SnapChat Vulnerable to Two Exploits

After claiming the makers of SnapChat repeatedly ignored their disclosures over a period of four months, Gibson Security recently published the full details of a pair of bugs in the photo and video sharing application. One could give an attacker the ability to connect phone numbers with usernames...

[Avivore] The Twitter-searching Data Miner

Avivore is a Python-based tool that searches Twitter for keywords and then parses any tweets that are found. When parsing, it looks for the following sort of data: Phone numbers in NPA-NXX format ex: 604-555-1212 IPv4 addresses 127.0.0.1 Blackberry PINs ABCDEF12 It presently uses a SQLite backend...

Stanford Researchers Find Connecting Metadata With User Names is Simple

One of the key tenets of the argument that the National Security Agency and some lawmakers have constructed to justify the agency’s collection of phone metadata is that the information it’s collecting, such as phone numbers and length of call, can’t be tied to the callers’ names. However, some...

U.S. District Court Judge Rules NSA Metadata Collection Likely Violates Fourth Amendment

A United States District Court judge has ruled that the bulk metadata collection program maintained by the National Security Agency for years now likely is unconstitutional. The judge, ruling on a pair of law suits that claimed the NSA’s methods violated users’ privacy and civil rights, said that...

EFF Argues For Search Warrant Requirement to Get Cell Location Data

With each day bringing new information about the way that intelligence agencies and law enforcement are tracking the activities and movements of U.S. citizens, the issue of when these organizations can legally obtain such data has become a major one. Now, a case that seemingly has little connecti...

Cisco Unified Communications Manager - TFTP Service

Exploit for hardware platform in category local exploits !/bin/bash Proof of Concept on how to get tftp config files from cisco phones This can be performed anonymously and privileges gathered relies on those assigned to the ldap account Developed by Daniel Svartman email protected In case tftp...

Microsoft Protects User Accounts with New Security Features

Microsoft announced yesterday that it will complement the two-factor authentication it enabled for account holders in April with additional security features designed to deny account hijacking and unauthorized access. Windows PC and mobile users, along with Outlook, SkyDrive, Xbox, Skype and othe...

Phone Drive Eightythree 4.1.1 iOS - Multiple Vulnerabilities

Document Title: =============== Phone Drive Eightythree 4.1.1 iOS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1168 Release Date: ============= 2013-12-10 Vulnerability Laboratory ID VL-ID: ==================================...

CVE-2013-6003

CRLF injection vulnerability in Cybozu Garoon 3.1 through 3.5 SP5, when Phone Messages forwarding is enabled, allows remote authenticated users to inject arbitrary e-mail headers via unspecified vectors...

CVE-2013-6905

Cross-site scripting XSS vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cybozu Garoon vulnerable to mail header injection

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains a mail header injection vulnerability in the Phone Messages function. Impact If the function that forwards Phone Messages to an email address is configured, the header of the email to be forwarded may be altered...

Cisco Unified IP Phone 8900/9900 Series Insecure File Permissions Vulnerability

A vulnerability in Cisco Unified IP Phone 9951, Cisco Unified IP Phone 9971, and Cisco Unified IP Phone 8961 could allow an authenticated, local attacker to fully compromise the affected device. The vulnerability is due to insecure file permissions on memory block devices. An attacker could explo...

CVE-2013-6685

The CVE-2013-6685 issue affects Cisco Unified IP Phone models 8961, 9951, and 9971. Root cause: weak permissions on memory block devices, enabling a local attacker to gain privileges by mounting a device that contains a setuid file in its filesystem. Impact: local privilege elevation on affected ...

Stanford Metaphone Project Aims to Show Dangers of Metadata Collection

When the first NSA surveillance story broke in June, about the agency’s collection of phone metadata from Verizon, most people likely had never heard the word metadata before. Even some security and privacy experts weren’t sure what the term encompassed, and now a group of security researchers at...

Cisco Adaptive Security Appliance Phone Proxy Database Entry Manipulation Vulnerability

A vulnerability in the phone proxy feature of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to temporarily insert an invalid entry in the phone proxy connection database. The vulnerability is due to the acceptance of an untrusted certificate. An attacke...

PT-2013-6071 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions 9.0.3.6 and earlier Description: The phone-proxy implementation in Cisco Adaptive Security Appliance ASA Software does not properly validate X.509 certificates, allowing remote attackers...

通达OA外网登陆绕过短信验证

简要描述： 外网登陆可绕过手机验证码 详细说明： http://外网网址/general/ 此处登陆需要获取手机验证码 http://外网网址/pda/ 但此处登陆无需验证码，登陆后可以切换回/general/目录正常访问。 漏洞证明：...

Stealing PIN Codes With a Wink and a Nod

Security researchers have developed a number of different methods to steal or bypass the passcodes on most of the common mobile phone platforms, some of which rely on software bugs and others that are simple social engineering techniques. Now, a pair of researchers from the University of Cambridg...

NSA Director Alexander Denies Spying on Europeans

Intelligence officials appearing before the House Permanent Select Committee on Intelligence on Tuesday denied collecting the phone records of citizens in France, Spain and Italy, as recently reported by media outlets in those countries. “The assertions made by Le Monde of France, El Mundo of Spa...

EFF: Congress Has Opportunity to Stop Mass Surveillance

Since the leaks of NSA surveillance methods began in June, there has been a flurry of activity in Congress, with members scurrying to line up on either side of the issue, either defending the agency’s methods or condemning them. That mad scramble also has included the introduction of a number of...