After data breach, Visa removes Heartland from PCI list

Credit card giant Visa has taken Heartland Payment Systems and RBS WorldPay off its list of service providers that are compliant with the PCI Data Security Standard. In a statement released Friday, Visa said it was removing the payment processors based on “compromise event findings.” RBS WorldPay...

Comcast passwords left unprotected online

User names and passwords belonging to more than 8,000 Comcast Internet customers were left exposed on the Web for at least two months. A post by Brad Stone on the Bits blog NYTimes.com details the situation, which was exposed by a Comcast customer from Pennsylvania. Kevin Andreyo, an educational...

Employee stole data from Sprint

Sprint has sent letters to thousands of its customers informing them that a former employee compromised their personal account data over the course of two months in 2008 and 2009. Brian Krebs Security Fix says that the company mailed warnings to several thousand customers and that the breach coul...

CS-Cart 2.0.0 Beta 3 - 'Product_ID' SQL Injection

CS-Cart 2.0.0 Beta 3 dispatch SQL Injection Vulnerability Provider: www.cs-cart.com Discovered by netsoul Greetz: m1cr0n, IvanKalet, blackfalcon, str0ke Contact: netsoul2atgmail.com ALTO PARANA - PARAGUAY Ñane mba'e teete Exploit: http://cs-cart...

Will the real [Breach X] please stand up?

Do you remember that classic game show “To Tell the Truth?” It was great and trying to figure out who was the “real” person was always a challenge. Unfortunately Visa and MasterCard are making all of us play the same game of late. There have been recent rumors running rampant alliteration anyone?...

i-dreams GB 5.4 Final Info Disclosure

--------------------------------------------------------- Portal Name: i-dreams GB Version : 5.4 Final Author : PouyaServer , [email protected] Website: http://Pouya-Server.ir --------------------------------------------------------- Xpl: http://site.com/firebook/data/admdat/admin.dat...

Information disclosure

SepCity Classified Ads stores the admin password in cleartext in data/classifieds.mdb, which allows context-dependent attackers to obtain sensitive information...

CVE-2008-6157

SepCity Classified Ads stores the admin password in cleartext in data/classifieds.mdb, enabling context-dependent attackers to obtain sensitive information. The issue is documented across several sources (NVD, CVE records, PT-2009-1632) with no concrete vendor/version details provided and no expl...

CVE-2008-5898

CVE-2008-5898 concerns the CodeAvalanche Directory, where insufficient access control allows remote attackers to download the database file containing the administrator password through a direct request to _private/CADirectory.mdb. The NVD entry notes an exposed, sensitive database under the web ...

sdms-sql.txt

SDMS Simple Document Management System v1.1.4 SQL Injection Author: Yuri Program: SDMS Simple Document Management System Version: v1.1.4 and probably all older versions as well Website: http://sdms.cafuego.net/ How it works The login system is very insecure, this is the code we are going to abuse...

动漫广告吧管理系统v1.0漏洞

1.存在SQL注入漏洞 2.所有添加图片的功能页面都没有限制任何恶意后缀文件 3.暴库 ver 1.0 我们建议使用此软件的用户随时关注厂商的主页以获取最新版本...

CVE-2008-4512

The CVE-2008-4512 entry concerns an ASP/MS Access Shoutbox (likely v1.1 beta) that stores the database file db/shoutdb.mdb under the web root with insufficient access control. This misconfiguration allows remote attackers to retrieve sensitive information via a direct request. The underlying root...

Ftbbs 6. X injection 0day exp-vulnerability warning-the black bar safety net

Article author: the cloud EagleJ. L. S. T Information source: security leaves the technical groupJ. Leaves Security Team （http://www.00day.cn to See 1 0 The Big Brother of the message scared me, put something out, don't know a wooden man to, wood technology, only grasping the point of the broiler...

Pluck CMS 4.5.2 - Multiple Local File Inclusions

Digital Security Research Group DSecRG Advisory DSECRG-08-037 Application: Pluck CMS Versions Affected: 4.5.2 Vendor URL: http://www.pluck-cms.org/ Bug: Multiple Local File Include Exploits: YES Reported: 28.07.2008 Vendor Response: 03.08.2008 Solution: YES Date of Public Advisory: 25.08.2008...

CustomCMS 4.0 - 'print.php' SQL Injection

Author: !DoktOR! Date found: 21.08.08 Product: CCMS Gaming Portal Version: 4.0 The price: $55 URL: customcms.net Vulnerability Class: SQL injection print.php Vuln code: $q = mysqlquery"SELECT from ccmsnewscomments WHERE wid='$id'"; magicquotesgpc = Off http://localhost/installdir/ Exploit:...

GC Auction Platinum (cate_id) Remote SQL Injection Vulnerability

No description provided by source. || | | GC Auction Platinum cateid Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : www.tryag.cc/cc | | email: darkangelg85atYahooDoTcom | | | | | | | | script :...

ShopCartDx 4.30 - 'pid' SQL Injection

ShopcartDX Remote Sql Injection All Version By Cr@zyKing / sqL Lov3r'Z Crew Co. 2008 Downlod: http://webscripts.softpedia.com/script/E-Commerce/Shopping-Carts/ShopcartDX-1-1421.html Sql : http://localhost/patch/productdetail.php?cid=9&pid=-1 UNION SELECT...

[SECURITY] [DSA 1608-1] New mysql-dfsg-5.0 packages fix authorization bypass

------------------------------------------------------------------------ Debian Security Advisory DSA-1608-1 [email protected] http://www.debian.org/security/ Devin Carraway July 13, 2008 http://www.debian.org/security/faq -...

ezContents CMS Version 2.0.0 SQL Injection Vulnerabilities

...:::::ezContents CMS Version 2.0.0 SQL Injection Vulnerabilities ::::... Virangar Security Team www.virangar.net -------- Discoverd By :virangar security teamhadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members & all hackerz greetz:to my best friend in the worl...

Anserv Auction XL - 'cat' SQL Injection

\ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV92$2008 ----------------------------------------------------------------------------------------- ECHOADV92$2008 Anserv Auction XL viewfaqs.php cat Blind Sql Injection Vulnerability...