Identify devices at risk of search

Searches and seizure is not limited to personal computers or laptops. Any device that stores data is fair game for Customs and Border Protection or Immigration and Customs Enforcement ICE Agents. This includes all computers, laptops, tablets, mp3 and mobile media players, digital cameras,...

Iframe Vulnerability in Google App Engine (Appspot)

Iframe Vulnerability in Google App Engine Appspot An Indian Hacker "Ethical Mohit" have found in Iframe Vulnerability in Contact Desk page of Google App Engine Appspot. 1 Proof of Concept : Click Here 2 Proof of Concept : Click Here Google App Engine lets you run your web applications on Google's...

Apple Releases iOS 4.3.3, Addressing Location-Tracking Concerns

Apple has released iOS 4.3.3, a firmware update for the iPhone, iPod Touch and iPad that, among other things, fixes the controversial issues surrounding the location tracking capabilities of those devices. The firmware update is Apple’s response to the outcry that erupted last month when a pair o...

CVE-2011-1717

Skype for Android stores sensitive user data without encryption in sqlite3 databases that have weak permissions, which allows local applications to read user IDs, contacts, phone numbers, date of birth, instant message logs, and other private information...

Mozilla Foundation Security Advisory 2011-09

Mozilla Foundation Security Advisory 2011-09 Title: Crash caused by corrupted JPEG image Impact: Critical Announced: March 1, 2011 Reporter: Jordi Chancel Products: Firefox, Thunderbird Fixed in: Firefox 3.6.14 Thunderbird 3.1.8 Description Security researcher Jordi Chancel reported that a JPEG...

CVE-2009-5033

IBM Lotus Notes Traveler before 8.5.0.2 does not properly handle a " " argument sequence for a certain tell command, which allows remote authenticated users to obtain access to other users' data via a sync operation, related to storage of the data of multiple users within the same thread...

Wells Fargo, BoA Cited For Lax Mobile App Security

Days after publishing a report on serious security lapses in the PayPal mobile payments application for the iPhone, a Chicago firm has released an analysis that finds similar problems in a mobile banking applications by Bank of America and Wells Fargo. The report, published on Thursday by...

How to Minimize Your Database Attack Surface

Database Management Systems DBMS have extended their capabilities far beyond simply serving as data storage and query systems. Contrary to what they were in the 1970...

Researcher Claims 'Evercookie' Can't Be Removed

Call it “Frankencookie:” a security researcher has released a tracking cookie that he claims is nearly impossible to remove. Dubbed “evercookie,” it is designed to raise awareness about the ease with which Web site operators can evade privacy tools designed to eliminate shield visitors’ privacy...

[SECURITY] Fedora 12 Update: gnupg2-2.0.13-2.fc12

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

[SECURITY] Fedora 13 Update: gnupg2-2.0.14-4.fc13

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

CVE-2010-2913

The CVE-2010-2913 entry concerns the Citi Mobile iOS app prior to version 2.0.3, where account data is stored in a local file. This creates a risk that local users can access sensitive information via (1) the mobile device itself or (2) a computer synchronized with the device. The available docum...

Новый метод атаки через Reverse-IP

Новый метод атаки через reverse-ip Хоть статья и 2009 года, но до сих пор актуальна. 0. INTRO Вобщем не буду делать большое вступление. Недавно имело место хекать сайт. Шел был успешно залит на соседний, но вот беда на сервере грамотно выставленны права. Пришлось включать голову и думать. И в...

Rich Mogull on Database Security and Encryption

Dennis Fisher talks with analyst Rich Mogull of Securosis about his new report on database encryption, the value and danger of storing credit-card data and why more companies don’t get rid of sensitive data more quickly. Podcast audio courtesy of sykboy65 Subscribe to the Digital Underground...

Plug horse code is space-separated solutions-vulnerability warning-the black bar safety net

Some time ago, the new cloud management system, dynamic network Forum get a WEBSHELL and this, today, we discuss this aspect of things, in fact, ASP database plug horse also is not what fresh stuff, believe you played this. Oh, and that you have not met insert the asp code is spaces apart case?...

iShowMusic V1. 2 Write a shell vulnerability-vulnerability warning-the black bar safety net

A few days before the announcement of the vulnerability, these days quite busy, today only see. Just some time ago using this program to do a music station, in the own Station test is successful, by the way also fill the lower holes. -------- Vulnerability description: iShow Music is a basic set...

Thecus NAS Device Detection

According to its web server, the remote host is a Thecus NAS Network- Attached Storage device, which provides file-based data storage to hosts across a network. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid35820; scriptversion"1.12"; scriptnameenglish:"Thecus NAS...

Opera Web Browser 9.62 - History Search Input Validation

Opera Web Browser 9.62 - History Search Input Validation source: https://www.securityfocus.com/bid/32015/info Opera Web Browser is prone to an input-validation vulnerability because of the way it stores data used for the History Search feature. Attacker-supplied HTML and script code would run in...

Mac OS X Mail.App insecure data storage

Encrypted messages are stored in cleartext...

iShowMusic V1.2 写入shell漏洞

iShow Music 是一套基本于PHP+TXT的在线音乐播放程序。程序采用文本数据存储方式，无需MYSQL数据库支持，同时程序代码与界面模板分离，方便你的音乐网站界面修改。 在error.php 12-26行 elseif $POST'action'=="save" $cknumon && GdConfirm$gdcode; ifempty$id Showmsg"no","你还未选择歌曲呢!","返回重新填写","javascript:history.back-1"; exit; elseifempty$POST'user'...