OpenXchange User Enumeration

Hi@all, there is an information disclosure in OpenXchange prior 7.8. An authenticated user can enumerate all imap user folders. If you browse the PoC you get an permission denied error, but the folder’s name is reflected into the page in json format. About Open Xchange: Open-Xchange2 develops,...

How to become an Information Security Expert with the CISSP Certification

If you dream of making it big in the IT security community, the CISSP certification is a necessary milestone. Having this certification to your credit portrays a sense of commitment to the security profession and shows potential employers that you have a strong knowledge base to excel in this...

Millions of IoT Devices Using Same Hard-Coded CRYPTO Keys

Millions of embedded devices, including home routers, modems, IP cameras, VoIP phones, are shareing the same hard-coded SSH Secure Shell cryptographic keys or HTTPS HTTP Secure server certificates that expose them to various types of malicious attacks. A new analysis by IT security consultancy SE...

Researcher warns about Security Loopholes in Denmark's Largest Bank

While accessing your Bank account online, Have you ever thought… ...there could be a Hacker, somewhere in the World, who is after your Money? Maybe NO. Because, you believe that your bank offers Secure banking solution, Right? At The Hacker News, we have reported many incidents of cyber attacks,...

Python for Security Professionals: Free IT Security Training

Python is an excellent programming language that has rapidly become popular among Hackers, Reverse engineers, software testers, Forensic analyst and Penetration testers. Python is a simple object-oriented and minimalistic language that is easy to learn for novice programmers as well as experience...

RSA Conference Chris Hoff Reuben Paul Keynote

SAN FRANCISCO – When it comes to the future development of secure software, there’s really only one “next generation” that matters. That’s why today when the covers were pulled back on a seven-foot-tall server rack wheeled out on stage during Chris Hoff’s RSA Conference keynote, those in the...

IT-Grundschutz M4.007: Änderung voreingestellter Passwörter

IT-Grundschutz M4.007: Änderung voreingestellter Passwörter. Stand: 14. Ergänzungslieferung 14. EL. Hinweis: Test wird nur über SSH und Telnet ausgeführt. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

CVE-2014-7866

CVE-2014-7866 is a set of remote directory traversal/file-upload vulnerabilities affecting ZOHO ManageEngine OpManager (build 88xx–11.4), IT360 (10.3–10.4), and Social IT Plus (11.0). Exploitation occurs via unauthorized file writes through MigrateLEEData (fileName=..../warfile.war) or MigrateCen...

CVE-2014-3997

The CVE-2014-3997 entry concerns SQL injection in the MetadataServlet.dat endpoint of ManageEngine Password Manager Pro (PMP) and PMP MSP, affecting PMP 5–7 build 7003 and IT360/IT360 MSP prior to 10.3.3 build 10330 (and related products). Public sources confirm vulnerable vectors via the sv para...

CVE-2014-6034

CVE-2014-6034 affects ManageEngine OpManager (versions 8.8–11.3) and related products (Social IT Plus 11.0, IT360 10.4 and earlier). A directory traversal in the FileCollector servlet, triggered by a ".." in the regionID parameter, allows remote attackers or remote authenticated users to write to...

IT Security Horror Story: Digging your own grave with Default Credentials

I recently performed a penetration test that really required no "hacking skills" whatsoever. I was able to obtain domain administrator rights simply by logging into web applications and network hardware using default credentials...

Thousands of High-Risk Vulnerabilities Found in NOAA Satellite System

The informational systems that the National Oceanic and Atmospheric Administration NOAA run are loaded with several critical vulnerabilities that could leave it vulnerable to cyber attacks. According to the findings of an audit recently conducted by the Department of Commerce’s Office of the...

UPS Admits 51 Stores Hit With Malware For Five Months

The list of corporations that have been victimized by credit card stealing malware in 2014 grew a little longer this week as UPS announced that 51 of its stores suffered a “broad-based malware intrusion” earlier this spring. The company disclosed the breach – which affected franchised locations o...

NOAA, Satellite Data, Riddled with Vulnerabilities

The informational systems that the National Oceanic and Atmospheric Administration NOAA run are fraught with vulnerabilities and what the U.S. Department of Commerce deems “significant security deficiencies” that could leave it vulnerable to cyber attacks. That’s according to the findings of an...

SIEM for One, SIEM for All

IT security is not a luxury; it’s a necessity. While IT practitioners understand this and are on the lookout for effective security options for their network, security solutions manufacturers tend to serve the enterprise market and large companies more than they do smaller organizations and...

DJ Studio Pro 8.1.3.2.1 - SEH Exploit

No description provided by source. DJ Studio Pro Version 8.1.3.2.1 SEH 0 day Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Download Vulnerable application from...

Quick Player 1.3 Unicode SEH Exploit

No description provided by source. Quick Player 1.3 Unicode SEH Exploit Author Abhishek Lyall and Puneet Jain [email protected] , abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Download Vulnerable...

MyBB (editpost.php, posthash) - SQL Injection Vulnerability

No description provided by source. MyBB 1.6.9 is vulnerable to Stored, Error based, SQL Injection. Vulnerable code: /editpost.php === Line 398 === $posthashquery = posthash='$posthash' OR ; === It can be done by using Tamper DataOr Live HTTP Headers, and when submitting a post, edit the 'posthash...

Audiotran 1.4.2.4 SEH Overflow Exploit

No description provided by source. Audiotran 1.4.2.4 SEH Overflow Exploit 0 day Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Download Vulnerable application from...

DDoS Attacks a Cover for Financial Fraud, IP Theft

It’s difficult to imagine a noisier attack than a distributed denial-of-service attack. They’re an ever-present threat to banks and other businesses where the uptime of Web-based services is critical to customers and the well-being of an enterprise. And as a handful proved throughout 2013, they a...