SA-CONTRIB-2013-094 - EU Cookie Compliance - Cross Site Scripting (XSS)

This module enables you to display notifications so that visitors can give their consent to setting cookies by your website. The module doesn't sufficiently fiter and validate configuration values entered by administrators. This vulnerability is mitigated by the fact that an attacker must have a...

LinkedIn Intro Data Can Be Spoofed, Leads to Phishing

LinkedIn stood up for its new Intro app for iOS by providing some high-level transparency into how it handles communication between devices and its network, and took time to call initial criticism of the app inaccurate and speculative. In the meantime, one security researcher posted details onlin...

SA-CONTRIB-2013-081 - Spaces - Access bypass

This module enables you to make configuration options generally available only at the sitewide level to be configurable and overridden by individual "spaces" on a Drupal site. The spaces submodule, Spaces OG, doesn't properly handle deleting of organic group group spaces when the option to move t...

Tor Anonymizing network overload caused by Mevade Botnet

Recently, Tor Project Director - Roger Dingledine described a sudden increase in Tor users on the Tor Network after the events related to disclosure of the PRISM surveillance program, Since August 19, 2013, there has been an impressive growth in the number of Tor users. At first, No one knew who ...

Tor Anonymizing network overload caused by Mevade Botnet

Recently, Tor Project Director - Roger Dingledine described a sudden increase in Tor users on the Tor Network after the events related to disclosure of the PRISM surveillance program, Since August 19, 2013, there has been an impressive growth in the number of Tor users. At first, No one knew who ...

SA-CORE-2012-004 - Drupal core - Multiple vulnerabilities

Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7. Access bypass User module search - Drupal 6 and 7 A vulnerability was identified that allows blocked users to appear in user search results, even when the search results are viewed by unprivileged users. This...

Team Ghostshell Allegedly Dumps 1.6 M Aerospace, Nanotechnology Records

Hacktivist collective Team Ghostshell is claiming this morning to have spilled 1.6 million accounts from a handful of companies in the aerospace, nanotechnology, banking, law, education and government realm, a hack the group deems Project White Fox. The group claims White Fox is its “final stand”...

SA-CONTRIB-2012-171 - Webmail Plus - SQL injection - (unsupported)

The Webmail plus module is a full-featured email client for Drupal. It's designed to provide email for any or all members of a Drupal site. The module doesn't sufficiently sanitize user input as it is used in a database query. CVE: CVE-2012-5590 Versions affected All Webmail Plus module versions...

Final Report on DigiNotar Hack Shows Total Compromise of CA Servers

The attacker who penetrated the Dutch CA DigiNotar last year had complete control of all eight of the company’s certificate-issuing servers during the operation and he may also have issued some rogue certificates that have not yet been identified. The final report from a security company...

SA-CONTRIB-2012-119 - Excluded Users - Cross Site Scripting (XSS)

Excluded Users is a helper module which allows administrators to select users to not appear in user listings. The module displays a list of user names and email addresses without sanitizing them. In the event that someone manages to insert malicious code into a user name or email address, this...

LulzSec Affiliate, Ryan Cleary, Indicted in U.S.

Ryan Cleary, the 20 year-old Essex, England hacker associated with the hacker collective LulzSec, was indicted by a federal grand jury in the United States on Tuesday. According to an FBI press release, the grand jury indicted Cleary with one count of conspiracy and two counts of the unauthorized...

SA-CONTRIB-2012-066 - Spaces and Spaces OG - Access Bypass

CVE: CVE-2012-2303 Spaces is an API module intended to make configuration options generally avaliable only at the sitewide level to be configurable and overridden by individual "spaces" on a Drupal site. The spaces and spacesog modules part of the spaces package in some cases do not apply the...

Anonymous Takedown several Vatican Websites

Anonymous Takedown several Vatican Websites The Italian Anonymous Hackers took down the Vatican's website Vatican.va on Wednesday in retaliation for the "corruption" of the Roman Catholic Church. On an Italian-language website Anonymous accused the Catholic Church of being responsible for various...

CSF Firewall Buffer Overflow

Exploit for linux platform in category dos / poc Exploit Title: CSF Firewall Buffer overflow p0c DownLoaD : http://www.configserver.com/free/csf.tgz Date: 2011-12-09 Author: FoX HaCkEr site : www.sec4ever.com MaiL : email protected Tested on: CentOS3/4...

CSF Firewall - Buffer Overflow (PoC)

/ Exploit Title: CSF Firewall Buffer overflow p0c DownLoaD : http://www.configserver.com/free/csf.tgz Date: 2011-12-09 Author: FoX HaCkEr site : www.sec4ever.com MaiL : [email protected] Tested on: CentOS3/4 ============================================================================== FiLe : CSF.c...

CSF Firewall - Buffer Overflow (PoC)

CSF Firewall - Buffer Overflow PoC / Exploit Title: CSF Firewall Buffer overflow p0c DownLoaD : http://www.configserver.com/free/csf.tgz Date: 2011-12-09 Author: FoX HaCkEr site : www.sec4ever.com MaiL : [email protected] Tested on: CentOS3/4...

CVE-2011-3705

Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files...

Information disclosure

Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files...

CVE-2011-3705

Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files...

CVE-2011-3705

CVE-2011-3705 affects Arctic Fox CMS 0.9.4. Affected component is PHP files (notably acp/includes/edit.inc.php and similar) where a direct request to a PHP file can cause an error message that reveals the installation path, enabling information disclosure. The abuse is a remote attack that does n...