CVE-2014-9407

Multiple cross-site request forgery CSRF vulnerabilities in Revive Adserver before 3.0.5 allow remote attackers to hijack the authentication of administrators for requests that 1 delete data via a request to agency-delete.php, 2 tracker-delete.php, or 3 userlog-delete.php in admin/ or 4 unlink...

FBI Officially Blames North Korea in Sony Hacks

The FBI announced today that it has gathered enough evidence to say with certainty that the government of the Democratic People’s Republic of Korea is in fact responsible for recent intrusions into the networks of Sony Pictures Entertainment SPE. This fact was all but officially stated yesterday...

iOS 8 'Reset All Settings' Bug Could Delete Your iCloud Files

At the beginning of the month, Apple was criticized for the security flaw in its iCloud file storage service that, according to multiple media outlets, allowed hackers to allegedly retrieve photos of a number of high-profile celebrities. And Now, the company’s newly launched iOS 8 has been...

CVE-2014-3896

Multiple cross-site request forgery CSRF vulnerabilities in CGI programs in Seeds acmailer before 3.8.17 and 3.9.x before 3.9.10 Beta allow remote attackers to hijack the authentication of arbitrary users for requests that modify or delete data, as demonstrated by modifying data affecting...

Ruby on Rails <= 2.3.5 'protect_from_forgery' Cross Site Request Forgery Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/37322/info Ruby on Rails is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain unauthorized access to the affected...

Zenoss 2.3.3 Multiple Cross Site Request Forgery Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/37843/info Zenoss is prone to multiple cross-site request-forgery vulnerabilities. Exploiting these issues may allow a remote attacker to perform certain administrative actions, execute arbitrary commands, gain unauthoriz...

Revive Adserver < 3.0.5 Multiple CSRF Vulnerabilities

According to its version number, the Revive Adserver install hosted on the remote web server is affected by multiple cross-site request forgery CSRF vulnerabilities. This can allow an attacker to delete data and cause service disruptions by enticing an authenticated user to follow a crafted URL...

Tccms V8 Sql Injection

简要描述： 过滤不严。 详细说明： 在app\controller\picture.class.php中 public function delete $this-userIsLogin ; $Obj = M$this-objName; $msgObj = new Msg; $id = $GET'id'; $idAry = $POST'id'; $idStr = count$idAry == 0 ? intval$id : implode",", $idAry; $newIdAry = explode",", $idStr; $idSize = count$newIdAry; if...

ThinkSAAS某处平衡权限

简要描述： ThinkSAAS某处平衡权限 详细说明： 能够越权审核数据，越权删除数据 //执行审核 case "do": $topicid = intval$GET'topicid'; $new'group'-update'grouptopic',array 'topicid'=$topicid, ,array 'isaudit'='0', ; //统计需要审核的帖子 $counttopicaudit = $new'group'-findCount'grouptopic',array 'groupid'=$groupid, 'isaudit'='1', ; // 统计小组下帖子数并更新...

CVE-2013-4183

The clearvolume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors...

CVE-2013-4183

CVE-2013-4183 concerns OpenStack Cinder (LVMVolumeDriver) where the clear_volume routine used when deleting a snapshot does not properly clear data, potentially allowing local users to access sensitive information. The vulnerability affects OpenStack Cinder releases 2013.1.1 through 2013.1.2. Con...

CVE-2013-4183

The clearvolume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors...

Default credentials

The HP StoreOnce D2D backup system with software before 3.0.0 has a default password of badg3r5 for the HPSupport account, which allows remote attackers to obtain administrative access and delete data via an SSH session...

Anonymous ransomware spotted in the wild, campaign to Infamous Activists group

Folks from abuse.ch spotted an interesting piece of ransomware malware currently circulating in the wild. Current release is infecting Windows users. It seems that Cybercrooks are taking advantage of Anonymous Banner, for conducting such malware campaigns and supposed to be another game by opposi...

CVE-2011-5090

GR Board aka grboard 1.8.6.5 Community Edition does not require authentication for certain database actions, which allows remote attackers to modify or delete data via a request to 1 modrewrite.php, 2 commentwriteok.php, 3 poll/index.php, 4 update/index.php, 5 trackback.php, or 6 an arbitrary...

CVE-2011-5090

GR Board (grboard) version 1.8.6.5 Community Edition exposes an unauthenticated ability to modify or delete data via specific endpoints: mod_rewrite.php, comment_write_ok.php, poll/index.php, update/index.php, trackback.php, or an arbitrary poll.php under theme/. The issue stems from missing auth...

CVE-2011-5090

GR Board aka grboard 1.8.6.5 Community Edition does not require authentication for certain database actions, which allows remote attackers to modify or delete data via a request to 1 modrewrite.php, 2 commentwriteok.php, 3 poll/index.php, 4 update/index.php, 5 trackback.php, or 6 an arbitrary...

Study Finds One in 10 Hand-Me-Down Hard Drives Still Hold Personal Data

A U.K. organization today released independent study results that show one in 10 secondhand hard drives sold online may contain “residential personal information,” such as bank statements, passports and medical details. In an effort to underscore the need to throughly scrub machines, mobile phone...

Traidnt Topics Viewer 2.0 - 'main.php' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/52224/info Traidnt Topics Viewer is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain unauthorized access to the affected application, or delete certain...

Traidnt Topics Viewer 2.0 - main.php Cross-Site Request Forgery

Traidnt Topics Viewer 2.0 - main.php Cross-Site Request Forgery source: https://www.securityfocus.com/bid/52224/info Traidnt Topics Viewer is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain...