Stanford Researchers Find Connecting Metadata With User Names is Simple

One of the key tenets of the argument that the National Security Agency and some lawmakers have constructed to justify the agency’s collection of phone metadata is that the information it’s collecting, such as phone numbers and length of call, can’t be tied to the callers’ names. However, some...

大汉通版jis统一身份认证系统漏洞打包

简要描述： 大汉通版jis统一身份认证系统漏洞打包，政府部门使用居多 详细说明： 大汉通版jis统一身份认证系统: 在用户修改信息时进行抓包发现 POST: http://10.11.5.201:9080/jis/front/upduserdo.jsp CONTENT:...

phpcms2008 preview.php injection EXP-vulnerability warning-the black bar safety net

phpcms2008 description Phpcms2008 is a paragraph based on PHP+Mysql architecture of the web content management system, it is an open-source PHP development platform. Phpcms uses a modular approach to the development, functional and easy to use to facilitate the expansion, for medium to large site...

XDCMS某处平衡权限漏洞可泄漏用户信息

简要描述： XDCMS订餐系统最新版，官方演示站某处平衡权限。 详细说明： XDCMS订餐系统最新版，官方演示站某处平衡权限。 可以查看任意用户订单，包括订单密码等用户敏感信息。 这是用户333333的订单260的信息： 然后登陆另一个用户444444，此用户名可以查看用户333333的订单信息： 再来看看444444用户看到的222号id的订单信息： 由于用户没有控制用户之间的权限问题，导致平衡权限，造成订单遍历。 由于没有刚放演示站的最新版代码，此处不做代码分析。 问题应该出在\system\modules\company\order.php的show函数处。 漏洞证明： 见详细信息...

Cupid Media Hacked, Plaintext Passwords Stolen

Hackers reportedly breached servers in January belonging to Cupid Media, a niche dating service with 30 million users, stealing more than 42 million unencrypted passwords and various other sensitive data. Cupid Media operates a variety of niche dating sites based on ethnicity, religion, physical...

Zikula CMS v1.3.5 - Multiple Web Vulnerabilities

Document Title: =============== Zikula CMS v1.3.5 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1114 Release Date: ============= 2013-10-15 Vulnerability Laboratory ID VL-ID: ==================================== 1114 Comm...

Woltlab Burning Board FLVideo Addon SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Woltlab Burning Board FLVideo Addon SQL Injection flvideo.php Exploit Google Dork: inurl:flvideo.php wbb and more Date: 04.09.2013 Exploit Author: Easy Laster Vendor Homepage: http://www.flvideo.de/ Version: FLVideo Addon for WB...

MGASA-2013-0262 Updated nagstamon package fixes security vulnerability

A user details information exposure flaw was found in the way Nagstamon performed automated requests to get information about available updates. Remote attackers could use this flaw to obtain user credentials for servers monitored by the desktop status monitor due to their improper base64...

[LinEnum] Scripted Local Linux Enumeration & Privilege Escalation Checks

High-level summary of the checks/tasks performed by LinEnum: Kernel and distribution release details System Information: Hostname Networking details: Current IP Default route details DNS server information User Information: Current user details Last logged on users List all users including uid/gi...

docomo overseas usage application vulnerability in the connection process

Overview docomo overseas usage application provided by NTT DOCOMO contains a vulnerability within the process of connecting to Wi-Fi access points, which may lead to user information being sent unintentionally. Impact When connecting to a Wi-Fi access point, an attacker may obtain user informatio...

JVN#44035194: docomo overseas usage application vulnerability in the connection process

docomo overseas usage application provided by NTT DOCOMO contains a vulnerability within the process of connecting to Wi-Fi access points, which may lead to user information being sent unintentionally. Impact When connecting to a Wi-Fi access point, an attacker may obtain user information. Soluti...

JavaScript and Timing Attacks Used to Steal Browser Data

LAS VEGAS–Security researchers have been warning about the weaknesses and issues with JavaScript and iframes for years now, but the problem goes far deeper than even many of them thought. A researcher in the U.K. has developed a new technique that uses a combination of JavaScript-based timing...

Ubuntu Forums Password Breach Exposes 1.8 Million Users

Every username, password and email address used by members of the Ubuntu Forums was accessed in a breach reported on Saturday by the free Linux distribution. More than 1.82 million accounts stored in the forums’ database were stolen, according to a notice posted on the forums’ home page Saturday...

Brute Force Attack on Club Nintendo Yields Info on 25K

Hackers executed a coordinated attack, hitting servers belonging to the popular gaming company Nintendo hard for nearly a month, resulting in the breach of information of nearly 25,000 gamers. The brute-force attack targeted Club Nintendo, a fan/membership site run by the Kyoto-based company. Fro...

JSON-RPC API functions available anonymously even though anonymous API access is disabled.

The summary says it all really. The functions listed below can be used on our confluence service even though we have Anonymous API Access disabled check box not checked in admin control panel. This is an issue when it comes to confluence sites that have sensitive user or group information...

KRBanker Malware Targeting Korean Financial Institutions

A recently discovered piece of malware called KRBanker Korea + Banker = KRBanker , targeting mostly online end-users at Korean financial institutions. According to nProtect, now an invasive banking Trojan, the new and improved KRBanker can block anti-virus software, security websites and even oth...

Facebook Patches Privacy Flaw in Pages Manager for Android

Facebook has plugged a privacy hole in its Pages Manager application for Android. Facebook Pages help businesses establish a presence on the social network, while the app enables an admin to manage posts, respond to comments and messages, push notifications to customers, manage photographs and...

Wei Feng network passport design defect,the presence of leakage of user privacy risk-vulnerability warning-the black bar safety net

Wei Feng network passport design defect, enter any one of the Wei Feng network registered user name, you can get the user registered email address and other private information Due to audience characteristics significantly, in the mobile Internet boom may have prompted some of thehackingmalicious...

Wi-Fi Spot Configuration Software vulnerability in the connection process

Overview Wi-Fi Spot Configuration Software provided by SoftBank contains a vulnerability within the process of connecting to Wi-Fi access points, which may lead to user information being sent unintentionally. Masashi Sakai reported this vulnerability to IPA. JPCERT/CC coordinated with the develop...

The horizon of a sub-Station back to bypass-vulnerability warning-the black bar safety net

The horizon of a sub-station in background to bypass leaked some user information! 1. Background privileges to bypass the http://younghainan.tianya.cn/admin888/left.aspx ban js Leaked some information on the Ah Pro! To thehackingto get the user information on what to do. There seemed to be...