e2openplugin OpenWebif 1.2.4 Code Execution

Hello all, e2openplugin-OpenWebif is an open source web interface plugin for IP TVs and media centers. It is found in several IP TV software images and hardware products including the commercial Dreambox devices. A remote code injection vulnerability was found in the "key" HTTP GET parameter of t...

Census Bureau Says Breach Didn't Compromise Sensitive Data

Officials at the United States Census Bureau say that the attackers who compromised one of the bureau’s databases last week did not get access to any confidential information, but only data such as names and phone numbers of organizations that submit information to the Federal Audit Clearinghouse...

ManageEngine Desktop Central - Arbitrary File Upload / RCE Vulnerabilities

ManageEngine Desktop Central suffers from code execution and remote shell upload vulnerabilities. Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro Agile Information Security...

ManageEngine Password Manager Pro / ManageEngine IT360 - SQL Injection

source: https://www.securityfocus.com/bid/69303/info ManageEngine Password Manager Pro and ManageEngine IT360 are prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

Carna Botnet Analysis Enumerates Vulnerable Network Devices

The Carna botnet, more formally known as the Internet Census 2012, stirred up a hornet’s nest of controversy when it was unveiled in March to a number of popular security mailing lists. An unidentified researcher had found more than 420,000 embedded devices that were accessible online with defaul...

United States Census Bureau Hacked and Vulnerability Exposed

United States Census Bureau Hacked and Vulnerability Exposed A Group of Hackers from r00tw0rm found SQL injection Vulnerability on United States Census Bureau,0x3a,user\,0x3a,database\,4,5,groupconcat\tablename+from+informationschema.tables--+ and Hackers successfully exploit the Database and...

Netvolution CMS 2.5.8 Blind SQL Injection

Netvolution CMS v2.5.8 is vulnerable to a blind SQL injection attack in the HTTP “referer” header. A malicious user may utilize this vulnerability to modify content on the vulnerable website, inject malicious javascript code to a visitor’s browser, collect CMS usernames and plaintext passwords an...

LulzSec steal millions of records from the UK 2011 Census

LulzSec steal millions of records from the UK 2011 Census According to a Pastebin Link posted by LulzSec , they claimed to steal millions of records from the UK 2011 Census, with a public release coming soon. However, the group did post the a tweet : Our next step is to categorize and format leak...

LulzSec steal millions of records from the UK 2011 Census

LulzSec steal millions of records from theUK 2011 Census According to a Pastebin Link posted by LulzSec , they claimed to steal millions of records from the UK 2011 Census, with a public release coming soon. However, the group did post the a tweet : Our next step is to categorize and format leake...

CVE-2010-2020: FreeBSD kernel NFS client local vulnerabilities

Census ID: census-2010-0001 URL: http://census-labs.com/news/2010/05/26/freebsd-kernel-nfsclient/ CVE ID: CVE-2010-2020 Affected Products: FreeBSD 8.0-RELEASE, 7.3-RELEASE, 7.2-RELEASE Class: Improper Input Validation CWE-20 Remote: No Discovered by: Patroklos Argyroudis We have discovered two...

U.S. Census Bureau 2010 Census Campaign Warning

US-CERT asks users to be vigilant during the U.S. Census Bureau's 2010 Census campaign and to watch for potential census scams. According to the U.S. Census 2010 website, they began delivery of the printed census forms to every resident in the United States on March 1, 2010. The only way to...

monkey -- improper input validation vulnerability

Census Labs reports: We have discovered a remotely exploitable "improper input validation" vulnerability in the Monkey web server that allows an attacker to perform denial of service attacks by repeatedly crashing worker threads that process HTTP requests...

CVE-2009-3586: CoreHTTP web server off-by-one buffer overflow vulnerability

census ID: census-2009-0003 URL: http://census-labs.com/news/2009/12/02/corehttp-web-server/ CVE ID: CVE-2009-3586 Affected Products: CoreHTTP web server versions = 0.5.3.1. Class: Improper Input Validation CWE-20, Failure to Constrain Operations within the Bounds of a Memory Buffer CWE-119 Remot...

FreeBSD 7.0/7.1 - 'vfs.usermount' Local Privilege Escalation

/ cve-2008-3531.c -- Patroklos Argyroudis, argp at domain census-labs.com Privilege escalation exploit for the FreeBSD-SA-08:08.nmount CVE-2008-3531 vulnerability: http://security.freebsd.org/advisories/FreeBSD-SA-08:08.nmount.asc http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3531 For ...