Mail.ru: [townwars.mail.ru] Time-Based SQL Injection

Добрый день. POSТ параметры "c" и "m" названия контроллера и метода соответственно уязвимы к атаке типа SQL Injection. прямого вывода на страницу нет, но можно получить данные ориентируясь на задержку ответа от сервера если запрос возвращает false - ответ от сервера возвращается быстро. если запр...

Threat Outbreak Alert RuleID21611: Email Messages Distributing Malicious Software on March 9, 2016

Medium Alert ID: 43987 First Published: 2016 March 9 20:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID21611 and RuleID21611KVR may contain the followin...

ownCloud: Apache Range Header Denial of Service Attack (Confirmed PoC)

owncloud.com is vulnerable to Apache range header denial of service. This was confirmed by injecting Range: header payloads and analyzing the request vs. response times to an arbitrary page. The results confirm that processing times took up to 50,000 milliseconds per request when the range header...

CollabNet Subversion Edge missing brute force protection

Vuln Title: The CollabNet Subversion Edge does not protect against brute forcing accounts Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: Lack of defensive measures Risk: Medium Status:...

phpyun v3.2 (20141222) 无需登录无视过滤注入一枚。

简要描述： 无需登录。 最新版本。 demo测试。 功能越多 bug越多 bug越多 rank越多。 详细说明： 在model/subscribe.class.php中 function certaction if$GET'id' $arr=@explode"|",base64decode$GET'id';//当时我就震惊了。。。 $email = $arr0; $code = $arr1; $nid=$this-obj-DBupdateall"subscribe","status='1'","email='".$email."' and code='".$code."'";...

MyBulletinBoard (MyBB) <= 1.2.3 - Remote Code Execution Exploit

No description provided by source. !/usr/bin/php ?php errorreportingEALL ^ ENOTICE; http://www.milw0rm.com/exploits/2012 They corrected not all a lot of SQL requests which use the ipaddress, with $db-escapestring. They don't corrected the function this is a choice ... the bad and they forgot to...

Facebook Bug Bounty Submissions Dramatically Increase

Facebook today reported a dramatic increase in 2013 submissions to its bug bounty program, and said that despite reports from researchers that it’s becoming difficult to find severe bugs on its various properties, the social network plans to increase rewards for critical bugs. “The volume of...

[Wireshark v1.9.2] World’s Foremost Network Protocol Analyzer

Wireshark is the world’s foremost network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It is the de facto and often de jure standard across many industries and educational institutions. Wireshark development thrives thanks to the...

Study Examines Security and Privacy in Computer-Related Medical Device Recalls

Nearly one-third of all recalled medical devices contain computers, and half of those are recalled because of computer-related problems, according to a recent study. ‘Security and Privacy Qualities of Medical Devices: An Analysis of FDA Postmarket Surveillance’ was funded by the Department of...

broadcast-dhcp-discover NSE Script

Sends a DHCP request to the broadcast address 255.255.255.255 and reports the results. By default, the script uses a static MAC address DE:AD:CO:DE:CA:FE in order to prevent IP pool exhaustion. The script reads the response using pcap by opening a listening pcap socket on all available ethernet...

Cisco IOS Software Processing of SAA Packets - Cisco Systems

The Service Assurance Agent SAA is the new name for the Response Time Reporter RTR feature. The router is vulnerable only if the RTR responder is enabled. When the router receives a malformed RTR packet, it will crash. RTR is disabled by default. There is no workaround short of disabling the RTR...

ISC BIND named negative caching vulnerability

Overview ISC BIND contains a vulnerability in the processing of large RRSIG RRsets included in a negative cache response. Description According to ISC:DNS systems use negative caching to improve DNS response time. This will keep a DNS resolver from repeatedly looking up domains that do not exist...

A Chat With Adobe's Brad Arkin

Adobe has been in the security spotlight for some time now, and in an effort to give our readers a better perspective on the company’s efforts to improve the security of its products, Threatpost had a live chat with Brad Arkin, director of product security and privacy at Adobe, on Feb. 24. This i...

SaphpLesson 4.3 - Blind SQL Injection

SaphpLesson 4.3 - Blind SQL Injection !/usr/bin/ruby ============================================= SaphpLesson v4.3 Exploit Blind SQL Injection Vulnerability --------------------------------------------- Date: 21-08-2009 Discovered & written by: Jafer Al Zidjali Email: jaferatscorpionds.com...

SaphpLesson 4.3 SQL Injection

!/usr/bin/ruby ============================================= SaphpLesson v4.3 Exploit Blind SQL Injection Vulnerability --------------------------------------------- Date: 21-08-2009 Discovered & written by: Jafer Al Zidjali Email: jaferatscorpionds.com Website: www.scorpionds.com...

Month Of Twitter Bugs - TwitSnaps XSS

Sunday, July 5, 2009 MoTB 05: Reflected XSS in TwitSnaps What is TwitSnaps "We tweet your photos, that's what we do! You want to share your photographs on Twitter? TwitSnaps is at your service." TwitSnaps about page Twitter affect TwitSnaps can be used to send tweets by uploading new photos, or...

CiscoWorks Internetwork Performance Monitor远程命令执行漏洞

BUGTRAQ ID: 28249 CVECAN ID: CVE-2008-1157 CiscoWorks IPM是可测量网络响应时间和可用性的故障检测应用。 Solaris和Windows平台上的的IPM 2.6版中的一个进程可导致将命令shell自动绑定到随机选择的TCP端口上，未经认证的远程用户可以连接到开放的端口上并在Solaris系统上以casuser权限或在Windows系统上以SYSTEM权限执行任意命令。 Cisco Internetwork Performance Monitor 2.6 厂商补丁： Cisco -----...

Vulnerability in InterVations&#39; MailCopa

While developing one of our advanced security training movies, we identified an exploitable vulnerability in the latest release of InterVetions' MailCopa. Successful exploitation of this vulnerability allows an attacker to execute arbitrary code in the context of the user executing MailCopa. In a...

OpenSSH < 4.1.0p2 / 4.2 Timing Attack

Binary data 3787.prm...

OpenSSH timing attacks

It's possible to check user's validity by measuring response time...