CVE-2013-2754

Cross-site request forgery CSRF vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via a request to admin/users/add/user/do/...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via a request to admin/users/add/user/do/...

Apple iOS < 7.1 Multiple Vulnerabilities

Binary data appleios71check.nbin...

PT-2014-2056 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600 router versions prior to 2.17b02 Description: The issue concerns a cross-site request forgery CSRF vulnerability. This vulnerability allows remote attackers to hijack the authentication of administrators for various requests,...

CloudFlare Issues Transparency Report

CloudFlare claims government requests for user data are affecting fewer than .017 percent of their two million global customers The Web performance and security company yesterday issued the report in accordance with the Department of Justice’s new regulations for publishing information pertaining...

Pony Botnet steals $220,000 from multiple Digital Wallets

Are you the one of the Digital Currency Holder? PONY is after You. A Group of cyber criminals has used hundreds of thousands of infected computers of the digital currency holders to filch approximately $220,000 worth of Bitcoins and other virtual currencies. The researchers at the security firm,...

[Lynis 1.4.2] Security and System Auditing Tool to Harden Linux Systems

Lynis is an auditing tool for Unix/Linux. It performs a security scan and determines the hardening state of the machine. Any detected security issues will be provided in the form of a suggestion or warning. Beside security related information it will also scan for general system information,...

Yahoo!: A csrf vulnerability which add and remove a favorite team from a user account.

Thank you for your submission to Yahoo’s Bug Bounty program. While we recognize the effort that you put into the research and writing of a report for us to evaluate, but unfortunately this bug has already been reported to us. We appreciate your adherence to responsible disclosure guidelines and...

Hackers exploiting Router vulnerabilities to hack Bank accounts through DNS Hijacking

In past months, we have reported about critical vulnerabilities in many wireless Routers including Netgear, Linksys, TP-LINK, Cisco, ASUS, TENDA and more vendors, installed by millions of home users worldwide. Polish Computer Emergency Response Team CERT Polska recently noticed a large scale cybe...

Ektron CMS Take Over - Hijacking Accounts

I have detailed a vulnerability within Ektron CMS that allows an unauthenticated user to hijack any account. The clear targets of choice for this CMS would be the builtin or admin account. Whilst I found this issue back in 2012, it appears that around 65 are still vulnerable and should be patchin...

[Lynis 1.4.0] Security and System Auditing Tool to Harden Linux Systems

Lynis is an auditing tool for Unix/Linux. It performs a security scan and determines the hardening state of the machine. Any detected security issues will be provided in the form of a suggestion or warning. Beside security related information it will also scan for general system information,...

Yahoo Mail hacked; Change your account password immediately

A really bad year for the world's second-largest email service provider, Yahoo Mail! The company announced today, 'we identified a coordinated effort to gain unauthorized access to Yahoo Mail accounts', user names and passwords of its email customers have been stolen and are used to access multip...

Web Client Plug-in error: “invalid Single Sign-On token”

Challenge When a new user of the vSphere web client attempts to access the Veeam Web Client Plug-in, they encounter the following error: Server error: Failed to login to Veeam Backup Enterprise Manager. Login failed due to invalid Single Sign-On token Cause To successfully obtain statistics from...

16 Million German Users' Data Compromised in mysterious Botnet Malware attack

A New day begins with a Cup of Coffee and with new massive Data Breach News. This time in Germany, the Digital identities of about 16 million online users had been stolen, and posing a risk to their accounts linked to social media and other services. Federal Office for Information Security BSI...

CVE-2013-6922

Multiple cross-site request forgery CSRF vulnerabilities in the Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to hijack the authentication of administrators for requests that 1 add user accounts via a crafted request to admin/accesscontroluseradd.php; 2...

CVE-2012-6631

Cross-site request forgery CSRF vulnerability in accounts/admin/index.php in Vessio NetBill 1.2 allows remote attackers to hijack the authentication of administrators for requests that add accounts via a new-client action...

iScripts MultiCart <= 2.4 - Persistent XSS / CSRF / XSS+CSRF Mass Accounts takeover

Exploit for php platform in category web applications Exploit Title : iScripts MultiCart same product id for which you submited the review. Cross-site request forgery form nam...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Atmail Webmail Server before 7.2 allow remote attackers to hijack the authentication of administrators for requests that 1 add user accounts, 2 modify user accounts, 3 delete user accounts, or 4 stop the product's service...

Setting Up a Secure and Private Twitter Account

To kick off the new year, we are restarting our tutorial screencast series where we attempt to briefly walk users through the process of locking down their various online accounts. Today’s video, which is just slightly longer than we had hoped, thoroughly details the steps necessary to ensure tha...

Dredge School Administration System 1.0 Multiple Vulnerabilities

Dredge School Administration System version 1.0 suffers from backup disclosure, account disclosure, cross site request forgery, cross site scripting, and remote SQL injection vulnerabilities. Dredge School Administration System V1.0 - Multiple Vulnerabilties...