CVE-2014-5335

Multiple cross-site request forgery CSRF vulnerabilities in innovaphone PBX 10.00 sr11 and earlier allow remote attackers to hijack the authentication of administrators for requests that modify configurations or user accounts, as demonstrated by 1 changing the administrator password via a crafted...

A billion reasons to enhance your penetration testing

There are so many questions regarding those leaked Russian passwords. Is this for real? What sites are on that list? How can you tell if your sites users are in the "Russian Billion"? Isnt this just a matter of changing user passwords? Bottom line: As a company with websites that have user...

Facebook Self-XSS Scam Fools Users into Hacking Themselves

Scammers have again targeted more than one billion active users of the popular social networking giant Facebook, to infect as many victims as possible. Not by serving fake post, neither by providing malicious video link, instead this time scammers have used a new way of tricking Facebook users in...

Cisco WebEx Meetings Server OutlookAction Class Vulnerability

A vulnerability in the OutlookAction Class of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to enumerate valid user accounts. The vulnerability is due to improper sanitization of a returned message. An attacker could exploit this vulnerability by sending crafted URL...

CVE-2014-3304

The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in php/useraccount.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts...

CVE-2014-3304

Cisco WebEx Meetings Server’s OutlookAction Class is vulnerable to unauthenticated remote enumeration of valid user accounts through crafted URL requests due to improper sanitization of returned messages (Bug ID CSCuj81722). The Cisco advisory notes that software updates are not available to fix ...

CVE-2014-2974

The CVE-2014-2974 issue affects Silver Peak VX prior to a fixed release. A CSRF in /php/user_account.php allows an unauthenticated user to cause administrative accounts to be created, enabling an attacker to hijack administrator sessions/privileges. Affected product: Silver Peak VX (versions up t...

CVE-2014-2974

Cross-site request forgery CSRF vulnerability in php/useraccount.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts...

CVE-2014-3304

The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722...

Cannot uninstall Veeam MP because Microsoft.SystemCenter.SecureReferenceOverride MP is dependent

Challenge During an attempt to uninstall Veeam Management Pack for Microsoft System Center a message appears stating that Microsoft.SystemCenter.SecureReferenceOverride MP is dependent on Veeam Base Discovery MP: Cause The Microsoft.SystemCenter.SecureReferenceOverride contains information...

Omeka < 2.2.1 Multiple Vulnerabilities

Binary data 8330.prm...

Facebook Brute Force with Customize Word Lists for Signed In Accounts

Brute Forcing is easy for Any Signed In Facebook Account at Firefox or Chrome. Usage Info Simple is that you just have to run on Developer Console of Google Chrome or Web Console of Firefox, Javascript Console of Safari, you name it. This is private exploit. You can buy it at https://0day.today...

CVE-2013-5423

IBM Flex System Manager FSM 1.1 through 1.3 before 1.3.2.0 allows remote attackers to enumerate user accounts via unspecified vectors...

Code injection

IBM Flex System Manager FSM 1.1 through 1.3 before 1.3.2.0 allows remote attackers to enumerate user accounts via unspecified vectors...

Hardcoded credentials

Cisco Unified Communications Domain Manager CDM in Unified CDM Platform Software before 4.4.2 has a hardcoded SSH private key, which makes it easier for remote attackers to obtain access to the support and root accounts by extracting this key from a binary file found in a different installation o...

CVE-2013-5423

IBM Flex System Manager FSM 1.1 through 1.3 before 1.3.2.0 allows remote attackers to enumerate user accounts via unspecified vectors...

Zurmo CRM - Persistent XSS Vulnerability

Exploit for php platform in category web applications Affected software: Zurmo CRM Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. We use a test-driven methodology for building every part of the application. Type of vulnerability: XSS...

Miniduke APT Campaigh Returns with New Targets, Hacking Tools

The Miniduke advanced persistent threat APT campaign uncovered by researchers at Kaspersky Lab and CrySys Lab in February 2013 is back after a year-long hiatus in which attacks abated almost entirely. While the initial Miniduke operations primarily targeted government organizations in Europe, thi...

Zurmo CRM - Persistent Cross-Site Scripting

Zurmo CRM - Persistent Cross-Site Scripting Affected software: Zurmo CRM Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. We use a test-driven methodology for building every part of the application. Type of vulnerability: XSS Stored UR...