Tiredful API - An intentionally designed broken web application based on REST API

Tiredful API is intentionally designed broken app. The aim of this web app is to teach developers, QA or security professionals about flaws present in webservices REST API due to insecure coding practice. Who can use Tiredful API? Web developers Web Pentesters Security Professionals Student What ...

BORG - Terminal Based Search For Bash Snippets

Borg was built out of the frustration of having to leave the terminal to search and click around for bash snippets. Borg's succint output also makes it easy to glance over multiple snippets quickly. Search borg "find all txt" 1 Find and delete .txt files in bash a find . -name ".txt" | xargs rm b...

Crowd-Sourced Threat Intelligence: AlienVault Open Threat Exchange™ (OTX)

For years, the systems and networks that run our businesses have been secured by the efforts of IT and security practitioners acting on their own. We continue to deploy the latest countermeasures, always trying to keep up with adversaries. Criminal attackers, on the other hand, have shared...

Design/Logic Flaw

CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control RBAC restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing...

HD Moore, Project Sonar Crowdsources Vulnerability Analysis

The state of embedded device security is poor, and there hasn’t been much in the way of discussion to the contrary. It’s well established that vendors skimp on security, selling for example, routers and other networking gear protected only by default passwords, or other critical devices engineere...

CVE-2012-5822

The contribution feature in Zamboni does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of...

Call for Articles - The Hacker News Magazine | December Edition

Call for Articles - The Hacker News Magazine | December Edition THN Magazine is a free monthly magazine designed to spread awareness and knowledge about cyber security. Our goal is to provide the most up-to-date information on a wide variety of topics that relate to hackers and security experts...

Linux kernel 3.0 - 343 changes made by Microsoft developer K. Y. Srinivasan

Linux kernel 3.0 - 343 changes made by Microsoft developerK. Y. Srinivasan Linux Kernal Change Logs figures were published on Thursday in an LWN.net article : 343 Changes made by Microsoft developer K. Y. Srinivasan 1,085 change provided by independent developers Red Hat provided 1,000 Changes in...

WebJaxe 1.01 SQL Injection

Exploit Title: WebJaxe Sql Injection Date: 14-05-2010 Author: IHTeam Software Link: http://media4.obspm.fr/outils/webjaxe/en/ Version: 1.01 Tested on: Win/Linux !You need a registred user! http://site/path/php/partieadministrateur/administration.php?page=projetcontribution&idcontribution=SQL...

WebJaxe - SQL Injection

WebJaxe - SQL Injection Exploit Title: WebJaxe Sql Injection Date: 14-05-2010 Author: IHTeam Software Link: http://media4.obspm.fr/outils/webjaxe/en/ Version: 1.01 Tested on: Win/Linux !You need a registred user!...

python: Multiple integer overflows discovered by Google

Multiple integer overflows in Python before 2.5.2 might allow context-dependent attackers to have an unknown impact via vectors related to 1 Include/pymem.h; 2 csv.c, 3 struct.c, 4 arraymodule.c, 5 audioop.c, 6 binascii.c, 7 cPickle.c, 8 cStringIO.c, 9 cjkcodecs/multibytecodec.c, 10...

Gentoo Security Advisory GLSA 200805-07 (ltsp)

The remote host is missing updates announced in advisory GLSA 200805-07. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Webavis 0.1.1 (class.php root) Remote File Inclusion Vulnerability

No description provided by source. Webavis Remote file inclusion root Download script : http://webavis.myreseau.org/src/webavis-0.1.1.tar.gz Thanks Str0ke :D Exploit : http://victim.com/webavis/class/class.php?root=shell.txt ? Discovered by ThE TiGeR MiroTigeratHotmail.com sebug.net...

Maxwebportal <= 1.36 password.asp Change Password Exploit (3 - perl)

Exploit for unknown platform in category web applications ==================================================================== Maxwebportal Gr33tz To == mhp0rtal , Oilkarchack , Str0ke & AlphaST.Com And Iranian Hacking & Security Teams : IHS , Shabgard , Emperor ,Crouz & Simorgh-ev use IO::Socket...

ImageMagick png vulnerability fix

Glenn Randers-Pehrson has contributed a fix for the png vulnerabilities discovered by Chris Evans...

HMAP Web Server Fingerprinting

Nessus was able to identify the remote web server type by sending several valid and invalid HTTP requests. In some cases, its version can also be approximated, as well as some options. C Tenable Network Security, Inc. Redistribution and use in source, with or without modification, are permitted...

Microsoft Windows - RPC DCOM Remote (2)

Microsoft Windows - RPC DCOM Remote 2 ////////////////////////////////////////////////////////////////////////// // // Windows RPC DCOM Remote Exploit with 48 TARGETS Fixed // ////////////////////////////////////////////////////////////////////////// // // English - French - Chinese - Polish -...

MS Windows (RPC DCOM) Remote Exploit (48 Targets)

No description provided by source. ////////////////////////////////////////////////////////////////////////// // // Windows RPC DCOM Remote Exploit with 48 TARGETS Fixed // ////////////////////////////////////////////////////////////////////////// // // English - French - Chinese - Polish - Germa...

[Announce] SECURITY: mutt-1.2.5.1 and mutt-1.3.25 released.

mutt-1.2.5.1 and mutt-1.3.25 have just been released. These releases both fix a security hole which can be remotely exploited. The problem was found and a fix suggested by Joost Pol [email protected]. Thanks for that. mutt-1.2.5.1 is released as an update to the last stable version of mutt,...