Josh Shaul on Broken Security, Targeted Attacks and Database Security

Dennis Fisher talks with Josh Shaul of AppSec about the current run of targeted attacks and data breaches, the state of denial among some security and IT staffs about the extent of the problem and what can be done to address the issues. Podcast audio courtesy of sykboy65 Subscribe to the Digital...

Tumblr security flaw, Clarification by Tumblr official staff !

Tumblr security flaw, Clarification by Tumblr official staff ! On our yesterday post about Tumblr security flaw : server IPS, API keys, passwords, etc were leaked, Finally Tumblr official staff gives a statement to all their users as below : A human error caused some sensitive server configuratio...

DeKalb website hacked !

It appeared briefly this week that all DeKalb County's properties were owned by a hacker. The county's property appraisal website was hacked and listed every property owner as "Hacked by Red xD," CEO's spokesman Burke Brennan confirmed for The Atlanta Journal-Constitution. Brennan insisted none o...

Gawker Media Hacked by Gnosis, Source Code Leaked

A lot of people are gawking at Gawker Media this morning, though not for reasons that will bring much cheer to its founder, Nick Denton. Gawker, the parent company of popular blogs like Gizmodo, Lifehacker, Jezebel, and ValleyWag, has suffered a significant breach. A hacker group known as Gnosis...

Hacker Poses as Graduate, Hacks Student Emails, Faces Legal Consequences

A hacker who posed as a university graduate to access the emails of hundreds of students has been given a suspended prison sentence and ordered to pay more than £20,000 in costs and compensation. Daniel Woo, a 23-year-old Bulgarian national, was sentenced for offenses under the Misuse of Computer...

Jurpopage 0.2.0 - SQL Injection

Jurpopage 0.2.0 - SQL Injection ========================================================= Jurpopage SQL Injection ========================================================= Exploit Title : Jurpopage SQL Injection Date : 24 Noveber 2010 Author : Suddendeath [email protected] Platform/Tested...

Paul Roberts Joins Threatpost

In the year and a half since we first launched Threatpost, the site has grown very quickly, probably more quickly than any of us had even hoped it might. We’ve added a couple of regular podcasts, original videos, developed a stable of terrific regular contributors and recently launched our first...

TheHostingTool 1.2.2 Cross Site Request Forgery

Date: Mon 12 Jul 2010 01:19:52 PM EEST Vendor: http://thehostingtool.com/ Download: http://thehostingtool.googlecode.com/files/THT-v1.2.2.zip --- -= CSRF PoC 1 - Create Staff Account =- TheHostingTool 1.2.2 Multiple CSRF Vulnerabilities - Create Staff Account -= CSRF PoC 2 - Delete Staff Account ...

TheHostingTool 1.2.2 - Multiple Cross-Site Request Forgery Vulnerabilities

TheHostingTool 1.2.2 - Multiple Cross-Site Request Forgery Vulnerabilities Date: Mon 12 Jul 2010 01:19:52 PM EEST Vendor: http://thehostingtool.com/ Download: http://thehostingtool.googlecode.com/files/THT-v1.2.2.zip --- -= CSRF PoC 1 - Create Staff Account =- TheHostingTool 1.2.2 Multiple CSRF...

TheHostingTool 1.2.2 - Multiple Cross-Site Request Forgery Vulnerabilities

Date: Mon 12 Jul 2010 01:19:52 PM EEST Vendor: http://thehostingtool.com/ Download: http://thehostingtool.googlecode.com/files/THT-v1.2.2.zip --- -= CSRF PoC 1 - Create Staff Account =- TheHostingTool 1.2.2 Multiple CSRF Vulnerabilities - Create Staff Account -= CSRF PoC 2 - Delete Staff Account ...

TheHostingTool v1.2.2 Multiple CSRF Vulnerabilities

Exploit for php platform in category web applications =================================================== TheHostingTool v1.2.2 Multiple CSRF Vulnerabilities =================================================== Date: Mon 12 Jul 2010 01:19:52 PM EEST Vendor: http://thehostingtool.com/ Download:...

Traidnt Discovery Cross Site Request Forgery

Exploit Title: Traidnt Discovery - CSRF/Change Username & Password Staff Account Date: 16-06-2010 Author: G0D-F4Th3r Software Link: http://discovery.traidnt.com/demo/ Version: 1.0 ====================================form================================================ /ht...

FBI Probes AT&T iPad Goatse Email Leak

The U.S. Federal Bureau of Investigation has opened an investigation into the leak of an estimated 114,000 Apple iPad user e-mail addresses including those of Chief of Staff Rahm Emanuel, ABC ABC News anchor Diane Sawyer and NY Mayor Michael Bloomberg. Read the full article. IDG News Service...

Cosmos Solutions cms SQL Injection Vulnerability

Exploit for php platform in category web applications ================================================ Cosmos Solutions cms SQL Injection Vulnerability ================================================ .----..--.--.| |--..-----..----.| |.-----..-----. | || | || || -|| || || || | ||| ||||||| ||||| ...

CVE-2010-1057

Phpkobo AdFreely (aka Ad Board Script) 1.01 is affected by directory traversal via LANG_CODE in common.inc.php, enabling remote inclusion/execution of local files when magic_quotes_gpc is disabled. The vulnerability affects multiple paths (codelib/cfg/, codelib/sys/, staff/, staff/app/, staff/fil...

CVE-2010-0605

SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter...

CVE-2009-4392

SQL injection vulnerability in the XDS Staff List xdsstaff extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the XDS Staff List xdsstaff extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-4392

SQL injection vulnerability in the XDS Staff List xdsstaff extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-4392

The CVE-2009-4392 entry concerns a SQL injection vulnerability in the TYPO3 XDS Staff List (xds_staff) extension, affected in version 0.0.3 and earlier. The underlying issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors. The available documents confirm the prod...