PayPal Freezes $275,000 Campaign Funds of Secure-Email Startup 'ProtonMail'

ProtonMail, an End-to-End Encrypted email service developed by MIT, Harvard and CERN researchers, who already received over $275,000 from a crowdfunding campaigns to their PayPal account, and was so much excited to launch its beta version, but just before that PayPal freezes their account without...

Apple iPhone <= 2.2.1 Call Approval Dialog Security Bypass Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/35425/info Apple iPhone is prone to a security-bypass vulnerability that may cause a call to be placed automatically. Successfully exploiting this issue may allow attackers to bypass the Mail's call-approval dialog and...

Simple Forum PHP Multiple Vulnerabilities

No description provided by source. Exploit Title: Simple Forum PHP XSS/HTML Injection Vulnerabilities Date: August 25, 2010 Author: arnabs Software Link: http://www.simpleforumphp.com/forum/admin.php?act=topicoptions Price: $24.99 found bug on: http://server/demoguestbook.php?act=new details: you...

Apple iPhone <= 2.2.1 Call Approval Dialog Security Bypass Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/35425/info Apple iPhone is prone to a security-bypass vulnerability that may cause a call to be placed automatically. Successfully exploiting this issue may allow attackers to bypass the Mail's call-approval dialog and...

Apple iPhone <= 2.2.1 Call Approval Dialog Security Bypass Vulnerability (3)

No description provided by source. source: http://www.securityfocus.com/bid/35425/info Apple iPhone is prone to a security-bypass vulnerability that may cause a call to be placed automatically. Successfully exploiting this issue may allow attackers to bypass the Mail's call-approval dialog and...

ImgPals Photo Host 1.0 - Admin Account Disactivation

No description provided by source. -=--------------------ADVISORY-------------------=- ImgPals Photo Host Version 1.0 STABLE Author: Corrado Liotta Aka CorryL [email protected] -=-----------------------------------------------=- -=+ Application: ImgPals Photo Host -=+ Version: 1.0 STABLE -=+...

PHPLinks 2.1.2 Add Site HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6632/info phpLinks is prone to HTML injection. phpLinks does not sufficiently sanitized HTML and script code supplied via form fields before displaying this data to administrative users. This issue exists in the 'add.php'...

House Amendment Limits Funding for NSA Surveillance

The House of Representatives last night overwhelmingly passed an amendment to the Department of Defense Appropriations Act that would cut funding for two programs that grant intelligence agencies access to the private data and communications of U.S. citizens. The amendment shows that Congress is...

CVE-2014-3850

Cross-site request forgery CSRF vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to...

CVE-2014-3850

Cross-site request forgery CSRF vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to...

CVE-2014-3850

CVE-2014-3850 affects the WordPress Member Approval plugin (version 131109). The vulnerability is a Cross-Site Request Forgery (CSRF) that allows an attacker to hijack an administrator’s session and reset the plugin settings to defaults, effectively disabling registration approval via wp-admin/op...

WordPress Member Approval Cross Site Request Forgery

Details ================ Software: Member Approval Version: 131109 Homepage: http://wordpress.org/plugins/member-approval/ Advisory ID: dxw-1970-1172 CVE: CVE-2014-3850 CVSS: 5.8 Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N Description ================ CSRF in Member Approval 131109 permits unapproved...

某政府行政审批系统咨询处sql注入漏洞

简要描述： 女神是什么？ 详细说明： 关键词 inurl:/OnlineQuery/QueryDetail.aspx? 关键词仅供参考 部分网站不存在注入， 可能是版本的原因。 举几个例子 注入地址:http://shenpi.yuzhou.gov.cn/OnlineQuery/QueryDetail.aspx?QueryId=487 sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://www.sqlmap.org ! legal disclaimer: usage of sqlmap fo...

WordPress Member Approval Plugin <= 131109 - CSRF

Cross-site request forgery CSRF vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to...

Localize: XSS in invite approval

If a translator's name is set as “ and requests to join a project, and the project admin clicks on the review to accept it, it results in an xss. Screen: attacker/translator: http://prntscr.com/3ax1ca contributor/admin: http://prntscr.com/3ax1ix...

Localize: XSS & HTML injection

Link: http://www.localize.io/review/3C/languages/3 while approving and reviewing a phrase, you are able to send/set a message. You can XSS that by entering an XSS string String used: ? Screenshot: http://prntscr.com/3awo2p...

NSA Surveillance Reform Demonstrate Need for Public Scrutiny

The Snowden leaks and the ensuing critical spotlight shone on the National Security Agency’s surveillance programs have nudged many technologists, privacy hounds and politicians away from their desks and onto the front lines calling for reforms. Two nights ago, the New York Times reported that...

French intelligence agency gets complete access to Orange Telecom Data

Another leak from Edward Snowden files, but this time not about the NSA, rather the documents revealed that France's central intelligence agency, the DGSE has complete and unconditional access to all of telecom giant Orange’s data, not just metadata. Yes! It is the same Orange company who...

Discuz某处XSS劫持UC_KEY（XSS应用详细过程）

简要描述： Discuz某处XSS劫持UCKEY到拿webshell。 XSS应用的详细过程。 详细说明： 漏洞： 这个漏洞的位置在Discuz的门户功能处。 在发表文章时，打开“编辑源码”功能时，写入任意XSS CODE后，再进入和输出都没有过滤。导致存储型XSS。 大家都知道，这里的XSS虽然可以劫持到用户和管理的Cookies，但是没什么用，无法登陆。 那么，我们可以想办法拿XSS来干点其他的，比如劫持管理员后台内容，如UCKEY等。 门槛： 因为默认安装情况下这个门户功能是没有配置的。 所以管理员需要手动配置门户功能。大部分都会开启门户。...