WordPress AzonPop 1.0.0 SQL Injection

Exploit Title : Wordpress AzonPop Plugin SQL Injection Exploit Author : Ashiyane Digital Security Team Vendor Homepage : azonpop.blogspot.com Google Dork : inurl:wp-content/plugins/azonpop Date: 8 Jan 2016 Tested On : Win 10 | CyberFox Browser Vulnerable PHP File = /AzonPop/files/view/showpopup.p...

Mail.ru: [cfire.mail.ru] Time Based SQL Injection

Добрый день. Уязвимо кукис с названием cfiresid. Рабочий PoC GET /account/userbar/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/47.0.2526.73 Safari/537.36 OPR/34.0.2036.25 Host: cfire.mail.ru Accept: text/html, application/xml;q=0.9,...

Security researchers find HIV Dating APP vulnerability, the reverse is the vendor with the AIDS threat-vulnerability warning-the black bar safety net

! Around the world websites and applications to encourage researchers noted that their system vulnerabilities, but one designed for HIV-positive users of online Dating app developer with HIV a threat to security researchers not to notify them of the program any security vulnerabilities. HIV...

13 Million MacKeeper Records Found in Public Database

A trove of MacKeeper user data—some 13 million records—has been locked down after a researcher found an exposed and accessible database using a simple Shodan query. Chris Vickery revealed his discovery on Monday on Reddit in more of an appeal to reach officials at Kromtech, the parent company tha...

Cisco Wireless Residential Gateway Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of the Cisco EPC3928 Wireless Residential Gateway could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to...

WordPress Plugin Polls Widget 1.0.7 - SQL Injection

Exploit Title : wordpress poll widget version 1.0.7 SQL Injection vulnerability Author : WICS Date : 7/12/2015 Software Link : https://wordpress.org/plugins/polls-widget/ Affected Version: 1.0.7 and below Overview: Poll widget is wordpress plugin which provide fancy user Polling layout to website...

One after another: the VTech user data leaked, and was broke two major vulnerability-vulnerability warning-the black bar safety net

Recently, the world's largest infant electronic learning product Maker Vtech（Vtech）is aeration 4 8 0 million parents and 6 4 0 million for children information disclosure. ! Due to this event, Vtech its share price fell to a year low. Followed, with security researchers in their innotab Max produ...

WordPress Poll Widget 1.0.7 SQL Injection

Exploit Title : wordpress poll widget version 1.0.7 SQL Injection vulnerability Author : WICS Date : 7/12/2015 Software Link : https://wordpress.org/plugins/polls-widget/ Affected Version: 1.0.7 and below Overview: Poll widget is wordpress plugin which provide fancy user Polling layout to website...

The largest infant electronic learning product Maker Vtech（Vtech）is aeration 4 8 0 million parents and children to information disclosure-vulnerability warning-the black bar safety net

Vtech Vtech, the company is located in Hong Kong, as the world's largest infant and preschool electronic learning products business, before being exposed user data leakage. From the current analysis point of view, leaked the data relates to the range has covered 4 of 8 0 million parents and more...

The vulnerability in the web application for data synchronization with ownCloud allows a hacker to gain access to protected information related to user accounts and cookies.

The vulnerability of a web application for data synchronization with ownCloud is related to the lack of protection for service-related data. Exploiting this vulnerability may allow an attacker, operating remotely, to gain access to protected information such as user accounts and cookies by readin...

iBackDoor: the suspected back door, the impact of the iOS app a high risk of code-bug warning-the black bar safety net

! Recently, FireEye Mobile Security researchers discovered embedded into the iOS app in the suspected“back door”behavior mobiSage advertising in the library, and these applications are from the App Store. The researchers will be the potential of the back door called iBackDoor, allowing hackers...

iBackDoor: High-Risk Code Hits iOS Apps

Introduction FireEye mobile researchers recently discovered potentially “backdoored” versions of an ad library embedded in thousands of iOS apps originally published in the Apple App Store. The affected versions of this library embedded functionality in iOS apps that used the library to display...

CVE-2015-7320 - Multiple Reflective XSS in Appointment Booking Calendar 1.1.7 WordPress plugin

Vulnerability title: Multiple Reflective XSS in Appointment Booking Calendar 1.1.7 WordPress plugin CVE: CVE-2015-7320 Vendor: WordPress DWBooster Product: Appointment Booking Calendar Affected version: 1.1.7 Fixed version: 1.1.8 Reported by: Iberia Medeiros Vulnerability Details:...

Apple told Judge: It's Impossible to Access Data on Locked iPhones

US Federal Official: Unlock that iPhone for me? Apple: Sorry, Nobody can do this! Neither we, nor you. Yes, in a similar manner, Apple told a U.S. federal judge that it is "IMPOSSIBLE" to access data stored on a locked iPhone running iOS 8 or later iOS operating system. In short, Apple has remind...

Vulnerability in Datalex airline booking software

Datalex airline booking software is a suite of software from Datalex Ireland that automatically connects to airline bookings. A security vulnerability exists in Datalex airline booking software updated prior to date 2015-09-03. A remote attacker can exploit the vulnerability to read or access...

74cms /wap/wap-company-show.php sql注入

/wap/wap-company-show.php define'INQISHI', true; requireoncedirnameFILE.'/../include/common.inc.php'; requireonceQISHIROOTPATH.'include/funwap.php'; requireonceQISHIROOTPATH.'include/mysql.class.php'; $smarty-cache = false; $db = new mysql$dbhost,$dbuser,$dbpass,$dbname;...

CVE-2015-2858

Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to 1 ValidateFormAction.do or 2 ProfileConfirmEditAddressAction.do...

Code injection

Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to 1 ValidateFormAction.do or 2 ProfileConfirmEditAddressAction.do...

CVE-2015-2858

The CVE-2015-2858 issue affects the Datalex airline booking software (pre-2015-09-03) and stems from an authorization-check bypass in how the application processes the profileId parameter. By modifying profileId in POST requests to ValidateFormAction.do or ProfileConfirmEditAddressAction.do, an a...

CVE-2015-2858

Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to 1 ValidateFormAction.do or 2 ProfileConfirmEditAddressAction.do...