Woman Sues LinkedIn for $5 Million Over Data Breach

Less than two weeks after learning more than 6 million stolen LinkedIn passwords were posted online, an Illinois woman is leading a class-action lawsuit against the professional networking site for using inadequate security tools to protect its members’ data. Katie Szpyrka, who registered for a...

Simple Document Management System 1.1.5 - Multiple SQL Injections

Simple Document Management System 1.1.5 - Multiple SQL Injections source: https://www.securityfocus.com/bid/54043/info Simple Document Management System is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an...

Joomla! Component Joomsport - SQL Injection Arbitrary File Upload

Joomla! Component Joomsport - SQL Injection Arbitrary File Upload source: https://www.securityfocus.com/bid/53944/info The Joomsport component for Joomla! is prone to an SQL-injection vulnerability and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data...

Last.fm, Mum On Breach, Adopts 'More Rigorous' Password Security

Last.fm, the online music streaming service, said it has implemented ‘more rigorous’ security for customer account passwords in the wake of reports that some of those passwords had been leaked online. In a post on the company’s Website, Last.fm said that its investigation of reports that hashed o...

Multi Gather Skype User Data Enumeration

This module will enumerate Skype account settings, contact list, call history, chat logs, file transfer history, and voicemail logs, saving all the data to CSV files for analysis. This module requires Metasploit: https://metasploit.com/download Current source:...

shopxp online shopping system v7. 4 SQL injection vulnerability-vulnerability warning-the black bar safety net

Keywords: inurl:shopxpnews. asp Injected code: TEXTBOX2. ASP? action=modify&news%69d=1 2 2%20and%2 0 1=2%20union%20select%201,2,admin%2bpassword,4,5,6,7%20from%20shopxpadmin Broke the user name and password note: username and password are connected together, after the sixth bit is the password MD...

WHMCompleteSolution (WHMCS) - boleto_bb.php SQL Injection

WHMCompleteSolution WHMCS - boletobb.php SQL Injection source: https://www.securityfocus.com/bid/53711/info WHMCS WHM Complete Solution is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue...

BBSXP CMS - Multiple SQL Injections

source: https://www.securityfocus.com/bid/53298/info BBSXP CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the applicatio...

'/users/userpicker.action' exposes users loginids and full names in instance with anonymous access enabled

quote LDAP directory users and groups exposed via the /users/userpicker.action. There should be an option to restrict this to authenticated users only and perhaps this should be the default behavior. quote quote The second exposed function that is part of this vulnerability is...

Joomla! Component CCNewsLetter 1.0.7 - 'id' SQL Injection

source: https://www.securityfocus.com/bid/53208/info The CCNewsLetter module for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the applicatio...

Invision Power Board 3.3/3.2.3 本地文件包含漏洞

Bugtraq ID: 52998 CVE ID：CVE-2012-2226 Invision Power Board是一款基于PHP的论坛程序 Invision Power Board多个脚本不正确过滤用户提交的输入，攻击者可以利用漏洞提交恶意请求包含本地文件，获得敏感信息 0 Invision Power Board 3.3 Invision Power Board 3.2.3 厂商解决方案 Invision Power Board ----- 用户可参考如下供应商提供安全公告获得补丁信息：...

Invision Power Board 3.3.0 - Local File Inclusion

Invision Power Board 3.3.0 - Local File Inclusion waraxe-2012-SA086 - Local File Inclusion in Invision Power Board 3.3.0 ======================================================================== ======= Author: Janek Vind "waraxe" Date: 12. April 2012 Location: Estonia, Tartu Web:...

GENU CMS SQL Injection

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- GENU CMS SQL Injection Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- bug found by h0rd h0rdatnull.net homepage http://h0rd.net download http://www.gnew.fr/pages/download.php?file=GENU-2012.3.tar.gz vulnerability in read.php vuln code:...

e-ticketing SQL Injection (CVE-2012-1673)

Exploit for php platform in category web applications 'e-ticketing' SQL Injection CVE-2012-1673 Mark Stanislav - email protected I. DESCRIPTION --------------------------------------- A vulnerability exists in loginscript.php that allows for SQL injection of the 'username' and 'password' POST...

SA-CONTRIB-2012-042 - Wishlist Cross Site Scripting (XSS)

CVE: CVE-2012-2069 The Wishlist Module allows users to maintain shared wishlists for special events and holidays. Impact: The module doesn't sufficiently filter user supplied text from the URL. This can be used to perform a reflected cross site scripting XSS attack. User account credentials could...

F5 FirePass 7.0 - SQL Injection

F5 FirePass 7.0 - SQL Injection source: https://www.securityfocus.com/bid/52653/info FirePass is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the...

TP-Link TL-WR740N 111130 - ping_addr HTML Injection

TP-Link TL-WR740N 111130 - pingaddr HTML Injection source: https://www.securityfocus.com/bid/52424/info TP-LINK TL-WR740N is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or script code could run in the context of the...

SAP Business Objects InfoVew System - listing.aspx?searchText Cross-Site Scripting

SAP Business Objects InfoVew System - listing.aspx?searchText Cross-Site Scripting source: https://www.securityfocus.com/bid/52361/info SAP Business Objects is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may...

Hacker Group Breaches Library of Congress Site, Publishes Passwords

A group of hackers claims to have breached the official website of the Library of Congress, America’s national library. The group claiming responsibility, BlitzSec, decried the wildly unpopular US Congress and said it used a SQL injection attack to access the Library of Congress Website’s back en...

Etano 1.20/1.22 - 'photo_search.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/52295/info Etano is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...