Fedora Project Mandating New Password and SSH Key Change

Recent site breaches like those at Kernel.org and Linux have prompted the Fedora Project to contact users to change their password and SSH public key before November 30 to avoid having their accounts marked as inactive. In a message posted on Wednesday to the Developer’s Announcements mailing lis...

Prosieben Website - Multiple SQL Injection Vulnerabilities

Document Title: =============== Prosieben Website - Multiple SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=284 Release Date: ============= 2011-10-04 Vulnerability Laboratory ID VL-ID: ====================================...

WordPress + Buddypress + Blogs Mu Theme Cross Site Scripting

Wordpress + Buddypress + Blogs Mu theme = XSS to Super Admin to Server Compromise ---------------------------------------------------------------------------------- Cross-site scripting XSS vulnerabilities tend to be seen as one of the less serious security issues. Sometimes XSS can be serious,...

La Poste FR Website - Multiple SQL Injection Vulnerabilities

Document Title: =============== La Poste FR Website - Multiple SQL Injection Vulnerabilities Release Date: ============= 2011-09-12 Vulnerability Laboratory ID VL-ID: ==================================== 267 Product & Service Introduction: =============================== La Poste is the mail...

Kernel.org Linux Site Compromised

Attackers have compromised a number of servers at kernel.org that house the Linux kernel source code and were able to modify a number of files and log user activity on the machines. However, it appears right now as though the Linux source code repositories were not affected by the attack. A messa...

German Federal Police servers Hacked by NN-Crew

German Federal Police servers Hacked by NN-Crew Hacking Group "NN-Crew" hacked into server used by Germany's Federal Police and stolen a large amount of data used to GPS-track suspects under surveillance. The hacked data published by NN-Crew included several usernames and passwords along with...

ACER Hacked : 40,000 Users Data, Source Codes & Server Compromised

ACER Hacked : 40,000 Users Data, Source Codes & Server Compromised Update : THN Report : ACER hacked because of their own stupidity This Week is Really with great UP-DOWNS in Cyber World. Mega hacks like Sony Pictures hacked, Chinese Hacker Cracks 100's of Gmail accounts , Public Broadcasting...

WordPress Spellchecker Local File Inclusion / Remote File Inclusion

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ======++++++ RFI & LFI Wordpress Spellchecker Plugin Vulnerability ++++++====== +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++...

The PHP Group has confirmed the compromise of their server !

The PHP Group has confirmed the compromise of their server ! In our last post we post that, Php.net got Compromised ,Read here . Today finaly PHP group has announce that they was really got hacked,as shown in above image. Link :...

'EC-Council Academy' server compromised !

'EC-Council Academy' server compromised ! EC-Council Academy , Here a image show above that https://www.eccouncilacademy.org got rooted by a hacker. The image clear expose the shell on the server and via putty the hacker is login as root on their server :P Update : I wanna clarify that 'EC-Counci...

FreeBSD : mediawiki -- multiple vulnerabilities (8d04cfbd-344d-11e0-8669-0025222482c5)

Medawiki reports : An arbitrary script inclusion vulnerability was discovered. The vulnerability only allows execution of files with names ending in '.php' which are already present in the local filesystem. Only servers running Microsoft Windows and possibly Novell Netware are affected. Despite...

Drupal Panels 5.x-1.2 XSS Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Description of Vulnerability: - ----------------------------- Drupal http://drupal.org is a robust content management system CMS written in PHP and MySQL. The Drupal Panels module http://drupal.org/project/panels "allows a site administrator to create...

mediawiki -- multiple vulnerabilities

Medawiki reports: An arbitrary script inclusion vulnerability was discovered. The vulnerability only allows execution of files with names ending in ".php" which are already present in the local filesystem. Only servers running Microsoft Windows and possibly Novell Netware are affected. Despite...

Drupal Custom Pagers Module XSS

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Description of Vulnerability: - ----------------------------- Drupal http://drupal.org is a robust content management system CMS written in PHP and MySQL. The Drupal Custom Pagers module http://drupal.org/project/custompagers "allows administrators to...

DotNetNuke Remote Code Execution vulnerability

======================================= Vulnerability discovered: November 23, 2010 Discovered by: Danil Niggebrugge, Fox-IT BV https://www.fox-it.com/ Reported to vendor: November 30, 2010 Fix available: Yes ======================================= PRODUCT ------------- DotNetNuke is an open sour...

SQL injection vulnerability in Energine

Vulnerability ID: HTB22783 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinenergine.html Product: Energine Vendor: Energine http://www.memht.com/ Vulnerable Version: 2.3.8 and probably prior versions Vendor Notification: 28 December 2010 Vulnerability Type: SQL Injection...

ProFTPD 1.3.3c Trojan Source Code

== ProFTPD Compromise Report == On Sunday, the 28th of November 2010 around 20:00 UTC the main distribution server of the ProFTPD project was compromised. The attackers most likely used an unpatched security issue in the FTP daemon to gain access to the server and used their privileges to replace...

OpenX Releases Security Update

OpenX has released a security update to address a vulnerability in the 2.8 downloadable version of OpenX. Exploitation of this vulnerability may allow an attacker to compromise the integrity of the server running OpenX. US-CERT encourages users and administrators to review the OpenX "Security...

Some Pushdo Variants Resuming Spam Operations

A few days after the majority of the command-and-control servers belonging to one of the variants of the Pushdo botnet were taken offline, some researchers say that there are indications that portions of the botnet are back to their old tricks, downloading new spam templates for a resumption of...

PHF CGI Program Remote Command Execution (CVE-1999-0067)

There exists a vulnerability in the sample cgi bin program, PHF, which is included with NCSA httpd, and Apache 1.0.3, an NCSA derivitive. By supplying certain characters with special meaning to the shell, arbitrary commands can be executed by remote users. In case of a successful attack, a remote...