Topline Systems Opportunity Form vulnerable to information disclosure

Overview Topline Systems Opportunity Form contains an information disclosure vulnerability. Description CWE-200: Information Exposure Topline Systems Opportunity Form is a macro-enabled Excel spreadsheet that contains connection strings to a public-facing database. By running procedures included ...

Reddit Publishes its First Transparency Report

Reddit on Thursday published its first transparency report, joining the litany of technology and online service providers who have already shed light on their privacy practices, and the extent to which governments makes requests for user information. Reddit thrives on user-submitted content...

Apple MAC OS X Yosemite SceneKit Out-of-Bounds Vulnerability

Apple MAC OS X Yosemite is the latest operating system developed by Apple. Apple MAC OS X Yosemite handles SceneKit with an out-of-bounds error that allows remote attackers to exploit the vulnerability to execute arbitrary code to obtain user information...

74CMS 3.5.1 /wap/wap-resume-show.php SQL注入漏洞

/wap/wap-resume-show.phpifintval$SESSION"uid"0 $sql="select from ".table"companydownresume"." where companyuid=$SESSIONuid and resumeid=$GETid "; $downresume=$db-getone$sql; $smarty-assign'downresume',$downresume; $time=time; $jobssql="select from ".table"jobs"." where uid=$SESSIONuid and display...

PHP Calendar Extension Remote Integer Overflow Vulnerability

PHP is a widely used general purpose scripting language. A remote integer overflow vulnerability exists in PHP Calendar Extension because it fails to fulfill sufficient bounds checks on user-supplied data. An attacker could exploit this vulnerability to execute arbitrary code in the context of th...

ArticleFR CMS 3.0.5 - SQL Injection

ArticleFR CMS 3.0.5 - SQL Injection Exploit Title: SQL injection vulnerability in articleFR CMS 3.0.5 Google Dork: N/A Date: 01/21/2015 Exploit Author: Tran Dinh Tien [email protected] & ITAS Team www.itas.vn Vendor Homepage: http://freereprintables.com Software Link:...

Facebook Careers Page XXE Vulnerability Patched

A vulnerability was discovered and patched in a third-party service that handles resumes on Facebook’s careers page. The discovery was worth more than $6,000 in a bounty paid out by Facebook to researcher Mohamed Ramadan of Egypt, who published some details of the vulnerability and exploit on his...

Google Document Embedder 2.5.16 SQL Injection

Exploit Title : Google Document Embedder 2.5.16 mysqlrealescpaestring bypass SQL Injection Data : 2014 – 12 -03 Exploit Author : Securely Yoo Hee man Plugin : google-document-embedder Fixed version : N/A Software Link : https://downloads.wordpress.org/plugin/google-document-embedder.2.5.16.zip 1...

Kesion ICMS智能建站系统多处权限绕过，可修改任意用户密码

简要描述： Kesion ICMS2.5智能建站系统存在多处权限绕过 详细说明： Kesion ICMS智能建站系统多处权限绕过，修改任意用户资料，并可修改任意用户密码。 漏洞证明： 系统官网：http://www.kesion.com/ 系统演示站点：http://i.kesion.com/ 为了演示漏洞，注册了用户名为test1和test2的两个用户。 漏洞一、修改任意用户基本资料： 1、登录test1用户--》会员中心--》修改我的资料。 2、使用代理拦截请求，修改cookie中的username字段为被攻击的用户名： 3、登录被攻击用户，用户资料被修改 漏洞二、修改任意用户绑定手...

Twitter will now Track EVERY App You have Installed on Your Smartphone

Like Facebook and Google, Twitter will soon be collecting your smartphone data in order to provide a "more personal Twitter experience" by serving targeted advertisements. The popular microblogging service Twitter said Wednesday that it will start collecting information about the other applicatio...

YXCMS 1.2.6任意文件删除可Reinstall

简要描述： YXCMS 1.2.6任意文件删除 Reinstall 详细说明： 前人经验： http://wooyun.org/bugs/wooyun-2010-047226 产生漏洞文件： protected\apps\admin\controller\photoController.php protected\apps\member\controller\photoController.php 关键代码： if!empty$photos'photolist' $phoarr=explode',',$photos'photolist'; foreach $phoarr as $vo...

rubygem-actionpack: number_to_currency XSS

It was found that the numbertocurrency Action View helper did not properly escape the unit parameter. An attacker could use this flaw to perform a cross-site scripting XSS attack on an application that uses data submitted by a user in the unit parameter...

Government Requests for Facebook User Data Increasing

Facebook’s latest transparency report shows that U.S law enforcement agencies issued a greater number of total requests for user data related to criminal investigations in the first six months of 2014 than they have over any previous such period. This report, per Justice Department reporting...

Sony Xperia Devices Secretly Sending User Data to Servers in China

If you own a Sony smartphone either the Android 4.4.2 or 4.4.4 KitKat firmware then inadvertently you may be transmitting your data back to the servers in China, even if you haven’t installed any application. Quite surprising but it’s true. I know many of you haven’t expected such practices from ...

Verizon Wireless Injects Identifiers to Track Mobile Customers’ Online Activities

The Nation's largest telecom operator 'Verizon Wireless' is tracking its customers' mobile internet traffic by adding a token to Web requests traveling over its network, in order to facilitate targeted advertising even if a user has opted out of their Customer Proprietary Network Information CPNI...

Drupal 7. x SQL Injection exp (CVE-2 0 1 4-3 7 0 4)-vulnerability warning-the black bar safety net

| 1 | import urllib2,sys ---|--- 2 | from drupalpass import DrupalHash https://github.com/cvangysel/gitexd-drupalorg/blob/master/drupalorg/drupalpass.py ---|--- 3 | if lensys. argv != 4: ---|--- 4 | print "" ---|--- 5 | print "python 7.xSQL.py admin 1 2 3 4 5 6" ---|--- 6 | print "" ---|--- 7 |...

phpmywind水平权限漏洞一枚，可修改任意用户的任意资料包括密码

简要描述： phpmywind水平权限漏洞一枚，可修改任意用户的任意资料包括密码 详细说明： 经过简单审核发现phpmywind 存在一处任意用户资料更新漏洞包括密码 因为phpmywind的密码采用双md5加密,即使存在注入，也很难跑出密码，所以感觉注入漏洞危害性还不如密码重置这类的漏洞，这里我就验证下密码重置这个漏洞，其实是可以修改任意用户的所有资料信息。 出现逻辑问题的代码位于member.php的第601行，上下文分别是 //更新资料 elseif$a == 'saveedit' //检测数据完整性 if$password!=$repassword or$email==''...

Dropbox Denies Hack, Says 'Your Stuff is Safe'

Dropbox officials on Monday said that a large cache of usernames and passwords posted online and alleged to have come from the company’s users are not related to Dropbox customer accounts. A spate of media reports reported yesterday that attackers had stolen several million sets of credentials fr...

YXcms越权修改任意用户资料，获取任意用户密码

简要描述： YXcms建站系统修改用户资料时，对用户身份没有进行验证，导致越权操作 详细说明： 1、涉及版本YXcms1.2.6 2、下载地址：http://www.yxcms.net/ 系统演示地址：http://demo.yxcms.net/index.html 3、用户完善自己资料内容时，系统根据用户id在后台进行操作。但用户id的设置只是简单的数字，因此通过修改id，我们可以修改任意用户的资料信息。 漏洞证明： 1、登录系统，进入会员中心，在资料完善模块填写要修改的用户基本资料。 2、为了演示漏洞，我们注册了一个id为1的被攻击账户，抓包修改id为被攻击者的id，即为1。...

Cicada-known Enterprise Portal system v2. 5 sql injection to admin-vulnerability warning-the black bar safety net

The problem is when the user modifies the information of the place /system/module/user/control.php public function edit$account = " if!$ account or RUNMODE == 'front' $account = $this-app-user-account; if$this-app-user-account == 'guest' $this-locateinlink'login'; if! empty$POST...