Apple, Google to Testify at Smart Phone Tracking Hearing

After a bruising series of revelations about location tracking features on mobile devices running their operating systems, Apple and Google will send executives to Capitol Hill to talk to the Senate Judiciary Subcommittee on Privacy, Technology and the Law about cell phone privacy. Guy L. “Bud”...

Multiple SSH Initial Connection Requests (CVE-2003-0190; CVE-2006-5229; CVE-2016-6210)

Brute Force Attacks are a significant threat on users privacy. Using Brute Force, remote attackers attempt to gain access to unauthorized areas of a target system, such as FTP accounts, e-mail accounts and databases. By trying to repeatedly log in to an SSH server using different passwords, it is...

Facebook Flops On The Sale Of The User's Address, Telephone Numbers !!

Facebook made a rapid retreat Monday January 17 announcing that it would "temporarily" disable the functionality of a new brand that allows applications to third harvest phone numbers of users and home addresses. The function began with a blog Facebook quiet afternoon Friday, January 14. He said...

Privacy Crackdown Rattles Facebook Developers

Following an embarrassing expose in the Wall Street Journal, Facebook has tightened its controls over the ways in which applications that use the social networking platform can share unique user identity information or UIDs. The company also banned several applications accused of improperly...

Bug Count Just One Problem for Facebook Foe Diaspora

Saying that you want to take on the world’s biggest social network is the kind of thing that puts a big target on your back. At least that’s what the ambitious young crew behind Diaspora, an open source alternative to Facebook, found out this week. The Diaspora team pushed out an early as in...

CVE-2010-1617

user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page...

Privacy Tool Sidesteps Google's Data Collection

BOSTON — Privacy advocate Moxie Marlinspike used the spotlight of the SOURCE conference here to call attention to Google’s data harvesting practices, warning that the search engine giant can mine information to figure out even what Web surfers are thinking about. During a presentation that...

JVN#39157969 Third-party cookie issue in Opera

Opera contains an issue in which third-party cookies are not handled properly. Please note that this issue only occurs when the user changes the setting for "Accept only cookies from the site I visit" from the default installation of Opera. Impact A remote attacker may be able to trace an user's...

Traidnt UP 2.0 Blind SQL Injection

?php printr' || || | || o,7 || . o7 || q||| o///, : / / . /QQQQQQQQQQQQQQQQQQQ\ q Traidnt UP 2.0 Blind SQL Inj. /QQQ/\QQQ\ /QQQQQ/ \QQQQQQ\ q FILES 3 /QQQQ/ QQQQ\ /QQQQ/ \QQQQ\ q Magic Quotes == OFF! |QQQQ/ By Qabandi \QQQQ| |QQQQ| |QQQQ| |QQQQ| From Kuwait, PEACE... |QQQQ| |QQQQ| |QQQQ| |QQQQ...

Twitter needs a top-down security rethink

Twitter co-founder Biz Stone says the company “takes security very seriously” but the details behind the micro-blogging site’s recent hack shows that Twitter is light years away from having the most basic security controls in place. French hacker gains access to Twitter’s admin panel Here’s the...

Restrict anonymous users from viewing user profiles.

Even if I start Confluence with -Dconfluence.disable.peopledirectory.anonymous=true, it is still possible to browse individual users by visiting a URL like https://wikiBaseUrl/display/accountName. This is a major security problem for us because it exposes: 1. The user's name 2. The user's ID 3. T...

CVE-2008-3451

PhpWebGallery 1.7.0 and 1.7.1 are affected by CVE-2008-3451. Remote authenticated users with advisor privileges can obtain real e-mail addresses of other users by editing the target user’s profile. The NVD records a CVSS2 base score of 4.0 (Medium) with network attack vector and low complexity, h...

skyportal-multi.txt

WwW.BugReport.ir BugReport Security Research & Penetration Testing Group Title: Sky Portal Multiple SQL Injection Vulnerabilities Vendor: http://skyportal.net Exploitation: Remote with browser Fix Available: Patched In Last Version In Vendor Leaders : Shahin Ramezany & Sorush Dalili Team Members:...

skyportal vrc6 - Multiple Vulnerabilities

skyportal vrc6 - Multiple Vulnerabilities WwW.BugReport.ir BugReport Security Research & Penetration Testing Group Title: Sky Portal Multiple SQL Injection Vulnerabilities Vendor: http://skyportal.net Exploitation: Remote with browser Fix Available: Patched In Last Version In Vendor Leaders :...

skyportal vrc6 - Multiple Vulnerabilities

WwW.BugReport.ir BugReport Security Research & Penetration Testing Group Title: Sky Portal Multiple SQL Injection Vulnerabilities Vendor: http://skyportal.net Exploitation: Remote with browser Fix Available: Patched In Last Version In Vendor Leaders : Shahin Ramezany & Sorush Dalili Team Members:...

People Directory search can be misused to retrieve email addresses of all users

Even when email addresses should be hidden because of global settings, it is possible to retrieve email addresses of all the users in the system by misusing search in people directory. It seems that the email address is one of the attributes that are being indexed by the search engine. So if one...

Security Best Practice: Protect Yourself against FTP Brute Force Attacks

The File Transfer Protocol FTP is used to connect computers over the Internet enabling file transferring between their users. FTP Brute Force Attacks are a common threat on vulnerable systems. Brute Force Attacks are a significant threat on users? privacy. Using Brute Force, remote attackers...

Multiple browsers information leaks

Server can find pages visited by user by using, e.g., different background pages for "visited" elements...

CVE-2006-6480

admin/adminmembre/fichemembre.php in AnnonceScriptHP 2.0 allows remote attackers to obtain sensitive information via the idmembre parameter, which discloses the passwords for arbitrary users...

Invision Community Blog Mod 1.2.4 SQL Injection Vulnerability

No description provided by source. 1. Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string input type='hidden' name='eid' value='BLOGENTRYID' / 6. Change BLOGENTRYID with this S...