CVE-2014-9566

CVE-2014-9566 : SolarWinds Orion Platform is affected by multiple SQL injection vulnerabilities in the AccountManagement.asmx endpoints (GetAccounts, GetAccountGroups). The issue allows remote authenticated users to execute arbitrary SQL commands by supplying crafted dir or sort parameters. Affec...

Hacker Abuses Google Apps vulnerability for Sending Phishing Emails

A critical vulnerability has been discovered in the Google Apps for Work that allows hackers to abuse any website’s domain name based email addresses, which could then be used to send phishing emails on company’s behalf in order to target users. If you wish to have an email address named on your...

Facebook Auto-UnLiker — Your Facebook Page 'Likes' Might Drop This Week

Do you own a Facebook Business page? If yes, then you will notice a drop in the number of "likes" on your Facebook Page by next week, which could be quite disappointing but, Facebook believes, will help business to know their actual followers. FACEBOOK'S OFFICIAL MASS AUTO-UNLIKE The social netwo...

Hudson CI Groovy Console accessible

Checks if the Hudson CI Groovy Console is unprotected. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE = "cpe:/a:oracle:hudson";...

Google Play services information disclosure vulnerability

Google Play is an online app store developed by Google for Android devices. Google Play services suffers from an information disclosure vulnerability that allows an attacker to gain access to a Google account through a carefully crafted application...

CrushFTP 7.2.0 - Multiple Vulnerabilities

CrushFTP 7.2.0 - Multiple Vulnerabilities ======================================================== I. Overview ======================================================== Multiple CSRF & Cross-Site Scripting XSS vulnerabilities have been identified in Crushftp 7.2.0 Web Interface on default...

'TweetDeck Teams' Allows Managing Multiple Twitter Accounts Without Sharing Passwords

Many times organizations, companies and groups of people come across the problem when their social media teams have to work within a single Twitter account or maintain multiple twitter accounts. In this case, either they need to use some third party API-based services or they use TweetDeck...

CrushFTP 7.2.0 Cross Site Request Forgery / Cross Site Scripting

======================================================== I. Overview ======================================================== Multiple CSRF & Cross-Site Scripting XSS vulnerabilities have been identified in Crushftp 7.2.0 Web Interface on default configuration. These vulnerabilities allows an...

CVE-2015-1498

Persistent Systems Radia Client Automation does not properly restrict access to certain request, which allows remote attackers to 1 enumerate user accounts via a getUsers request, 2 assign a role to a user account via an addAssigneesToRole request, 3 remove a role from a user account via a...

Cross site request forgery (csrf)

Persistent Systems Radia Client Automation does not properly restrict access to certain request, which allows remote attackers to 1 enumerate user accounts via a getUsers request, 2 assign a role to a user account via an addAssigneesToRole request, 3 remove a role from a user account via a...

CVE-2015-1498

The CVE-2015-1498 issue affects Persistent Systems Radia Client Automation. Connected sources confirm a improper access-control vulnerability in specific requests (notably getUsers, addAssigneesToRole, removeAssigneesFromRole) that enables remote attackers to enumerate user accounts and modify us...

NetApp OnCommand Balance Privilege Control Vulnerability

NetApp OnCommand Balance is a NetApp solution that provides guidance on how to optimize the performance and capacity of virtual and physical data center infrastructures. A security vulnerability exists in NetApp OnCommand Balance prior to version 4.2P2 that stems from the inclusion of default...

ManageEngine Multiple Products Arbitrary File Download Exploit

This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This module will attempt to login using th...

CVE-2015-0597

The Forgot Password feature in Cisco WebEx Meetings Server 1.5.1.131 and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159...

Default credentials

The Forgot Password feature in Cisco WebEx Meetings Server 1.5.1.131 and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159...

CVE-2015-0597

Cisco WebEx Meetings Server vulnerability CVE-2015-0597 allows remote attackers to enumerate administrator accounts via crafted packets in the Forgot Password process. Affected are Cisco WebEx Meetings Server 1.5(.1.131) and earlier. The root cause is insufficient input validation, enabling unaut...

CVE-2015-0597

The Forgot Password feature in Cisco WebEx Meetings Server 1.5.1.131 and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159...

Cisco WebEx Meetings Server User Enumeration Vulnerability (CNVD-2015-00894)

Cisco WebEx Meetings are web conferencing solutions. A security vulnerability exists in Cisco WebEx Meetings Server that allows an attacker to send special messages to enumerate administrator accounts...

FBI: Business Email Compromise Scams Steal $214m in 2014

The FBI’s Internet Crime Complaint Center IC3 is sounding the alarm on a type of fraud they are calling business email compromise BEC scams. The scheme, formerly known as a man-in-the-email attack, comes in three distinct flavors, each of which is ultimately designed to dupe corporate employees o...

ManageEngine Multiple Products Arbitrary File Download

This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This module will attempt to login using th...