on the remote web server is affected by multiple vulnerabilities : - A flaw exists in which accounts without login keys can be hijacked. - An information disclosure vulnerability exists due to improper implementation of UTF8. A remote...
MGASA-2014-0031 Updated drupal package fixes security vulnerabilities
Christian Mainka and Vladislav Mladenov reported a vulnerability in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts CVE-2014-1475. Matt Vance and Damien Tournoud reported an access bypass vulnerability in the...
Drupal 6.x < 6.30 OpenID Module Account Hijacking
The remote web server is running a version of Drupal that is 6.x prior to 6.30. It is, therefore, affected by a security bypass vulnerability in the OpenID module that could allow an authenticated attacker to hijack other users' accounts. Only user accounts associated with one or more OpenID...
eBay Open to Cross-Site Request Forgery, Account Hijacking
EBay is vulnerable to a hack that would allow an attacker to hijack an account and make unauthorized purchases from the victim’s account that would be difficult to disprove. The vulnerability was discovered and reported to eBay in August, and despite three separate communications from the online...
Microsoft Protects User Accounts with New Security Features
Microsoft announced yesterday that it will complement the two-factor authentication it enabled for account holders in April with additional security features designed to deny account hijacking and unauthorized access. Windows PC and mobile users, along with Outlook, SkyDrive, Xbox, Skype and othe...
Mailbox iPhone app vulnerability executes any Javascript from HTML mail body
Italian Researcher Michele Spagnuolo recently revealed a serious vulnerability in the popular Mailbox iPhone app. Mailbox is a tidy iOS the email app recently purchased by Dropbox, has a pretty wide-open hole that could allow bad actors to hijack your device. The flaw occurs in the latest version...
Mailbox App for iOS Automatically Executes Javascript
UPDATE – The popular Mailbox app for iOS suffers from a bit of a security nightmare. A security researcher in Italy recently discovered that the app automatically executes javascript contained in any HTML email. “It is just a bad design choice,” said researcher Michele Spagnulo, a computer...
iPic Sharp 1.2.1 Wifi Script Insertion
Title: ====== iPic Sharp v1.2.1 Wifi iOS - Persistent Foldername Web Vulnerability Date: ===== 2013-07-24 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1031 VL-ID: ===== 1031 Common Vulnerability Scoring System: ==================================== 3.6 Introduction:...