iScripts AutoHoster - checktransferstatusbck.php SQL Injection

iScripts AutoHoster - checktransferstatusbck.php SQL Injection source: https://www.securityfocus.com/bid/64377/info iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker can exploit these vulnerabilities to...

Turkish PM Erdogan’s staff emails hacked and leaked by Syrian Electronic Army Hackers as #OpTurkey

Syrian Electronic army appears to be taking part in ongoing operation against Turkey government website. Hackers collectively called Anonymous and SEA breached into Turkish Ministry of Interior website and the private information of staffers in PM Tayyip Erdogan's office. Hackers claimed that the...

Kayako Fusion 4.51.1891 Cross Site Scripting

Title: ====== Kayako Fusion v4.51.1891 - Multiple Web Vulnerabilities Date: ===== 2013-01-22 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=824 ID: SWIFT-3119 URL: http://dev.kayako.com/browse/SWIFT-3119 VL-ID: ===== 824 Common Vulnerability Scoring System:...

Dd'Linux - SQL Injection / Cross-Site Scripting Vulnerabilities

Dd'linux provides business solutions and services based on Linux as the main OS.Given the form of licensing which is free software, these solutions do not require the degree of investment in licenses as required by commercial software.Our technical staff has experience since 1996 in the...

E-Mail Security Virtual Appliance (ESVA) - Remote Execution

Exploit Title: E-Mail Security Virtual Appliance ESVA Remote Execution. Date: 10 Aug 2012 Exploit Author: iJoo Vendor Homepage: http://www.esvacommunity.com/ Software Link: http://sourceforge.net/projects/esva-project/ Version: ; while$cmd ! "exit" $content = ""; $ua = LWP::UserAgent-new;...

Minnesota Premier Publications SQL injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Minnesota Premier Publications SQL injection Vulnerability Author: Becax Home : CrimeIRCD ---------------------------------------------------------------------! Email : email protected Category: webapps Version: n/a Google dork:...

Coalfire Acquires Digital Resources Group in California

We have reached a new milestone at Coalfire and have announced the recent acquisition of privately held Digital Resources Group DRG in Redwood City, California. We are excited about our latest venture as it consolidates our leadership position within the IT Governance Risk and Compliance IT GRC...

CitrusDB 2.4.1 - LFI/SQLi Vulnerability

CitrusDB 2.4.1 - LFI/SQLi Vulnerability Author: Michal wacky Blaszczak WWW: blaszczakm.blogspot.com CitrusDB is an open source customer service and billing database. It can be used by customer service personnel to provide sales and support to customers, and by billing staff to bill customers for...

Game On: Gamma Ray Scanners To Guard 'Most Technologically Secure' Super Bowl Ever

Gamma ray scanners? Night vision cameras? bomb-proof manhole covers? G-Men? It must be Super Bowl time again, and Marion County, Indiana says that they’ve gone where no other municipality has gone before: a permanent, $18 million regional operation center yes – ROC that will manage security at th...

[PT-2011-04] Cross-Site Scripting in Kayako Support Suite

----------------------------------------------------------------- PT-2011-04 Positive Technologies Security Advisory Cross-Site Scripting in Kayako Support Suite ----------------------------------------------------------------- --- Vulnerable software Kayako Support Suite Version: 3.70.02-stable...

Anonymous expose email addresses of British military staff & Nato officials

Anonymous expose email addresses of British military staff & Nato officials Anonymous Hackers expose email addresses of 221 British military staff with encrypted passwords, including those of defence, intelligence and police officials as well as politicians and 242 Nato advisers. "Civil servants...

Several vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third-party TYPO3 extensions: MM DAM - FEFileList mmdamfilelist, Events julleevents, WEC Staff Directory wecstaffdirectory, TGM news tgmnews, TGM media tgmmedia, TGM calendar module tgmcal, DAM Lightbox damlightbox, Download system...

How I Taught the Senate To Hack

What happens when 20-something Beltway wonks put down their Blackberries and start getting real about hacking? Chris Wysopal can tell you. The security expert and former L0pht member is just back from D.C., where he took on the job of teaching Senate staffers on the Homeland Security and...

Josh Shaul on Broken Security, Targeted Attacks and Database Security

Dennis Fisher talks with Josh Shaul of AppSec about the current run of targeted attacks and data breaches, the state of denial among some security and IT staffs about the extent of the problem and what can be done to address the issues. Podcast audio courtesy of sykboy65 Subscribe to the Digital...

Tumblr security flaw, Clarification by Tumblr official staff !

Tumblr security flaw, Clarification by Tumblr official staff ! On our yesterday post about Tumblr security flaw : server IPS, API keys, passwords, etc were leaked, Finally Tumblr official staff gives a statement to all their users as below : A human error caused some sensitive server configuratio...

DeKalb website hacked !

It appeared briefly this week that all DeKalb County's properties were owned by a hacker. The county's property appraisal website was hacked and listed every property owner as "Hacked by Red xD," CEO's spokesman Burke Brennan confirmed for The Atlanta Journal-Constitution. Brennan insisted none o...

Gawker Media Hacked by Gnosis, Source Code Leaked

A lot of people are gawking at Gawker Media this morning, though not for reasons that will bring much cheer to its founder, Nick Denton. Gawker, the parent company of popular blogs like Gizmodo, Lifehacker, Jezebel, and ValleyWag, has suffered a significant breach. A hacker group known as Gnosis...

Hacker Poses as Graduate, Hacks Student Emails, Faces Legal Consequences

A hacker who posed as a university graduate to access the emails of hundreds of students has been given a suspended prison sentence and ordered to pay more than £20,000 in costs and compensation. Daniel Woo, a 23-year-old Bulgarian national, was sentenced for offenses under the Misuse of Computer...

Jurpopage 0.2.0 - SQL Injection

Jurpopage 0.2.0 - SQL Injection ========================================================= Jurpopage SQL Injection ========================================================= Exploit Title : Jurpopage SQL Injection Date : 24 Noveber 2010 Author : Suddendeath [email protected] Platform/Tested...

Paul Roberts Joins Threatpost

In the year and a half since we first launched Threatpost, the site has grown very quickly, probably more quickly than any of us had even hoped it might. We’ve added a couple of regular podcasts, original videos, developed a stable of terrific regular contributors and recently launched our first...