Joomla! Component JVideoClip 1.5.1 - 'uid' SQL Injection

source: https://www.securityfocus.com/bid/62610/info The JVideoClip component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

PHP168 a magical loophole, you can query any user data-bug warning-the black bar safety net

Brief description: Country micro-PHP168 appeared a magic array, can cause the whole station to the user data leakage. The leaked content includes total Station user passwords in cipher text, email, password, salt, IP and other sensitive information. Detailed description: PHP168 program...

[OS X Auditor] free Mac OS X computer forensics tool

OS X Auditor parses and hashes the following artifacts on the running system or a copy of a system you want to analyze: the kernel extensions the system agents and daemons the third party's agents and daemons the old and deprecated system and third party's startup items the users' agents the user...

Google, Facebook, Yahoo File NSL Transparency Motions

Google, Yahoo and Facebook filed amended requests today with the U.S. Foreign Intelligence Surveillance Court FISC reiterating their desire to publish numbers on requests for user data related to national security. Google, meanwhile, went a step further asking for an open, public hearing with the...

Yahoo Transparency Report Reveals More Than 12K U.S. Government Data Requests

Following the lead of Google, Twitter and other major Internet companies, Yahoo has issued its first transparency report, revealing that it received more than 12,000 requests for user data from the U.S. government in the first half of 2013. The company disclosed user content in nearly a third of...

Multiple Vulnerabilities in X2CRM

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in X2CRM, which can be exploited to include arbitrary local files and execute arbitrary PHP code, as well as to perform Cross-Site Sripting XSS attacks against users of vulnerable application. 1 PHP File Inclusion in X2CRM...

UBUNTU-CVE-2013-3374

Unspecified vulnerability in Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information user preferences and caches via unknown vectors, related to a "limited session re-use."...

Microsoft Fixes ASLR/DEP Bypass Bug

Buried in the details of the Microsoft Patch Tuesday release for August is the explanation of an important change that the company made to Windows that defeats a group of exploit mitigation bypasses. The change is a small one, but it prevents dangerous attacks that previously worked on most...

Cisco Finesse User Data in Query Vulnerability

A vulnerability in HTTP queries of Cisco Finesse could allow an unauthenticated, remote attacker to collect potentially sensitive user data. The vulnerability is due to insecure transmission of user data in an HTTP query. An attacker could exploit this vulnerability by capturing the HTTP query...

German Video Game 'Crytek' Websites go offline after Security Breach

It seems that German Video Game company 'Crytek' has been the latest victim of hacking attacks on its website and few forums, and caused Crytek's family of websites to go offline. According to the company, "Our Crytek.com, Mycryengine.com, Crydev.net and MyCrysis.com sites were all subject to a...

SEA Hacks Messaging App Tango, Leaks User Information

The Syrian Electronic Army SEA reportedly hacked into a database belonging to the free messaging and video sharing app Tango over the weekend, potentially compromising millions of users’ information. The SEA – a group of hackers that attacks websites to spread pro-Bashar al-Assad propaganda –...

Ubuntu Forums hacked; 2 million user's personal Information compromised

Ubuntuforums.org, The popular Ubuntu Forums site, has posted a message on its index page, informing its near 2 million users that it has suffered a serious security breach. "There has been a security breach on the Ubuntu Forums," reads the page. The site was defaced by hacker with Twitter handle...

Zoho Information Disclosure / Mixed Content

ZOHO INTERNAL INFORMATION DISCLOSURE Content type is not specified /INSECURE TRANSITION FROM HTTP TO HTTPS IN FORM ================================================================================================================================================== Report-Timeline: ================...

Google, Microsoft Seek Help in Lifting FISA Gag Order

Google and Microsoft have locked arms with a number of civil liberties advocates in filing a brief with the secret Foreign Intelligence Surveillance Court hoping to lift a gag order preventing the two tech giants from releasing information on their role in the NSA’s surveillance activities. To...

[waraxe-2013-SA#105] - Multiple Vulnerabilities in Spider Catalog Wordpress Plugin

waraxe-2013-SA105 - Multiple Vulnerabilities in Spider Catalog Wordpress Plugin =================================================================================== Author: Janek Vind "waraxe" Date: 22. May 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-105.html Description of...

WordPress Plugin WP Private Messages - msgid SQL Injection

WordPress Plugin WP Private Messages - msgid SQL Injection source: https://www.securityfocus.com/bid/60854/info WP Private Messages plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query...

Stolen Opera Code-Signing Certificate Used to Sign Malware

Opera Software said it was able to contain the impact of a security breach that resulted in the theft of an expired code-signing certificate used to sign malware distributed to Windows users during a 36-minute stretch on June 19. Opera developer Sigbjorn Vik said the browser maker was victimized ...

Google Adds Phishing, Malware Info to Transparency Report

Google divulged new statistics today about its Safe Browsing program, a service it uses to flag websites it suspects of peddling malware and phishing. According to the numbers, most of the “unsafe website” warnings it pushes to users on Google Search and in browsers, stem from malware and not...

Elemata CMS RC3.0 - global.php?id SQL Injection

Elemata CMS RC3.0 - global.php?id SQL Injection Exploit Title : Elemata CMS RC3.0 SQL Injection Date : 23 June 2013 Exploit Author : CWH Underground Site : www.2600.in.th Vendor Homepage : http://www.elemata.com/ Software Link :...

Elemata CMS RC3.0 - 'global.php?id' SQL Injection

Exploit Title : Elemata CMS RC3.0 SQL Injection Date : 23 June 2013 Exploit Author : CWH Underground Site : www.2600.in.th Vendor Homepage : http://www.elemata.com/ Software Link : http://jaist.dl.sourceforge.net/project/elematacms/Elemata%203.x/ElemataRC3.0.zip Version : RC 3.0 Tested on : Windo...