WordPress O2Tweet 0.0.4 CSRF / XSS

Title: CSRF/XSS Vulnerability in O2Tweet WP Plugin Author: Manideep K CVE -ID: CVE-2014-9338 Plugin Homepage: https://wordpress.org/plugins/o2tweet/ Version Affected: 0.0.4 probably lower versions Severity: High Description: Vulnerable Parameter: o2tusername, o2ttags etc About Vulnerability: This...

Mikiurl WordPress Eklentisi 2.0 CSRF / XSS

Title: CSRF/XSS Vulnerability in Mikiurl WordPress Eklentisi WP Plugin Author: Manideep K CVE -D : CVE-2014-9337 Plugin Homepage: https://wordpress.org/plugins/mikiurl-wordpress-eklentisi/ Version Affected:2.0 probably lower versions Severity: High Description: Vulnerable Parameter:...

IRCCloud: Unvalidated Channel names causes IRC Command Injection

IRCCloud does not validate the channel names created by a user causing it to be parsed as an IRC command such as QUIT. This means the user can have their clients force-closed by a malicious channel name. This could also lead to other command injections such as forcing the handover of channels to...

Category Page Icons <= 0.9.1 - Arbitrary File Upload/Deletion via Path Traversal

v0.9.2 added a check to not allow direct access to the affected file. However the path traversal was not fixed Plugin has been closed from repository. PoC Choose File to upload : Directory :...

UserPreferencesResource accepts form encoded data, is vulnerable to XSRF attacks

UserPreferencesResource exposes all data stored in a UserPreferences object, and allows updating it via a POST. This vulnerability needs to be closed before the next deployment...

dovecot security update

Package : dovecot Version : 1:1.2.15-7+deb6u1 CVE ID : CVE-2014-3430 Debian Bug : 747549 It was discovered that the Dovecot email server is vulnerable to a denial of service attack against imap/pop3-login processes due to incorrect handling of the closure of inactive SSL/TLS connections...

curl, libcurl security update

CentOS Errata and Security Advisory CESA-2014:0561 Updated curl packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System...

[SECURITY] Fedora 19 Update: php-ZendFramework2-2.2.6-1.fc19

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...

CVE-2011-5268

connection.c in Bip before 0.8.9 does not properly close sockets, which allows remote attackers to cause a denial of service file descriptor consumption and crash via multiple failed SSL handshakes, a different vulnerability than CVE-2013-4550. NOTE: this issue was SPLIT from CVE-2013-4550 becaus...

Possible Credit Card Theft in Steam Website Hacking

Possible Credit Card Theft in Steam Website Hacking Valve CEO Gabe Newell has contacted all users of the Steam game distribution platform to let them know that the company has suffered a security breach. Right before going offline, users saw a new category in the forum that directed them to open ...

Alerts are not closed automatically in SCOM

This article addresses troubleshooting for the following problem: "Alerts are not closed automatically in SCOM."...

#OpPayPal - Anonymous calls for boycott of PayPal for blocking Wikileaks

OpPayPal - Anonymous calls for boycott of PayPal for blocking Wikileaks The Latest Operation could be a major departure into legal direct action for Anonymous, LulzSec and AntiSec. If so, this is one to watch with great interest. The campaign marks something of a departure for LulzSec and...

Thousands Of Bank Details At Risk As Hackers Hit Lozano UK Site !

Hackers can obtain the bank details of thousands of customers in a lush, a cosmetics company acknowledged yesterday. The company invites all our customers who have purchased products online during the month of October to check fraud. To date, 43 customers had their cards are used tricks. Thieves...

[security bulletin] HPSBMA02624 SSRT100195 rev.1 - HP LoadRunner, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02680678 Version: 1 HPSBMA02624 SSRT100195 rev.1 - HP LoadRunner, Remote Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted upon as soon as possible...

Проект WH+WHB закрыт

http://forum.web-hack.ru/ Цитата: Проект WH+WHB закрыт Всем привет! 21 ноября форуму WHB исполнилось 8 лет, а у сайта давно пошел уже девятый год. Это достаточно большой срок для проекта в Рунете, особенно данной тематики. В связи с ДР я и выбрал такую дату - дату для закрытия проекта в целом. За...

Spam Volume Is Way Down…But Why?

The volume of spam e-mail is down…way down. That’s the good news. But experts aren’t exactly sure what’s caused the precipitous drop in spam e-mail or how long it will last. As Brian Krebs reports on his blog, mail security firm M86 is seeing a 40% decline in spam volume since the beginning of...

Satanic Socks Server: RDot edition

Satanic Socks Server - sss.c v0.66 by drmist/STNC mod for rdot.org v1.1 Отличия от Satanic Socks Server v0.66.170506 sss.c by drmist\STNC: -убрана поддержка windows +добавлено ограничение на подключения только с заданного IP +маскировка списке процессов +режим агрессивного закрытия отработавших...

Vulnerability: be wary of“help and Support Center”uninvited-vulnerability warning-the black bar safety net

Microsoft has just released 6 months patch, Windows XP it also exposed a new HCP Protocol vulnerabilities. After 3 6 0 Security Center to verify, when the Windows XP users use IE series browsers open hung it to the web, or playing“the infected”of the music file, the PC will automatically...

SAP Kernel 'sapstartsrv'拒绝服务漏洞

Bugraq ID: 37286 在SAP实例中，sapstartsrv服务提供WEB SAP管理控制接口用于远程管理。由于不正确处理特殊构建的请求，远程攻击者可以利用漏洞使进程关闭。 成功利用漏洞允许远程攻击者对SAP管理控制台进行拒绝服务攻击，导致SAP管理控制台拒绝访问，进行任何管理操作。 SAP Kernel 7.20 SAP Kernel 7.11 SAP Kernel 7.01 SAP Kernel 7.00 SAP Kernel 6.40 SAP Note 1302231已经提供安全补丁，建议用户参考下载： http://www.sap.com/...

CVE-2007-4373

The server in Babo Violent 2 2.08.00 and earlier does not properly implement password protection, which might allow remote attackers to bypass authentication by reconnecting after a connection closes...