CVE-2010-2913

The CVE-2010-2913 entry concerns the Citi Mobile iOS app prior to version 2.0.3, where account data is stored in a local file. This creates a risk that local users can access sensitive information via (1) the mobile device itself or (2) a computer synchronized with the device. The available docum...

Новый метод атаки через Reverse-IP

Новый метод атаки через reverse-ip Хоть статья и 2009 года, но до сих пор актуальна. 0. INTRO Вобщем не буду делать большое вступление. Недавно имело место хекать сайт. Шел был успешно залит на соседний, но вот беда на сервере грамотно выставленны права. Пришлось включать голову и думать. И в...

Rich Mogull on Database Security and Encryption

Dennis Fisher talks with analyst Rich Mogull of Securosis about his new report on database encryption, the value and danger of storing credit-card data and why more companies don’t get rid of sensitive data more quickly. Podcast audio courtesy of sykboy65 Subscribe to the Digital Underground...

Plug horse code is space-separated solutions-vulnerability warning-the black bar safety net

Some time ago, the new cloud management system, dynamic network Forum get a WEBSHELL and this, today, we discuss this aspect of things, in fact, ASP database plug horse also is not what fresh stuff, believe you played this. Oh, and that you have not met insert the asp code is spaces apart case?...

iShowMusic V1. 2 Write a shell vulnerability-vulnerability warning-the black bar safety net

A few days before the announcement of the vulnerability, these days quite busy, today only see. Just some time ago using this program to do a music station, in the own Station test is successful, by the way also fill the lower holes. -------- Vulnerability description: iShow Music is a basic set...

Thecus NAS Device Detection

According to its web server, the remote host is a Thecus NAS Network- Attached Storage device, which provides file-based data storage to hosts across a network. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid35820; scriptversion"1.12"; scriptnameenglish:"Thecus NAS...

Opera Web Browser 9.62 - History Search Input Validation

Opera Web Browser 9.62 - History Search Input Validation source: https://www.securityfocus.com/bid/32015/info Opera Web Browser is prone to an input-validation vulnerability because of the way it stores data used for the History Search feature. Attacker-supplied HTML and script code would run in...

Mac OS X Mail.App insecure data storage

Encrypted messages are stored in cleartext...

iShowMusic V1.2 写入shell漏洞

iShow Music 是一套基本于PHP+TXT的在线音乐播放程序。程序采用文本数据存储方式，无需MYSQL数据库支持，同时程序代码与界面模板分离，方便你的音乐网站界面修改。 在error.php 12-26行 elseif $POST'action'=="save" $cknumon && GdConfirm$gdcode; ifempty$id Showmsg"no","你还未选择歌曲呢!","返回重新填写","javascript:history.back-1"; exit; elseifempty$POST'user'...

Talking about the Web App secondary vulnerability-vulnerability warning-the black bar safety net

On the assumption that design does not exist on the problems that people solve an application problem does not exist, and the use of language, and other peripheral component is a secure case, the program of the vulnerability on most of is due to in the implementation process, the programmer for t...

Cacti 0.8.7a Multiple Vulnerabilities

Cacti 0.8.7a Multiple Vulnerabilities Name Multiple Vulnerabilities in Cacti Systems Affected Cacti 0.8.7a and possibly earlier versions Severity High Impact CVSSv2 High 9/10, vector: AV:N/AC:L/Au:N/C:C/I:P/A:P Vendor http://www.cacti.net/ Advisory...

LightBlog Remote File Upload Vulnerability

LightBlog 9.5 - REMOTE FILE UPLOAD VULNERABILITY by Omni 1 Infos --------- Date : 2008-01-30 Product : LightBlog Version : v 9.5 Vendor : http://www.publicwarehouse.co.uk/ Vendor Status : 2008-01-31 Informed! 2008-01-31 Patch received from vendor! 2008-02-01 Published! Description : Lightblog...

[email protected]

PHPBlogger is a simple tool to help the creation of web blogs... Encrypted admin password and other preferences are stored on /data/pref.db You can find lots of them exposed with google search: pref password= filetype:db = -------------------------------------------- The admin panel is acessible...

Hackers newbies tutorial of the well known Cookies to the file spoofing-vulnerability warning-the black bar safety net

First, a few basic concepts Cookies deception, is in only for the user to do the Cookies the authentication of the system, by modifying Cookies of the content to obtain the appropriate user permissions to log on. So what is Cookies?, I'm here to give you a professional explanation, Cookies are...

CVE-2007-0413

CVE-2007-0413 - MODE C BEA WebLogic Server versions 8.1 through 8.1 SP5 store cleartext data in a backup of config.xml after offline editing. This allows local users to obtain sensitive information by reading the backup file. The vulnerability is due to storing sensitive configuration data in an ...

Backup implementation

Backup implementation I. Intro II. Tools III. Strategy Well, now let's talk about how to live with all this correctly. The backup process consists of three stages: planning, implementation and support. We have already talked a little about support and implementation, but planning is the most...

Computer Associates多个CleverPath Portal环境会话劫持漏洞

CleverPath Portal环境一般配置在多个Portal服务器共享一个通用数据存储时存在安全问题。这可导致通过其中一个Portal服务器连接的用户可继承Portal会话，关联另一个Portal服务器中的某个用户的安全验证。 当多个Portal服务器共享通用数据存储并两个Portal服务器在同一时间里启动，由于CleverPath Portal环境变量数据存在问题，可导致以其他用户权限访问服务程序。CleverPath Portal环境变量不是默认配置。 Computer Associates Unicenter Workload Control Center 1.0 SP4...

Pretty Guestbook v1

Homepage: http://www.tuttophp.altervista.org/main.php Description: Text-based guestbook with the following features: - Data storing on text file - Paging of messages on screen - Blockage of messages with words too long into - Blockage of messages with both html tags - Validity-checking of email...

Morris Guestbook v1

Homepage: http://www.tuttophp.altervista.org/morrisguest-ing.htm Description: Morris Guestbook is a text-based guestbook with the following features: Data storing on text file, paging of messages on screen, words crypting, counting of inserted messages, blockage of messages with both html tags...

ASP database plug horse small conference-vulnerability warning-the black bar safety net

With the development of technology, ASP database plug horse also is not what fresh stuff, believe you played this. Oh, and that you have not met insert the asp code is spaces apart case? i.e. insertion of each of the characters between the There are spaces for? Now, let us to solve this problem...