FTP Sprite v1.2.1 iOS - Persistent Web Vulnerability

Document Title: =============== FTP Sprite v1.2.1 iOS - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1007 Release Date: ============= 2013-07-11 Vulnerability Laboratory ID VL-ID: ==================================== 1007...

Ecshop csrf可劫持用户账号

简要描述： 详细说明： 修改个人信息处未验证token，可通过一个精心构造的表单强制用户修改邮箱，达到劫持用户的目的，劫持用户账号只需要欺骗目标用户点击一个链接。 POC: None 劫持成功后，就可以去修改密码喽...

CVE-2013-0080

Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "Callback Function Vulnerability."...

Vulnerability in HTC website allow attacker to hijack accounts

Thamatam Deepak Mr.47™ reported a Cross site scripting XSS Vulnerability and cookie handling in HTC website, that allow an attacker to HTC website hijack accounts. Mr. Deepak is a 16 years old whitehat hacker, listed in Apple Hall of Fame with 'The Hacker News' researcher Mohit Kumar this month...

Vulnerability in HTC website allow attacker to hijack accounts

Thamatam Deepak Mr.47™ reported a Cross site scripting XSS Vulnerability and cookie handling in HTC website, that allow an attacker to HTC website hijack accounts. Mr. Deepak is a 16 years old whitehat hacker, listed in Apple Hall of Fame with 'The Hacker News' researcher Mohit Kumar this month...

Exclusive : Hacking Hotmail and Outlook accounts using Cookie reuse vulnerability

This Friday I was working with my co-security researcher "Christy Philip Mathew" in +The Hacker News Lab for testing the Cookie Handling Vulnerabilities in the most famous email services i.e Hotmail and Outlook. Well, both are merged now and part of the same parent company - Microsoft, the softwa...

Skype Restores Password Resets, Repairs Flaw that Allows Account Hijacking

UPDATE – Skype engineers have repaired a newly reported vulnerability that would allow someone to abuse the platform’s password-reset mechanism to take over another account. “We suspended the password reset feature temporarily this morning as a precaution and have made updates to the password res...

Mail.RU Group eMail - Persistent Web Vulnerability

Document Title: =============== Mail.RU Group eMail - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=709 Release Date: ============= 2012-10-09 Vulnerability Laboratory ID VL-ID: ==================================== 709 Comm...

Fortigate UTM WAF Appliance Multiple Vulnerabilities

Multiple input validation vulnerabilitiespersistent are detected in the FortiGate UTM Appliance Application. Remote attackers & low privileged user accounts can inject persistent own malicious script code to manipulate specific customer/admin requests. Affected Products: ==================...

Interspire Email Marketer v6.0.1 Multiple Vulnerabilites

Exploit for php platform in category web applications Interspire Email Marketer v6.0.1 - Multiple Vulnerabilites Details: ======== 1.1 A SQL Injection vulnerability is detected in the Interspire Email Marketer v6.0.1, Email Marketing Software. The vulnerability allows an attacker remote or local...

CVE-2010-5093

SilverStripe 2.3.x contains a vulnerability in Member_ProfileForm (security/Member.php) up to version 2.3.7 that allows remote attackers to hijack user accounts by saving data using the email address (ID) of another user. Affected software: SilverStripe 2.3.x (before 2.3.7). Root cause: input han...

Barracuda SSL VPN 680 Cross Site Scripting

Exploit for php platform in category web applications Barracuda SSL VPN 680 - Cross Site Scripting Vulnerabilities Introduction: ============= The Barracuda SSL VPN is an integrated hardware and software solution enabling secure, clientless remote access to internal network resources from any Web...

Flogr v2.5.6 & v2.3 - Cross Site Script Vulnerabilities

Document Title: =============== Flogr v2.5.6 & v2.3 - Cross Site Script Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=656 Release Date: ============= 2012-07-10 Vulnerability Laboratory ID VL-ID: ==================================== 656...

eSyndiCat Pro 2.4.1 CSRF / XSS / SQL Injection

Title: ====== eSyndiCat Pro v2.4.1 - Multiple Web Vulnerabilities Date: ===== 2012-05-19 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=575 VL-ID: ===== 575 Common Vulnerability Scoring System: ==================================== 7.1 Introduction: =============...

Anchor v0.6-0.4 CMS - Persistent Web Vulnerability

Document Title: =============== Anchor v0.6-0.4 CMS - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=453 Release Date: ============= 2012-02-28 Vulnerability Laboratory ID VL-ID: ==================================== 453...

Skype Cross Site Vulnerabilities, user accounts can be Hijacked

Skype Cross Site Vulnerabilities, user accounts can be Hijacked The independent security researcher Ucha Gobejishvili has detected a cross site scripting XSS vulnerabilities affecting shop.skype.com and api.skype.com. According to a blog post on 1337 Blog, the XSS flaw discovered on these sites...

CMS wizard Cross Site Scripting

================================================================= -=CMS wizard Cross Site Scripting ================================================================= Author: XaDaL Date: 14-02-2012 vendor: http://www.cmswizard.co.uk/ tested on: windows mobile dork : powered by CMS wizard This...

XBox Security Chief Says Account Hacks Linked To Phishing, Resale Schemes

In a pattern that is becoming more common, hackers are hijacking XBox Live accounts, then tricking them out with expansion modules and other add-ons before trying to resell them to unwitting third parties. Recent XBox Live account hijacks are most likely the product of phishing and identity theft...

PayPal UK Twitter account hijacked by angry customer

PayPal UK Twitter account hijacked by angry customer Second high-profile hack of the week against Twitter accounts, Yesterday FOX News Twitter Account was Hacked by 5CR1PT K1DD3S & then sent false tweets saying that U.S. President Barack Obama had been shot dead. Today an angry customer of Paypal...

Mobile Devices Key To Facebook's New Log-In Approval Feature

Facebook is implementing a new opt-in, two-factor verification security feature they are calling log-in approval. The new feature will require users to enter a unique, one time code, which Facebook will send via SMS whenever a user tries to access his or her account from a new and/or unrecognized...