Max.Blog <= 1.0.6 (show_post.php) SQL Injection Vulnerability

No description provided by source. Salvatore drosophila Fresta Application: Max.Blog http://www.mzbservices.com Version: Max.Blog = 1.0.6 Bug: SQL Injection Exploitation: Remote Dork: intext:Powered by Max.Blog Date: 20 Jan 2009 Discovered by: Salvatore drosophila Fresta Author: Salvatore...

CVE-2014-3281

The web framework in VOSS in Cisco Unified Communications Domain Manager CDM does not properly implement access control, which allows remote attackers to obtain potentially sensitive user information by visiting an unspecified BVSMWeb web page, aka Bug IDs CSCun46071 and CSCun46101...

CVE-2014-3281

CVE-2014-3281 affects Cisco’s VOSS web framework in the Unified Communications Domain Manager (CDM). The issue is an improper access control vulnerability that could allow remote attackers to view potentially sensitive user information by accessing an unspecified BVSMWeb page (Bug IDs CSCun46071/...

Direct Object Reference - User Information Disclosure

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-46864. panel A direct object reference vulnerability exists on the answers.atlassian.com platform which allows for malicious...

Direct Object Reference - User Information Disclosure

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-46864. panel A direct object reference vulnerability exists on the answers.atlassian.com platform which allows for malicious use...

Direct Object Reference - User Information Disclosure

A direct object reference vulnerability exists on the answers.atlassian.com platform which allows for malicious users to obtain the email address of any given ID. Additionally since the ID's are incremental, it would be possible for an attacker to gain the email addresses of every single Atlassia...

Design/Logic Flaw

Unspecified vulnerability in the Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to discover user names, full names, and e-mail addresses via a search...

CVE-2013-3975

IBM Sametime Meeting Server (IBM Lotus Notes Sametime) contains an information-disclosure vulnerability that lets remote attackers enumerate user identities (usernames, full names, and e-mail addresses) via a search on the web interface. Affected products/versions: IBM Sametime 8.x up to 8.5.2.1 ...

CVE-2011-2513

The Java Network Launching Protocol JNLP implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to obtain the username and full path of the home and cache directories by accessing properties of the ClassLoader...

Bitly Developing Two Factor Authentication Following Compromise

The link-shortening service Bitly announced late last week that it’s ramping up its development of two-factor authentication following a compromise that leaked user information on Thursday. The breach, first discovered Thursday morning, spilled users’ email addresses, encrypted salted and hashed...

mcms手机建站之星任意用户信息(包括密码)修改(不包括管理员)

简要描述： mcms手机建站之星任意用户信息包括密码修改，可惜不能改管理员。 详细说明： 文件 plugin/gov.user/index.php 188行 function medit global $dbm; $params = array; if !isnumeric$POST'userid' die'"code":"210","msg":"会员UID必须是数字"'; // 验证会员信息是否合法 if empty$POST'uname' die'"code":"210","msg":"会员名不能为空"'; //if empty$POST'pro'...

With a Warning FTC Approves WhatsApp, Facebook Union

Facebook’s acquisition of messaging application WhatsApp was approved by the Federal Trade Commission late last week, but not without a stern notice from the agency, which warned that it would be keeping a watchful eye on the two companies going forward. In a letter addressed to officials at...

yungoucms system latest SQL injection-vulnerability warning-the black bar safety net

Official website : http://www.yungoucms.com/ demo site: http://www.yungoucms.cn/ Product search you can build a SQL statement that is! http://www.yungoucms.cn/?/stag/ publicfunction tag $search =$this-segment4; if!$ searchmessage"enter search keyword"; $search = urldecode$search; $search =...

Government Requests for Google User Data Continue to Climb

While the number of requests for user information that Google receives from governments around the world continues to rise–climbing by 120 percent in the last four years–the company is turning over some data in fewer cases as time goes on. Google received more than 27,000 requests for user...

Kentico CMS 7.0.75 - User Information Disclosure

Exploit for asp platform in category web applications This vulnerability is an unprotected page on the site where you can view all current users and usernames. To find out if a Kentico CMS is vulnerable go to http://site.com/CMSModules/Messaging/CMSPages/PublicMessageUserSelector.aspx assuming th...

Privacy Groups Seek to Halt Facebook Acquisition of WhatsApp

The appeal of WhatsApp, the cross-platform mobile messaging app recently acquired by Facebook for a stunning $19 billion price tag, was that it kept to its promise of not collecting user information that would be converted to ad revenue. The acquisition by Facebook, however, likely changes that...

Meetup.com Back Online After DDoS Attacks, Extortion

Social networking site Meetup.com is finally back online today, yet officials at the site are warning it could still face future outages following a series of sustained distributed denial of service attacks DDoS over the weekend. Meetup is a social networking portal that allows individuals with...

phpBB viewtopic.php URL Decoding Code Execution - ver 2 (CVE-2004-1315)

A code injection and execution vulnerability has been reported in phpBB. The vulnerability is due to lack of input validation on the highlight parameter supplied to viewtopic.php. A remote attacker can exploit this issue by injecting malicious SQL code to the target server. Successful exploitatio...

RSA Conference Mobile App Vulnerable

The official mobile application for the ongoing RSA Conference contains a half-dozen security vulnerabilities, according to an analysis performed by researchers from the security service provider IOActive. IOActive chief technical officer Gunter Ollmann claims the most severe of the vulnerabiliti...

JVN#71045461: Cybozu Garoon vulnerable to SQL injection

Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an issue in the process of downloading files, which may result in SQL injection. Impact A user who can log in to the system may obtain or alter information on the system. Solution For Cybozu Garoon 3.7: Apply the Patch...