PHPCMS Arbitrary Code Execution Vulnerability

PHPCMS is an open source content management system. An arbitrary code execution vulnerability exists in the front-end of PHPCMS, which allows attackers to exploit this vulnerability to execute arbitrary code...

Live Forms <= 1.2.0 - Unauthenticated Stored Cross-Site Scripting (XSS)

Form input fields on the blog front end are not properly sanitised. The unsanitised user input will be displayed in "WordPress Admin Form entries". Screenshots: http://imgur.com/Oflsb3n http://imgur.com/jHaZR5O...

Microsoft Windows 2003 Approaching End Of Life (deprecated)

This plugin has been deprecated as Windows 2003 is now end-of-life EOL. %NASLMINLEVEL 999999 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2016/02/11. include"compat.inc"; if description scriptid80120; scriptversion"1.3"; scriptcvsdate"Date: 2018/07/20 0:18:55";...

Google Releases Chrome Extension for End-To-End Email Encryption

Back in june this year, Google announced an alpha Google Chrome extension called "End-to-End" for sending and receiving emails securely, in wake of former NSA contractor Edward Snowden’s revelations about the global surveillance conducted by the government law-enforcements. Finally, the company h...

Google Releases End-To-End Chrome Extension to Open Source

Google yesterday announced that it has released the source code for its End-to-End extension for Chrome to open source via GitHub. End-to-End enables Gmail users to encrypt, sign and verify email messages within the Chrome browser, using OpenPGP. “We’ve always believed strongly that End-To-End mu...

[SECURITY] Fedora 19 Update: pkcs11-helper-1.11-3.fc19

pkcs11-helper is a library that simplifies the interaction with PKCS11 providers for end-user applications using a simple API and optional OpenSSL engine. The library allows using multiple PKCS11 providers at the same tim e, enumerating available token certificates, or selecting a certificate...

CmsEasy最新版5.5 存储型XSS导致GetShell

简要描述： n处XSS，我不信都插完打不到cookie，get不了shell -.- 详细说明： 第一处（只代码审计第一处，后面几处类似。都是没有过滤）： function loginfalse cookie::set'loginfalse',int cookie::get'loginfalse'+1,time+3600; event::log'loginfalse','失败 user='.front::post'username'; front::flashlang'登陆失败！'."".lang'backuppage'."";...

HackerOne: Breaking Bugs as team member

It is possible to break a bug page front-end as a team member. This is how it's done: 1. Go to a bug. 2. Select "Change State" - "Triaged". 3. Enter a random comment. 4. Intercept the POST request, change "message" to "message". The status change will be saved but the message will be null and not...

ECStore开源网店系统任意文件读取漏洞

简要描述： 后台模板编辑功能可越权查看系统文件 详细说明： file参数对../未做过滤，导致可以跨目录读取文件 测试url：http://shop.xxx.com/index.php/shopadmin/index.php?app=site&ctl=adminthemewidget&act=preview&theme=ecstore&file=../../../../../etc/passwd 漏洞证明：...

Crash Your Friends' WhatsApp Remotely with Just a Message

A Vulnerability has been discovered in the wildly popular messaging app WhatsApp, which allows anyone to remotely crash WhatsApp just by sending a specially crafted message, two security researchers reported ‘The Hacker News’. Two India based independent security researchers, Indrajeet Bhuyan and...

FreeBSD : yii -- Remote arbitrary PHP code execution (5a35bc56-7027-11e4-a4a3-001999f8d30b)

Yii PHP Framework developers report : We are releasing Yii 1.1.15 to fix a security issue found in 1.1.14. We urge all 1.1.14 users to upgrade their Yii to this latest release. Note that the issue only affects 1.1.14. All previous releases are not affected. Upgrading to this release from 1.1.14 i...

WhatsApp Messenger Adds End-to-End Encryption by Default

Good news for all Privacy Lovers!! Finally the wildly popular messaging app WhatsApp has made end-to-end encryption a default feature, stepping a way forward for the online privacy of its users around the world. WhatsApp, most popular messaging app with 600 Million users as of October 2014, has...

WhatsApp Adds Encryption by Default to Android App

WhatsApp, a massively popular messaging app, recently added end-to-end encryption for some mobile clients, a move that brings a high level of security to millions of users. The change is the result of a partnership with Open Whisper Systems, the secure text and mobile OS company started by securi...

[SECURITY] Fedora 20 Update: Pound-2.6-8.fc20

The Pound program is a reverse proxy, load balancer and HTTPS front-end for Web servers. Pound was developed to enable distributing the load among several Web-servers and to allow for a convenient SSL wrapper for those Web servers that do not offer it natively. Pound is distributed under the GPL ...

Researcher Found TextSecure Messenger App Vulnerable to Unknown Key-Share Attack

Do you use TextSecure Private Messenger for your private conversations? If yes, then Are you sure you are actually using a Secure messaging app? TextSecure, an Android app developed by Open WhisperSystems, is completely open-source and claims to support end-to-end encryption of text messages. The...

[SECURITY] Fedora 21 Update: python-django-horizon-2014.1.3-1.fc21

Horizon is a Django application for providing Openstack UI components. It allows performing site administrator viewing account resource usage, configuring users, accounts, quotas, flavors, etc. and end user operations start/stop/delete instances, create/restore snapshots, view instance VNC consol...

Facebook Now Accessible Via Tor Anonymous Network Using .Onion Address

If you are fan of the largest social networking site Facebook, but also want to remain anonymous while using your Facebook account, then there is really a Good news for you. Facebook on Friday began offering a way for security and Privacy conscious users to connect to its social networking servic...

Tor 0.2.5.10 - Anonymity Online (Tor 0.2.3.x is deprecated!)

Tor 0.2.5.10 is the first stable release in the 0.2.5 series. It adds several new security features, including improved denial-of-service resistance for relays, new compiler hardening options, and a system-call sandbox for hardened installations on Linux requires seccomp2. The controller protocol...

Oracle Identity Manager (October 2014 CPU

The remote host is missing the October 2014 Critical Patch Update for Oracle Identity Manager. It is, therefore, affected by multiple vulnerabilities : - The application is affected by a vulnerability in Apache Commons BeanUtils in which ClassLoader objects can be set via the class attribute of a...

CVE-2014-6557

Unspecified vulnerability in the Application Performance Management component in Oracle Enterprise Manager Grid Control before 12.1.0.6.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to End User Experience Management...