Researchers Find Methods to Kill Persistent 'Evercookie'

The persistent method that security researcher Samy Kamkar introduced last week for storing tracking data on a user’s machine, known as the “Evercookie,” is even more worrisome when used on mobile devices, according to another researcher’s analysis. The Evercookie is a simple method for forcing a...

PHP Hosting Directory 2.0 background verification bypass vulnerability and fix-vulnerability warning-the black bar safety net

PHP Hosting Directory 2.0 program background verification is not strictly, can lead to bypass the password verification sign in the background. Google: "powered by PHP Hosting Directory 2.0" Default background:http://127.0.0.1/admin Use method: Do not need to enter any password, through cookies...

PHP Hosting Directory 2.0 background verification bypass vulnerability-vulnerability warning-the black bar safety net

PHP Hosting Directory 2.0 program background verification is not strictly, can lead to bypass the password verification sign in the background. Google: "powered by PHP Hosting Directory 2.0" Default background:http://127.0.0.1/admin Use method: Do not need to enter any password, through cookies...

XSS vulnerability in Office Connector

We have identified and fixed a cross-site scripting XSS vulnerability in the Confluence Office Connector. An attacker might take advantage of the vulnerability to steal other users' session cookies or other credentials, by sending the credentials back to such an attacker's own web server. An...

XSS vulnerability in Office Connector

We have identified and fixed a cross-site scripting XSS vulnerability in the Confluence Office Connector. An attacker might take advantage of the vulnerability to steal other users' session cookies or other credentials, by sending the credentials back to such an attacker's own web server. An...

Cag CMS 0.2 - Cross-Site Scripting / Blind SQL Injection

----------------------------------------------------------------------------------------- Cag CMS Version 0.2 Beta = XSS && Blind SQL Injection Multiple Vulnerabilities ----------------------------------------------------------------------------------------- Author : Shamus Date : October, 05th...

phpmyfaq -- cross site scripting vulnerabilities

The phpMyFAQ project reports: The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 2.6.x: phpMyFAQ doesn't sanitize some variables in different pages correctly. With a properly crafted URL it is e.g. possible to inject JavaScript code into the output of a page,...

BlackBerry Cross Origin Bypass

0000000000000000000000000000000000 000000000000000000000 00000000000000000000000000000000000 0000000000000000 00000000000000000000000000000000 + BlackBerry Browser Cross Origin Bypass + Author : 599eme Man + Contact : [email protected]...

Researcher Claims 'Evercookie' Can't Be Removed

Call it “Frankencookie:” a security researcher has released a tracking cookie that he claims is nearly impossible to remove. Dubbed “evercookie,” it is designed to raise awareness about the ease with which Web site operators can evade privacy tools designed to eliminate shield visitors’ privacy...

Buffer overflow

Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services IIS, provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State aka VIEWSTATE for...

CVE-2010-3332

Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services IIS, provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State aka VIEWSTATE for...

Persistent XSS Bug on Twitter Exploited by Worm

UPDATE— Within an hour of reports surfacing about a cross-site scripting bug on the Twitter home page, a worm exploiting the bug was released on the site. However, engineers at Twitter have repaired the bug and say that it no longer should be exploitable. The bug appeared Tuesday morning and...

odCMS Cookies handling vulnerabilities

Exploit for php platform in category web applications ====================================== odCMS Cookies handling vulnerabilities ====================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/...

E-Xoopport - Samsara 3.1 Blind SQL Injection

!/usr/bin/perl 0-Day E-Xoopport - Samsara \r\n"; exit; $host = $ARGV0; $usr = $ARGV1; $pwd = $ARGV2; $anickde = $ARGV3; $anick = '0x'.EncHex$anickde; print "+ Logging In...\r\n"; my %postdata = uname = "$usr", pass = "$pwd" ; $ua = LWP::UserAgent-new; $ua-agent"Mozilla 5.0"; my $req = POST $host,...

Proventia Network Mail Security System CRLF Injection

Security Advisory: MVSA-10-009 / CVE-2010-0155 Vendor: IBM Products: Proventia Network Mail Security System Vulnerabilities: CRLF Injection Risk: Medium Attack Vector: From Remote Authentication: Required Reference: http://www.ventuneac.net/security-advisories/MVSA-10-009 Description Web-based...

Web Application Session Cookies Not Marked Secure

The remote web application uses cookies to track authenticated users. However, there are instances where the application is running over unencrypted HTTP or the cookies are not marked 'secure', meaning the browser could send them back over an unencrypted link under certain circumstances. As a...

Attackers Target Twitter XSS Bug

A dangerous XSS bug surfaced on Twitter on Monday, and researchers have seen active exploits for the bug, which allows an attacker to steal the session cookie of a Twitter user with a simple click-and-you’re-owned technique. Experts say that the attacks seem to be emanating from domains in Brazil...

VPSProxy (PHP Secure proxy + GUI)

PHP Secure proxy - программа для туннелирования HTTP/HTTPS трафика через PHP-гейт. На написание меня подтолкнула идея bons'a, в реализации которого не было необходимого мне функционала, и самое главное, GUI. Возможности + Поддержка HTTPS для php-гейтов. + Туннелирование HTTPS трафика добавлено в...

mBlogger 1.0.04 - addcomment.php Persistent Cross-Site Scripting

mBlogger 1.0.04 - addcomment.php Persistent Cross-Site Scripting !/usr/bin/python Exploit Title: mBlogger v1.0.04 addcomment.php Persistent XSS Exploit Date : 04 September 2010 Author : Ptrace Security Gianni Gnesa gnix Contact : researchatptrace-securitydotcom Software Link:...

CVE-2010-1507

WebYaST in yast2-webclient in SUSE Linux Enterprise SLE 11 on the WebYaST appliance uses a fixed secret key that is embedded in the appliance's image, which allows remote attackers to spoof session cookies by leveraging knowledge of this key...