Hackers use PDF generator to steal the WEB files on the server-the vulnerabilities and early warning-the black bar safety net

TCPDF PDF generator is the most popular today for creating a PDF document the PHP library one of today's most popular open source projects. It every day with millions of user usage, the carrier generally is a CMS program or other WEB application. However, the hacker using TCPDF's a loophole that...

某高校在用系统sql注入（打包）（DBA）（无需登录）2

简要描述： 1 详细说明： 案例较多，给CNCERT 漏洞证明： Apabi论文授权提交系统 版权所有© 北京方正阿帕比技术有限公司 谷歌搜索：论文授权提交系统 北京大学复旦大学什么的都在其中 漏洞文件doquery.asp 漏洞参数：txtStuName,txtStuNo,cboCollege,cboSubjectClass,txtMajor,inputStartDate,inputEndDate 随便来几个案例 210.44.126.14/tasi/admin/query/doquery.asp --data...

Google Apps 'Defect' Leaks Private WHOIS Data Of 280,000

Google has notified hundreds of thousands of domain registrants that their private WHOIS information has been exposed in the clear, opening them up to identity theft, phishing scams and more. Researchers from Cisco Talos last night said the problem likely lies with one of Google’s registrar...

通达T9系统sql注射10处打包(demo站点root权限)

简要描述： T9智能管理平台是基于B/S架构，灵活、稳定、安全、高性能的办公系统。采用自主研发的引擎技术，提供强大的工作流和公文流程管理功能，可完全根据客户需求定制办公门户平台。 详细说明： 测试地址 http://t9.go2oa.com/t9/core/frame/webos/index.jsp 测试帐号及密码 oa/无 注入1: http://t9.go2oa.com/t9/t9/core/funcs/email/act/T9EmailBoxAct/isBoxNameExist.act? post: boxName=test' and select 1 from select...

Samsung Patches Social Media Vulnerability in Millions of Devices

Samsung patched a vulnerability last month in SNS Provider, a popular application that manages other social media apps present in millions of its devices. If exploited the bug could have given attackers the ability to access to any personal information users stored on Facebook, LinkedIn and...

Mandarin Oriental Confirms Data Breach at U.S., European Hotels

The Mandarin Oriental luxury hotel chain is investigating a data breach that affects credit cards used in an “isolated number” of its hotels in the United States and Europe. Company officials said that the attack involved “undetectable” malware on some of its systems and emphasized that only cred...

TalkTalk Admits Customer Data Breach, warns of Scam Calls

TalkTalk, one of the biggest UK-based phone, TV and Internet service provider with 4 million customers, has admitted it suffered a major Data Breach. TalkTalk said customer information was accessed after a breach at a third-party company, in which names, addresses, phone numbers and TalkTalk...

Anthem Hack May Implicate 18 Million Non-Customers

In addition to roughly 80 million Anthem customers, nearly 20 million more individuals who aren’t customers of the health insurer could ultimately wind up implicated in this month’s massive data breach. The company disclosed yesterday that between 8.8 million and 18.8 million Blue Cross Blue Shie...

Zeuscart has multiple vulnerabilities

Zeuscart is a very stable, interface-rich, open source shopping system. Zeuscart has multiple vulnerabilities due to the program failing to properly filter user-supplied input. An attacker can exploit this vulnerability to steal cookie-based authentication credentials, compromise the application,...

WordPress Sites Vulnerable to Plugin-Related SQL Attacks

More than one million WordPress sites may be vulnerable to a critical plugin issue that could open sites up to SQL injection attacks and in turn, total takeover. The problem stems from a weak key vulnerability in WP-Slimstat, a web analytics plugin for the content management system that’s been...

WordPress Analytics Plugin Leaves 1.3 Million Sites Vulnerable to Hackers

A critical vulnerability has been discovered in one of the most popular plugins of the the WordPress content management platform that puts more than one Million websites at risks of being completely hijacked by the attackers. The vulnerability actually resides in most versions of a WordPress plug...

Lenovo Shipping PCs with Pre-Installed 'Superfish Malware' that Kills HTTPS

One of the most popular computer manufacturers Lenovo is being criticized for selling laptops pre-installed with invasive marketing software, or malware that, experts say, opens up a door for hackers and cyber crooks. The software, dubbed ‘Superfish Malware’, analyzes users’ Internet habits and...

NSA Planted Stuxnet-Type Malware Deep Within Hard Drive Firmware

The U.S. National Security Agency NSA may be hiding highly-sophisticated hacking payloads in the firmware of consumer hard drives over the last 15 to 20 years in a campaign, giving the agency the means to eavesdrop on thousands of targets’ computers, according to an analysis by Kaspersky labs and...

Massive, Decades-Long Cyberespionage Framework Uncovered

CANCUN–Researchers at Kaspersky Lab have uncovered a cyberespionage group that has been operating for at least 15 years and has worked with and supported the attackers behind Stuxnet, Flame and other highly sophisticated operations. The attackers, known as the Equation Group, used two of the zero...

53KF某处注入点

简要描述： 注入 详细说明： 注入点： http://www28.53kf.com/companyintro.php?arg=babyeyecom&styleid=103594706&language=cn 其中styleid参数存在注入 漏洞证明： 150多个表...

Researcher Publishes 10 Million Usernames and Passwords from Data Breaches

A security researcher has publicly released a set of 10 Million usernames and passwords, which he collected from multiple data breaches over the last decade for the purpose of his research. These 10 million usernames and passwords are collective of leaked database dumps those were already availab...

Anthem Data Breach — 6 Things You Need To Know

The Nation’s second largest Health insurer company, Anthem, alerted its customers on Wednesday that hackers had stolen the personal information of over 80 Millions of its customers, making it the largest data breach and double the number of payment cards affected by Target data breach occurred in...

Dennis Fisher and Mike Mimoso Discuss the Anthem Breach, Flash Zero Days and More

Dennis Fisher and Mike Mimoso discuss the Anthem data breach, the continuing Flash 0-day happy fun times, the expansion of exploit kits and the crowd funding support for GnuPG. Music by Chris Gonsalves Download: digitalunderground183.mp3...

Anthem Data Breach - A Message from Coalfire's Healthcare Practice Director

Several weeks ago I had the opportunity to speak on a panel at a healthcare conference. In attendance were CIOs, CISOs, VPs of IT, and members of legal counsel. The individuals attending the session represented organizations ranging from small- to medium-sized business associates all the way up t...

Anthem Data Breach Could Affect Millions of Consumers

Attackers have compromised Anthem Inc., one of the larger health-care companies in the United States, gaining access to the Social Security numbers, birth dates, names, employment and income data and other personal information of an untold number of customers. The company says it is not sure yet...