Crypto Pioneers Write Letter on NSA Surveillance to Obama

Perhaps the biggest condemnation of President Obama’s address last Friday announcing reforms to the NSA’s surveillance programs was his failure to mention any of the agency’s alleged involvement in subverting cryptography standards and the impact that has had on the trustworthiness of products...

EC-CUBE vulnerable to authorization bypass

Overview EC-CUBE contains an authorization bypass vulnerability. EC-CUBE from EC-CUBE CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an authorization bypass vulnerability CWE-639. The developer reported this vulnerability to JPCERT/CC under Information Security...

PT-2014-3854 · Ec Cube · Ec-Orange +1

Name of the Vulnerable Software and Affected Versions: EC-CUBE versions 2.11.0 through 2.12.2 EC-Orange systems deployed before June 29th, 2015 Description: An issue exists where a user-controlled key can be used to bypass authorization. This can be exploited by sending a crafted HTTP request,...

Starbucks mobile application information leakage

Insecure user data storing...

Private Messaging App Vendor Wickr Offers Hackers $100,000 for Bugs

Bug bounty programs, for the most part, have been the domain of large software vendors and Web companies such as Google, Mozilla, Microsoft, PayPal and Facebook. But some smaller companies are now getting involved, with the latest one to announce a bounty being Wickr, the maker of secure messagin...

Starbucks 2.6.1 Information Disclosure

Title: CVE-2014-0647 Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application Published: January 13, 2014 Reported to Vendor: December 2013 no direct response CVE Reference: CVE-2014-0647 Credit: This issue was discovered by Daniel E. Wood...

Cybozu Garoon Keitai vulnerable to authentication bypass

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon Keitai contains an authentication bypass vulnerability. Impact When an attacker sends a specially crafted request that includes a user ID for a user that has the Keitai function enabled, authentication using Keitai may b...

ShopEx某些服务器存在任意代码执行漏洞(可泄漏用户交易数据)

简要描述： 可执行命令，查看源码！ 详细说明： php cgi漏洞 http://shop322763.p13.shopex.cn/ 漏洞证明： http://shop322763.p13.shopex.cn/?-s http://shop319398.p09.shopex.cn/?-s http://shop317459.p21.shopex.cn/?-s 尝试执行PHP代码，虽然有openbasedir，disablefunctions的限制，不过我能直接CGI方式给PHP传参，这些限制自然不在话下，bypass之。 影响的用户太多了，厂商还是自查吧。。。...

Government Requests for Google Data Continue to Rise

The volume of government requests to Google for user data is continuing to increase, something that should come as no surprise in the current climate. In its latest transparency report, the company said that it received more than 25,000 requests for user data in the first six months of 2013, an...

iScripts MultiCart 2.4 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Cross-Site Scripting / Cross-Site Request Forgery / Mass Accounts Takeover

Exploit Title : iScripts MultiCart same product id for which you submited the review. Cross-site request forgery input type...

PlaySMS <= 0.9.9.2 - CSRF Vulnerability

Exploit for php platform in category web applications Playsms is an open source SMS managment system , suffers from Cross-site request forgery through which attacker can manipulate user data via sending him malicious craft url. Playsms is not using any security token to prevent it against CSRF.Yo...

PlaySms 0.9.9.2 - Cross-Site Request Forgery

PlaySms 0.9.9.2 - Cross-Site Request Forgery Exploit Title : PlaySMS input type=hidden size=10 maxlength=10 name=up...

PlaySMS 0.9.9.2 Cross Site Request Forgery

Exploit Title : PlaySMS...

Nearly 2000 Sites Vulnerable to Ruby on Rails Cookie Problem

A lingering security issue in Ruby on Rails that stems from a setting in the framework’s cookie-based storage mechanism is still present in almost 2,000 websites. Sites using an old version of Ruby on Rails that relies on CookieStore, the framework’s default cookie storage mechanism, are at risk...

U.S. Government Requests for Google User Data Doubled Since 2010

In the first six months of this year, Google received seven wiretap orders from the United States government and complied with all of them. The company also received 207 pen register requests in the same period and complied with 89 percent of them, according to Google’s new transparency report. T...

Apple Says It Has 'Never Received an Order Under Section 215'

In a new report detailing the number and kind of requests for user information it’s gotten from various governments, Apple said it has never received a request for information under Section 215 of the USA PATROT Act and would likely fight one if it ever came. The company also disclosed that it ha...

JReport Cross Site Request Forgery

================================================================================================================================================================ JREPORT Cross Site Request Forgery Vulnerability...

WHMCS 5.2.8 SQL Injection Vulnerability (0day)

dork:- inurl:submitticket.php site:.com inurl:submitticket.php site:.net inurl:submitticket.php site:.us inurl:submitticket.php site:.eu inurl:submitticket.php site:.org inurl:submitticket.php site:.uk intext:"Powered by WHMCompleteSolution" intext:"Powered by WHMCompleteSolution"...

Unnamed Android Vulna Ad Library Abused to Steal User Data

A popular Android mobile ad library available on Google Play can be used to collect device data or execute malicious code, security researchers have discovered. The most alarming aspect to the library is that close to 2 percent of Android apps with more than 1 million downloads on Google Play use...

PHP168 explosion vulnerability, you can query any user data-bug warning-the black bar safety net

PHP168 program built-in“user”module contains the user profile display page. In many practical scenarios, this page is not the front Desk use, but can be directly through the URL access. Page routing is:/homepage.php/username/member-profile To PHP168 official demo site, for example, to view any us...