9524 matches found
vBulletin 5.0.0 Beta 11 5.0.0 Beta 28 - SQL Injection
vBulletin 5.0.0 Beta 11 5.0.0 Beta 28 - SQL Injection Exploit Title: vBulletin 5 Beta XX SQLi 0day Google Dork: "Powered by vBulletin Version 5.0.0 Beta" Date: 24/03/2013 Exploit Author: Orestis Kourides Vendor Homepage: www.vbulletin.com Software Link: Version: 5.0.0 Beta 11 - 5.0.0 Beta 28...
LinkedIn Investors Cross Site Scripting
============================================= INTERNET SECURITY AUDITORS ALERT 2013-006 - Original release date: 4th March 2013 - Last revised: 25th March 2013 - Discovered by: Eduardo Garcia Melia - Severity: 4.3/10 CVSS Base Scored ============================================= I. VULNERABILITY...
[SECURITY] Fedora 17 Update: privoxy-3.0.21-1.fc17
Privoxy is a web proxy with advanced filtering capabilities for protecting privacy, filtering web page content, managing cookies, controlling access, and removing ads, banners, pop-ups and other obnoxious Internet junk. Privoxy has a very flexible configuration and can be customized to suit...
QuinStreet Database ID Spoofing
March 13, 2013 FULL-DISCLOSURE Exclusive - Vielen Dank John! VULNERABILITY SUMMARY --------------------- A confirmed security vulnerability has been identified with 30 high traffic web sites owned by QuinStreet. Vendor stores database IDs in cookies which are easily spoofed USERIDCOOKIE, allowing...
rubygem-rack: Timing attack in cookie sessions
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that doe...
[Weevely] PHP Stealth Tiny Web Shell
Weevely is a stealth PHP web shell that provides a telnet-like console. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones. Weevely is currently included in Backtrack and Backbox...
Browsers Standing Up For User Privacy
Mozilla chief privacy officer Alex Fowler relayed a vivid anecdote last week during RSA Conference 2013 that illustrates the lengths third parties such as advertisers, data brokers and others who traffic in users’ online behavior will go to track you once you land on a website. Fowler said that i...
WSS可以成功使用xss攻击后台
简要描述： 提交建议处xss，直接拿到管理员cookies 详细说明： 上次没有打入后台，这次补上 漏洞证明：...
Fedora Update for curl FEDORA-2013-2098
Check for the Version of curl OpenVAS Vulnerability Test Fedora Update for curl FEDORA-2013-2098 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...
CPOs Challenged with Meeting Privacy Expectations and Maintaining Full User Experience
SAN FRANCISCO – People who interact with online services have mounting privacy expectations that run in parallel with their need for a full experience with the functionality central to those services. But can users have their privacy cake and eat it too? That’s the challenging question facing...
TeamSHATTER Security Advisory: Oracle EM Cross Site Scripting in XDBResource cancelURL parameter (CVE-2013-0352)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TeamSHATTER Security Advisory Oracle Enterprise Manager Cross Site Scripting in XDBResource cancelURL parameter February 20, 2013 Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 10.2.0.3, 10.2.0.4; 10.2.0.5, 11.1.0.7,...
Google Play privacy issue, sends app buyers personal details to developers
Google is again under attack for its apparent mishandling of its users' personal information. An Australian software developer 'Dan Nolan' revealed that the search giant was sending him the full names, email and post codes of everyone who purchased his app on Google's Play. In a blog post, Nolan...
Google Play privacy issue, sends app buyers personal details to developers
Google is again under attack for its apparent mishandling of its users’ personal information. An Australian software developer 'Dan Nolan' revealed that the search giant was sending him the full names, email and post codes of everyone who purchased his app on Google's Play. In a blog post, Nolan...
IP.Gallery 4.2.x and 5.0.x Persistent XSS Vulnerability
Exploit for php platform in category web applications Exploit Title: IP.Gallery 4.2.x and 5.0.x persistent XSS vulnerability image title is vulnerable to persistent XSS vulnerability which allow any normal member to hack any administrator account or any other member account. we contacted the vend...
DEBIAN-CVE-2013-0263
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that doe...
D-Link hedwig.cgi Buffer Overflow in Cookie Header
This module exploits an anonymous remote code execution vulnerability on several D-Link routers. The vulnerability exists in the handling of HTTP queries to the hedwig.cgi with long value cookies. This module has been tested successfully on D-Link DIR300v2.14, DIR600 and the DIR645A1FW103B11...
SiteGo Local File Inclusion / Cross Site Scripting Vulnerabilities
SiteGo suffers from cross site scripting and local file inclusion vulnerabilities. Exploit Title: SiteGo Multiple Vulnerabilities Date: 02/07/2013 Author: L0n3ly-H34rT Contact: email protected My Site: http://se3c.blogspot.com/ Vendor Link: http://site-go.com/ Software Link:...
Yahoo Mail Breach Linked to Old WordPress Vulnerability
Researchers at Australia-based BitDefender say they’ve found how some Yahoo Mail accounts are being hijacked, and it leads back to “buggy” blog software Yahoo’s developers used. For about a month Yahoo Mail account holders have been falling for a scam in which they click on a short link that...
CentOS Update for luci CESA-2013:0128 centos5
Check for the Version of luci OpenVAS Vulnerability Test CentOS Update for luci CESA-2013:0128 centos5 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...