Skype Cross Site Vulnerabilities, user accounts can be Hijacked

Skype Cross Site Vulnerabilities, user accounts can be Hijacked The independent security researcher Ucha Gobejishvili has detected a cross site scripting XSS vulnerabilities affecting shop.skype.com and api.skype.com. According to a blog post on 1337 Blog, the XSS flaw discovered on these sites...

CMS wizard Cross Site Scripting

================================================================= -=CMS wizard Cross Site Scripting ================================================================= Author: XaDaL Date: 14-02-2012 vendor: http://www.cmswizard.co.uk/ tested on: windows mobile dork : powered by CMS wizard This...

XBox Security Chief Says Account Hacks Linked To Phishing, Resale Schemes

In a pattern that is becoming more common, hackers are hijacking XBox Live accounts, then tricking them out with expansion modules and other add-ons before trying to resell them to unwitting third parties. Recent XBox Live account hijacks are most likely the product of phishing and identity theft...

PayPal UK Twitter account hijacked by angry customer

PayPal UK Twitter account hijacked by angry customer Second high-profile hack of the week against Twitter accounts, Yesterday FOX News Twitter Account was Hacked by 5CR1PT K1DD3S & then sent false tweets saying that U.S. President Barack Obama had been shot dead. Today an angry customer of Paypal...

Mobile Devices Key To Facebook's New Log-In Approval Feature

Facebook is implementing a new opt-in, two-factor verification security feature they are calling log-in approval. The new feature will require users to enter a unique, one time code, which Facebook will send via SMS whenever a user tries to access his or her account from a new and/or unrecognized...

CVE-2011-0748

CVE-2011-0748 concerns phpList (PHPList) before 2.10.13, where multiple CSRF vulnerabilities allow remote attackers to hijack administrator sessions for actions like adding or editing administrator accounts. The issue affects phplist prior to 2.10.13 and stems from CSRF protections missing for ad...

CVE-2011-0545: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in adduser.do in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole...

Nagios XI - Multiple Cross-Site Request Forgery Vulnerabilities

source: https://www.securityfocus.com/bid/42322/info Nagios XI is prone to multiple cross-site request-forgery vulnerabilities because the application fails to properly validate HTTP requests. Successful exploit requires that the 'nagiosadmin' be logged into the web interface. Attackers can explo...

LightNEasy 3.2 admin account hijacking csrf vulnerability

Exploit for php platform in category web applications ========================================================= LightNEasy 3.2 admin account hijacking csrf vulnerability ========================================================= Author: pimpim Software Link:...

CVE-2010-1610: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in index.php in OpenCart 1.4 allows remote attackers to hijack the authentication of an application administrator for requests that create an administrative account via a POST request with the route parameter set to "user/user/insert." NOTE: some of...

RunCMS 2ma - 'post.php' SQL Injection

query$sql redirectheader"index.php", 2, MDCANTGETFORUM; exit; ... 'forum' variable is taken from $POST array and inserted in a sql query without prior santization and without being surrounded by quotes. Then you can subsequently manipulate this query in /modules/forum/class/class.permissions.php ...

SA-CONTRIB-2009-055 - BUEditor - Cross Site Scripting

The BUEditor module provides a plain textarea editor designed to facilitate code writing. The module suffers from a Cross Site Scripting XSS vulnerability, which allows an attacker to hijack the account of a logged in user by tricking them into visiting a seemingly innocent page using the Live...

CzarNews <= 1.20 (Account Hijacking) Remote SQL Injection Vuln

No description provided by source. czarNews Account Hijacking = 1.20 user and password Leak ---------------------------------------------------------- Author: Maycon Maia Vitali 0ut0fBound Contact: mayconmaia at yahoo dot com dot br http://maycon.gsec.com.br Original Xploit by StAkeR...

czarnewsaccount-sql.txt

czarNews Account Hijacking = 1.20 user and password Leak ---------------------------------------------------------- Author: Maycon Maia Vitali 0ut0fBound Contact: mayconmaia at yahoo dot com dot br http://maycon.gsec.com.br Original Xploit by StAkeR http://www.milw0rm.com/exploits/6462 Gerenal...

CzarNews 1.20 - Account Hijacking SQL Injection

czarNews Account Hijacking = 1.20 user and password Leak ---------------------------------------------------------- Author: Maycon Maia Vitali 0ut0fBound Contact: mayconmaia at yahoo dot com dot br http://maycon.gsec.com.br Original Xploit by StAkeR http://www.milw0rm.com/exploits/6462 Gerenal...

CzarNews 1.20 - Account Hijacking SQL Injection

CzarNews 1.20 - Account Hijacking SQL Injection czarNews Account Hijacking = 1.20 user and password Leak ---------------------------------------------------------- Author: Maycon Maia Vitali 0ut0fBound Contact: mayconmaia at yahoo dot com dot br http://maycon.gsec.com.br Original Xploit by StAkeR...

CVE-2008-3969

Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUSIDENTIFIED state." NOTE: this issue exists because of an incomplete fix for CVE-2008-3920...

CVE-2008-3920

Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to "recreate" and "hijack" existing accounts via unspecified vectors...

CVE-2008-3920

CVE-2008-3920 affects BitlBee prior to 1.2.2, where an unspecified vulnerability could allow remote attackers to recreate and hijack existing accounts. The OpenVAS/Fedora advisories reference this CVE in updates for bitlbee (Fedora 2008-7274, 2008-7712, 2008-7830, etc.), indicating remediation vi...

CVE-2007-5109

Cross-site request forgery (CSRF) in index.php of FlatNuke 2.6 (and possibly 3) allows remote attackers to change user password and privilege level by manipulating the user, regpass, and level parameters in a none_Login action, demonstrated via a Flash object. No explicit remediation is provided ...