Slack: Team admin can change unauthorized team setting (require_at_for_mention)

Team admin can escalate his privileges and change 'requireatformention' team setting, which can be changed only by a team owner. Steps to reproduce: 1. Log in as team admin 2. Send the below request using his token and notice that it changes 'requireatformention' setting to true. POST...

Twitter Files Suit Over Government Restrictions on National Security Letter Data

Twitter has filed a lawsuit in federal court asking that the United States Department of Justice’s prohibitions on publishing the number and kind of government requests for data the company receives be declared unconstitutional. The suit claims that the rules infringe on Twitter’s right to free...

Люди готовы "на всё" ради бесплатного WiFi

Специалисты из компаний F-Secure, Британского института по информационной безопасности и немецкой компании SySS провели совместное исследование, насколько обычные пользователи готовы подключаться к бесплатному хотспоту, даже если это подключение представляет потенциальную опасность. Для проверки,...

China merchants Bank online banking orientation xss through kill web, PC client and mobile APP can be directed to steal information phishing stallion-the vulnerability warning-the black bar safety net

Brief description: China merchants Bank online banking somewhere storage typexss, the web version, PC client, mobile client are affected. Not dare to use online banking.. Detailed description: The following is the client doing the test China merchants Bank online banking self-service transfer...

Square: Editing Client Details of other People

Hi there, I have found out that there is no "authorization" in which prohibits a user to modify client's data of other users. As per sample I have two2 accounts: One freebie account and One subscribed account Monthly The freebie account has a Client with ID : f42b88d1af62f0a9d240024e83690174. Tha...

GAO Shipping Port Cybersecurity Report

The U.S. Department of Homeland Security, Coast Guard and Federal Emergency Management Agency FEMA have been taken to the woodshed in a General Accounting Office GAO report on maritime cybersecurity. The GAO said the response to mandates to improve computer security efforts to protect the network...

Snes9x 1.3 - Local Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3437/info Snes9x is a free Super Nintendo emulator that runs on a number of platforms. Snes9x is prone to a buffer overflow. This is due to improper bounds checking of rom names. In this case, 4089 characters are required...

Adobe RoboHelp Server 8 Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/36245/info Adobe RoboHelp Server is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to upload and execute arbitrary code with SYSTEM-level privileges. RoboHelp Server 8.0 is affected;...

phpCOIN 1.2.2 includes/db.php $_CCFG[_PKG_PATH_DBSE] Parameter Traversal Arbitrary File Access

No description provided by source. source: http://www.securityfocus.com/bid/15831/info PhpCOIN is prone to a file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary remote PHP...

BS.Player 2.51 - '.mp3' File Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/38568/info BS.Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Attackers may leverage this issue to execute arbitrary code in the context of th...

FuseTalk <= 4.0 forum/include/common/comfinish.cfm FTVAR_SCRIPTRUN Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/24563/info FuseTalk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal cookie-based...

Siemens Simatic S7-1200 CPU START/STOP Module

No description provided by source...

Summit Computer Networks Lil' HTTP Server 2 URLCount.CGI HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5115/info Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks. Reportedly, Lil' HTTP Server is vulnerable to HTML injection attacks. The vulnerability is...

SalesLogix Corporation eViewer 1.0 DoS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1089/info SalesLogix eViewer is a web application integrated with the SalesLogix 2000 package. eViewer will not perform authorization on administrative commands if they are requested directly in the URL. Therefore, the UR...

Phorum 3.4.x Message Form Field HTML Injection Variant Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7545/info An HTML injection issue has been reported which may lead to unauthorized code execution. It has been reported that it is possible to inject HTML or script code into the subject and other fields of a message in...

MyWebServer 1.0.2 Search Request Remote Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5469/info MyWebServer is an application and web server for Microsoft Windows operating systems. MyWebServer includes a number of web based functions, including a search engine. MyWebServer suffers from a remote buffer...

Microsoft IIS 4.0,Microsoft JET 3.5/3.5.1 Database Engine VBA Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/286/info Microsoft's JET database engine feature allows the embedding of Visual Basic for Application in SQL string expressions and the lack of metacharacter filtering by many web applications may allow remote users to...

HP-UX 10/11 NLSPATH Environment Variable Format String Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/8985/info HP-UX allows the NLSPATH to be set for setuid root programs, which use catopen3C and may be executed by other local users. This could result in privilege escalation as an attacker could specify an arbitrary path...

W1L3D4 WEBmarket 0.1 - Remote SQL Injection Vulnerability

No description provided by source. /////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Title : W1L3D4 WEBmarket v0,1 SQL Injection Vuln Author : CrackersChild Contact : [email protected] Bug : in urunbak.asp Do...

Irssi <= 0.8.13 'WALLOPS' Message Off By One Heap Memory Corruption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/35399/info Irssi is prone to an off-by-one, heap-based, memory-corruption vulnerability because it fails to properly bounds-check user-supplied data before copying it into a memory buffer. Attackers can exploit this issue...