portable-phpMyAdmin（WordPress plugin authentication bypass-vulnerability warning-the black bar safety net

Part1. Description portable-phpMyAdmin is Wordpress a plug-in, direct access to plug-ins when there are no validation Wordpress session and permissions. Since this plugin has quite a lot of management functions, without a custom over the portable-phpMyAdmin plugin provides a full phpMyAdmin conso...

Scientific Linux Security Update : ecryptfs-utils on SL5.x i386/x86_64

These updated ecryptfs-utils packages have been upgraded to upstream version 75, which provides a number of bug fixes and enhancements over the previous version. In addition, these packages provide a graphical program to help configure and use eCryptfs. To start this program, run the command :...

Multiple xss issues in Liferay

Multiple xss issues in Liferay Description: Liferay Portal is an enterprise portal written in Java Multiple xss vulnerabilities where found in liferay. Because liferay has a "remember me" option in their login screen that stores an encrypted password in a cookie this is more problematic than it...

Liferay 5.x / 6.x Cross Site Scripting

Multiple xss issues in Liferay Description: Liferay Portal is an enterprise portal written in Java Multiple xss vulnerabilities where found in liferay. Because liferay has a "remember me" option in their login screen that stores an encrypted password in a cookie this is more problematic than it...

LabStoRe <= 1.5.4 Sql Injection Vulnerabilities

Dear All, I have found multiple sql injection vulnerabilities in LabStoRe = 1.5.4. The vendor knows the vulnerabilities and he is fixing them as stated in the enclosed advisory. See also http://www.bioinformatics.org/phplabware/labwiki/index.php?page=releasenotes Since the developer is currently...

Bleeding Life 2 Exploit Pack Released

Bleeding Life 2 Exploit Pack Released Black Hat Academy releases Bleeding Life 2 exploit pack. This is an exploit pack that affects Windows-based web browsers via Adobe and Java. You can read all about it, and download it for yourself. Statistics are kept based on exploit, browser, and OS version...

Recent Surveys Reveal Trends and Spending Habits for Retailers in PCI Compliance

Recently, Gartner Research released two separate research reports on retailer PCI DSS compliance progress, trends and strategies. These reports are based on a survey of 77 merchants of varying sizes and covers a wide range of topics, including compliance status, spending and the incidence of...

Work In Progress SQL Injection

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Work in Progres newsdettagli.php?idnews AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.wkprogress.com/ Persian Gulf 4 Ever! Dork : "Site design by: Work in Progres"...

Indictment Names Reddit Luminary In Theft of Data from MIT

A 24 year-old entrepreneur and star programmer has been indicted by the federal authorities in Boston following and accused of hacking into the network of the Massachusetts Institute of Technology and making off with millions of pages of copyrighted documents. Aaron Swartz, who is best known as a...

Amazon Web Service Down, No Timeline for Remedy

Amazon Web Service’s AWS Elastic Compute Cloud EC2, based in Northern Virginia, went offline early this morning, taking with it a number of popular sites including, news aggregator Reddit and question and answer site and TechCrunch darling, Quora.The Web hosting firm’s Relational Database Service...

Microsoft Cites Progress in SDL Report, Advocates More Adoption of ASLR, DEP

In the more than nine years since Bill Gates’s Trustworthy Computing email kicked off Microsoft’s comprehensive, company-wide security initiative, the company has not only committed a tremendous amount of money and resources to the project but also has been quite open and public about the process...

German Police & Sony Raids on Hacker's Home !

Sony has stepped up their game in Germany. Early this week, the home of German hacker "grafchokolo," known in real life as Alexander Egorenkov, was raided by a Sony representative backed up by local police. Sony seized Egorenkov's computer equipment and PS3 consoles as evidence in an upcoming cou...

BackTrack 5 ( BT5 ) Coming Soon !

BackTrack 5 BT5 Coming Soon ! We're behind schedule with BackTrack 5, but are working hard to make up for lost time. We thought we'd post a few pictures for your enjoyment of the development BT5 ISO we're working on. The screenshots were taken on a 2.6.38-rc5 kernel. The screenshot above is of th...

Progress Crawls in Securing Critical Infrastructure

The US government is progressing at a snail’s pace in securing critical American infrastructure according to a Center for Strategic and International Studies CSIS commission on cybersecurity examining the first two years of the 44th presidency. Two years ago the CSIS published Securing Cyberspace...

[DSECRG-11-008] Open Edge RDBMS - Multiple architecture vulnerabilities (UNPATCHED)

Digital Security Research Group DSecRG Advisory DSECRG-11-008 Application: Progress OpenEdge Enterprise RDBMS Versions Affected: 10.2A and maybe others Vendor URL: http://web.progress.com Bug: Authentication bypass, UserID enumerate Exploits: YES Reported: 13.10.2009 Vendor response: 13.10.2009...

pyftpdlib FTP Server Information Disclosure Vulnerability

pyftpdlib FTP server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

pyftpdlib FTP Server Information Disclosure Vulnerability

This host is running pyftpdlib FTP server and is prone to information disclosure vulnerability. OpenVAS Vulnerability Test $Id: gbpyftpdlibinfodiscvuln.nasl 7573 2017-10-26 09:18:50Z cfischer $ pyftpdlib FTP Server Information Disclosure Vulnerability Authors: Sooraj KS Copyright: Copyright c 201...

PYSEC-2010-22

pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to this command...

This Week In Security: Black Hat, Spammers and Trusted Rootkits

The old saying that there’s nothing new under the sun is just as true in the security industry as it is anywhere else. Many new attacks are variants or tweaks of existing ones, new software fails in exactly the same way as old software and new technologies crop up to solve problems that are 30...

White House Cybersecurity Meeting Produces Cautious Optimism

The meeting convened Wednesday at the White House by the country’s top cybersecurity official, Howard Schmidt, which included more than 100 security experts from the private sector and various government agencies, didn’t end with Schmidt revealing any new programs or initiatives, but some of the...