UseBB 1.0.14 Cross Site Request Forgery

UseBB 1.0.14 CSRF Vulnerability Author : Muhammet Cagri Tepebasili Date : 11.12.2011 Script & Demo : UseBB http://demo.opensourcecms.com/usebb/index.php Version : 1.0.14 Tested On : Linux Mint 11 Exploit : UseBB 1.0.14 CSRF Vulnerability | Author : Muhammet Cagri Tepebasili Note : Your Password...

crypt_blowfish: 8-bit character mishandling allows different password pairs to produce the same hash

cryptblowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash...

Miley Cyrus Needs A Lecture on Cyber Security

Miley Cyrus Needs A Lecture on Cyber Security The man, who is currently facing up to 121 years behind bars, has been charged with 26 counts of identity theft, wire-tapping and unauthorised access to protected computer.Chaney, who has been in contact with TMZ for the last two years, has contacted...

CVE-2011-3245

The Keyboards component in Apple iOS before 5 displays the final character of an entered password during a subsequent use of a keyboard, which allows physically proximate attackers to obtain sensitive information by reading this character...

Linux.com down again due to Security Breach

Linux.com down again due to Security Breach Linux Foundation infrastructure including LinuxFoundation.org, Linux.com, and their subdomains are again down for maintenance due to a security breach that was discovered on September 8, 2011. Investigators yet can't elaborate the source of attack...

CVE-2011-2483

cryptblowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash...

CVE-2011-0197

CVE-2011-0197 affects Apple Mac OS X (App Store) prior to 10.6.8, where App Store could log a user’s AppleID password to a local file with insufficient permissions, enabling local users to read the password. The root cause is credentials being written to a log entry; an improved handling of crede...

Chinese Hacker Cracks Hundreds of Gmail Accounts of U.S. & Asia

Chinese Hacker Cracks Hundreds of Gmail Accounts of U.S. & Asia Hackers around the world are gaining more attention than usual in the last few months. Now Google has added another announcement to the pile that hundreds of Gmail accounts have been hacked recently. Now, Google affirms that the...

CVE-2011-2076

MediaCAST 8 and earlier store passwords in cleartext, exposing sensitive credentials to attackers who can read the password data store. The description ties this to CVE-2011-2076 and distinguishes it from CVE-2010-0216. The documents do not specify the exact vulnerable component, root cause detai...

Password Security Do's and Don'ts

We write a lot about sophisticated, targeted attacks and zero day vulnerabilities aside. But the fact is that most security breaches hinge on easy to prevent security holes – such as insecure passwords. Indeed, even as headlines blare about data breaches and hacks at prominent firms, password...

Hydra v6.3 Released with oracle & snmp-enum modules !

Hydra v6.3 Released with oracle & snmp-enum modules ! A very fast network logon cracker which support many different services. Have a look at the feature sets and services coverage page - including a speed comparison against ncrack and medusa! Number one of the biggest security holes are password...

QQ the auction system ewebeditor exploit bulk take Station-vulnerability warning-the black bar safety net

Batch keyword: inurl:QQsales. asp Background address: http://www.xxx.com/editer/adminlogin.asp Default account: admin admin If the password is wrong, you can download: http://www.xxxx.com/editer/db/ewebeditor.mdb, and then read the password...

Input validation

installer.pl in Open Ticket Request System OTRS before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen...

CVE-2010-4758

Open Ticket Request System (OTRS) is affected (OTRS before 3.0.3). The Inbound Mail Password field uses an INPUT of type text instead of password, enabling a physically proximate attacker to read the password on screen. Root cause: password field not masked in the UI. Impact: potential password d...

Metasploit 3.5.1 adds Cisco device exploitation !

Metasploit now enables security professionals to exploit Cisco devices, performs passive reconnaissance through traffic analysis, provides more exploits and evaluates an organization's password security by brute forcing an ever increasing range of services. This latest release adds stealth...

Re: hidden admin user on every HP MSA2000 G3

On Mon, 13 Dec 2010 [email protected] wrote: i just found out that there is a hidden user on every HP MSA2000 G3 SAN out there: username: admin password: !admin Confirmed on P2000 G3 fw L100R013. Please, HP, is it really necessary to give us so many different reasons to hate you?! this use...

CVE-2010-4311

The CVE-2010-4311 entry concerns Free Simple Software 1.0, where passwords are stored in cleartext, enabling an attacker to disclose sensitive information. This information is corroborated by NVD entries describing cleartext password storage. The available connected documents do not specify affec...

FCrackZip 1.0 - Local Buffer Overflow (PoC)

Exploit Title: FCrackZip Local Buffer Overflow PoC Date: September 5th, 2010 Author: 0x6264 Software Link: http://oldhome.schmorp.de/marc/data/fcrackzip-1.0.tar.gz Version: 1.0 Tested on: Ubuntu 10.04 CVE : None Software Description: fcrackzip is a zip password cracker, similar to fzc, zipcrack a...

CA Oneview Monitor DoSave.jsp Path Manipulation

Minded Security Labs: Advisory MSA100410 CA Oneview Monitor "DoSave.jsp" path manipulation Tested Versions: This advisory is intended for CA Netegrity Siteminder Policy Manager 6.x with Netegrity Oneview monitor installed. Minded Security ReferenceID: MSA100410 Credits: Discovery by Giorgio Fedon...

Research: Weird Works When It Comes to Passwords

Researchers at Microsoft and Harvard University warn that popular passwords pose a bigger risk to online security than weak ones and suggest that many tools to enforce strong passwords actually steer users to choices that are easy to guess. Forcing users to choose passwords that are rare and...