SEA Hacks Messaging App Tango, Leaks User Information

The Syrian Electronic Army SEA reportedly hacked into a database belonging to the free messaging and video sharing app Tango over the weekend, potentially compromising millions of users’ information. The SEA – a group of hackers that attacks websites to spread pro-Bashar al-Assad propaganda –...

CVE-2013-0555: IBM Security Access Manager for Enterprise Single Sign-On information disclosure

ISAM ESSO Sync.exe in IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to a local code-injection flaw that can be exploited by a local administrator to access confidential data. The issue requires administrative authentication, is exploitable only locally, and does not affe...

Solaris 10 (x86) : 150401-59 (deprecated)

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Kernel. The supported version that is affected is 10. Easily exploitable vulnerability allows unauthenticated attacker with network access via ICMP to compromise Solaris. Successful attacks of this...

BlackBerry Warns of Z10, PlayBook Security Vulnerabilities

BlackBerry’s security incident response team has issued two advisories warning Z10 smartphone and PlayBook tablet users to upgrade to the latest version of the operating system and software on both platforms. The patches address a remote code-execution vulnerability in the Adobe Flash Player...

ScriptCase - 'scelta_categoria.php' SQL Injection

source: https://www.securityfocus.com/bid/60461/info ScriptCase is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

Weyal CMS - Multiple SQL Injections

source: https://www.securityfocus.com/bid/60089/info Weyal CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or...

Jojo CMS - x-forwarded-for HTTP header SQL Injection

Jojo CMS - x-forwarded-for HTTP header SQL Injection source: https://www.securityfocus.com/bid/59934/info Jojo CMS is prone to an SQL-injection vulnerability because it fails to sanitize user-supplied input. A successful exploit may allow an attacker to compromise the application, access or modif...

[ESNC-2013-004] Remote ABAP Code Injection in OpenText/IXOS ECM for SAP NetWeaver

ESNC-2013-004 Remote ABAP Code Injection in OpenText/IXOS ECM for SAP NetWeaver Please refer to http://www.esnc.de for the original security advisory, updates and additional information. ------------------------------------------------------------------------ 1. Business Impact...

Request Tracker - 'ShowPending' SQL Injection

source: https://www.securityfocus.com/bid/59022/info Request Tracker is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or...

PHP Address Book - addressbookregisterdelete_user.php?id SQL Injection

PHP Address Book - addressbookregisterdeleteuser.php?id SQL Injection source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allow an attacker ...

PHP Address Book - addressbookregisteredit_user_save.php Multiple SQL Injections

PHP Address Book - addressbookregistereditusersave.php Multiple SQL Injections source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allow an...

PHP Address Book - addressbookregisterreset_password_save.php Multiple SQL Injections

PHP Address Book - addressbookregisterresetpasswordsave.php Multiple SQL Injections source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allo...

PHP Address Book - '/addressbook/register/reset_password_save.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit laten...

PHP Address Book - '/addressbook/register/user_add_save.php?email' SQL Injection

source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit laten...

MyBB 1.6.6 - index.php?conditions[usergroup][] SQL Injection

MyBB 1.6.6 - index.php?conditionsusergroup SQL Injection source: https://www.securityfocus.com/bid/52743/info MyBB is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability. Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal...

MyBB 1.6.6 - 'index.php?conditions[usergroup][]' Cross-Site Scripting

source: https://www.securityfocus.com/bid/52743/info MyBB is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability. Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal cookie-based authentication credentials, compromise the...

LinkedIn Cross Site Request Forgery

============================================= INTERNET SECURITY AUDITORS ALERT 2013-001 - Original release date: January 30th, 2013 - Last revised: March 25th, 2013 - Discovered by: Vicente Aguilera Diaz - Severity: 4.3/10 CVSSv2 Base Score ============================================= I...

WordPress LeagueManager Plugin 3.8 - SQL Injection

LeagueManager plugin is prone to an SQL injection that exists in the "leagueid" parameter of a function call made by the leaguemanagerexport page. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit...

BlackNova Traders - news.php SQL Injection

BlackNova Traders - news.php SQL Injection source: https://www.securityfocus.com/bid/57910/info BlackNova Traders is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker ...

iCart Pro - 'section' SQL Injection

source: https://www.securityfocus.com/bid/57564/info iCart Pro is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, access or modify data,...