ThinkSNS 储存型xss一枚

简要描述： rt. 详细说明： 对于swf文件 过分信任 通杀所有浏览器 测试代码 : http://demo.thinksns.com/t3/weiba/post2075 chrome firefox ie 10 可蠕虫。 漏洞证明： chrome firefox https://images.seebug.org/upload/201406/150142590b17fc5d7dedb7e685f9e1f2797b7c98...

X (Formerly Twitter): XSS vulnerability in video player page

Hello, I found a XSS vulnerability in your site. Try this:...

LOL, Jar File Malware Just Goes Viral Through Facebook Messages

If you came across any suspicious Facebook message with ‘LOL’ text or a fake Image file send by any of your Facebook friend, avoid clicking it. A Trojan horse is currently circulating in wild through the Facebook social network that could steal your Facebook account data and Credentials. Security...

joola.io: HTTP Strict Transport Security (HSTS) Policy Not Enabled

Dear Team, Step-by-step instructions on how to reproduce the problem: It was found the application is vulnerable to HTTP Strict Transport Security HSTS Policy Not Enabled. HTTP Strict Transport Security HSTS is an opt-in security enhancement that is specified by a web application through the use ...

Fake Digital Certificates Found in the Wild While Observing Facebook SSL Connections

Visiting a website certified with an SSL certificate doesn’t mean that the website is not bogus. Secure Sockets Layer SSL protect the web users in two ways, it uses public key encryption to encrypt sensitive information between a user’s computer and a website, such as usernames, passwords, or...

CVE-2014-1518

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary cod...

ZeuS Botnet Updating Infected Systems with Rootkit-Equipped Trojan

ZeuS, or Zbot is one of the oldest families of financial malware, it is a Trojan horse capable to carry out various malicious and criminal tasks and is often used to steal banking information. It is distributed to a wide audience, primarily through infected web pages, spam campaigns and drive-by...

Mozilla Browsers JavaScript Navigator Object Memory Corruption - Ver2 (CVE-2006-3677)

Mozilla Firefox and Seamonkey are very popular open source web browsers from Mozilla Foundation, based on the Mozilla Suite code base. The browser is an application designed for tasks related to web browsing, such as displaying HTML pages, downloading files, rendering different media, and so on...

Mozilla Browsers JavaScript Navigator Object Memory Corruption - Ver2 (CVE-2006-3677)

Mozilla Firefox and Seamonkey are very popular open source web browsers from Mozilla Foundation, based on the Mozilla Suite code base. The browser is an application designed for tasks related to web browsing, such as displaying HTML pages, downloading files, rendering different media, and so on...

Heartbleed and other heartaches

Security Heartbleed and other heartaches Share April 11th, 2014 As has been reported extensively already, OpenSSL just fixed a serious vulnerability, dubbed Heartbleed. OpenSSL is used in a variety of products used on the internet, including Opera products and servers. We want to share with you h...

C2FO: The server supports only older protocols for HTTPS connections

The webserver at c2fo.com, 198.58.120.159 only supports SSL 3.0 and TLS 1.0 for secure HTTP connections see: test-results.png. While TLS 1.0 is more secure than SSL 3.0, subsequent versions of TLS, TLS 1.1 and TLS 1.2, are significantly more secure and fix many vulnerabilities present in SSL 3.0...

Siemens Ruggedcom Addresses BEAST Flaw in WiMax Products

The BEAST attack on some TLS implementations made major news when it was disclosed, showing that attackers could intercept and decrypt SSL-protected sessions in real time, breaking a significant portion of the confidentiality model of the protocol. Vendors rushed to patch and implement mitigation...

Beware of Zeus Banking Trojan Signed With Valid Digital Signature

A new dangerous variant of ZeuS Banking Trojan has been identified by Comodo AV labs which is signed by stolen Digital Certificate which belongs to Microsoft Developer to avoid detection from Web browsers and anti-virus systems. Every Windows PC in the world is set to accept software "signed" wit...

IE 12 to Support HSTS Encryption Protocol

Microsoft confirmed today it will support HTTPS Strict Transport Protocol HSTS in Internet Explorer 12, bringing its browser in line with other major vendors in its support of the protocol. Browsers supporting HSTS force any sessions sent over HTTP to be sent instead over HTTPS, encrypting...

Vulnerability in World Largest Video Site Turned Million of Visitors into DDoS Zombies

An application layer or 'layer 7' distributed denial of service DDoS attacks is one of the most complicated web attack that disguised to look like legitimate traffic but targets specific areas of a website, making it even more difficult to detect and mitigate. Just Yesterday Cloud-based security...

Linkedin Password Decryptor - Linkedin Password Recovery Software

Linkedin Password Decryptor is the all-in-one software to recover Linkedin passwords stored by popular Web Browsers. These days, most of the web browsers store the website login passwords to prevent hassale of entering the password again and again. Each web browser use their own encryption...

Browser Bugs, BIOS and Brokers dominate CanSecWest, Pwn2Own

Browsers, brokers and BIOS: you could safely call that triumvirate the past, present and future of security, but you’d be wrong. If last week’s CanSecWest conference, and Pwn2Own and Pwnium contests are indeed a point-in-time snapshot of the technical side of information security, then after last...

Oracle Demantra 12.2.1 - Persistent Cross-Site Scripting

Oracle Demantra 12.2.1 - Persistent Cross-Site Scripting Details: The TaskSender area is vulnerable to a stored cross-site scripting vulnerability. Impact: An attacker could exploit this flaw to get active HTML or script code executed in an authenticated user’s browser. Cross-site Scripting may b...

[FacebookPasswordDump v2.0] Command-line Tool to Recover Facebook Password from Browsers and Messengers

Facebook Password Dump is the command-line tool to instantly recover your lost Facebook password from popular web browsers and messengers. Currently it can recover your Facebook password from following applications, Firefox Internet Explorer v6.x - v10.x Google Chrome Chrome Canary/SXS CoolNovo...

[WebCacheImageInfo] Displays the software/camera model of images stored in the cache of your Web browser

WebCacheImageInfo is a simple tool that searches for JPEG images with EXIF information stored inside the cache of your Web browser Internet Explorer, Firefox, or Chrome, and then it displays the list of all images found in the cache with the interesting information stored in them, like the softwa...