1702 matches found
Privacy Proponents In Favor of Tracking Protection for Firefox
Privacy advocates are calling on Mozilla to better deploy Tracking Protection, a technology that offers more stringent privacy and speeds up page loads by blocking requests to tracking domains, in its Firefox browser. The functionality has existed in the browser for months but the idea of making ...
一采通电子采购系统多处SQL注入漏洞#2
简要描述： 一采通电子采购系统多处SQL注入漏洞2 详细说明： google:inurl:companycglist.aspx?ComId= 1 漏洞存在于 /Products/CategoryMSelect.aspx，参数Name 例如 http://eps.umgg.com.cn/Products/CategoryMSelect.aspx?Name=树脂磨盘 2 漏洞存在于 /RAT/Product/HistoryPrice.aspx，参数kw 例如 http://eps.umgg.com.cn/RAT/Product/HistoryPrice.aspx?kw=1 3 漏洞存在于...
Super cannon Great Cannon）defect inquiry of JS bloomer-vulnerability warning-the black bar safety net
Following the last post in the black bar to secure the article on the super cannon Great Cannon）defect inquiry of TTL article, we reference from abroad, a research organization for the event post-mortem analysis, as well as by being an attack site log and capture the code on a bloomer, locking Th...
某通用型电子采购系统Oracle盲注漏洞
简要描述： 捡漏啊 详细说明： 前人有经验： WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） 厂商： http://www.1caitong.com/ 北京网达信联科技发展有限公司 SQL注入点： /GetPassWord.aspx POST参数txtUserName存在注入 Case: http://eps.umgg.com.cn/GetPassWord.aspx http://ygcg.xuangang.com.cn/GetPassWord.aspx http://222.134.89.6/GetPassWord.aspx...
US House Votes to End NSA Phone Records Collection
The U.S. House of Representatives’ resounding vote on Wednesday to end the National Security Agency’s collection of phone metadata and business records shifts the Senate focus squarely onto the shoulders of Kentucky Republican Senator, Mitch McConnell. McConnell is a staunch defender of the...
Threat Outbreak Alert RuleID14867: Email Messages Distributing Malicious Software on April 23, 2015
Medium Alert ID: 38509 First Published: 2015 April 23 17:13 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14867 may contain the following files: Name | Si...
Anonymous Hackers Threaten Israel with 'Electronic-Holocaust' on 7th April
The famous cyber hacker group Anonymous has vowed an 'Electronic Holocaust' against Israel in response to what the group calls 'crimes in the Palestinian territories'. In a spooky video "message to Israel" posted on YouTube March 4, Anonymous declared yet another cyber attack on April 7, which is...
5 Biggest Hosting Companies hacked by Syrian Electronic Army
Once again, Syrian Electronic Army SEA has gain media attention by compromising a number of popular web hosting brands of one of the leading web-hosting companies Endurance International Group INC that manages over 60 different hosting brands. SEA, a pro-hacker group supposed to be aligned with...
openEMR 4.2.0 Cross Site Scripting / SQL Injection
Advisory: Multiple reflecting/stored XSS- and SQLi-vulnerabilities in openEMR v.4.2.0 Advisory ID: SROEADV-2015-08 Author: Steffen Rösemann Affected Software: openEMR v.4.2.0 Release-date: 28th Dec 2014 Vendor URL: http://www.open-emr.org Vendor Status: patched CVE-ID: to be assigned after releas...
某通用型电子采购平台可遍历用户和管理员账户密码
简要描述： RT 详细说明： 前人大牛的洞洞 WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） WooYun: 某通用型电子采购平台存在任意文件上传漏洞GETSHELL WooYun: 某通用型电子采购平台从某处目录遍历到任意文件上传GetShell 我也来凑凑热闹 老问题，权限控制问题 漏洞证明： 演示地址为某上市公司 http://cg.jishimedia.com 首先注册账户，登录之后进入密码修改 此时查看源代码即可获取当前用户密码 burpsuite抓包 放入intruder利用0000-9999遍历UserID即可获取所有人员姓名用户和密码，包括管理员 管理后台...
CSI: Cyber: We Watched So You Didn't Have To
From the time the first commercials aired during the American pro football championship game last month, CSI: Cyber has been one of the more talked-about and least-anticipated shows in recent memory. At least in tech circles. For normal viewers, it’s one of those shows that you wake up in the...
Electronic Arts Origin Client 9.5.5 Multiple Privilege Escalation Vulnerabilities
The application is vulnerable to an elevation of privileges vulnerability which can be used by a simple user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the 'F' flag full for the 'Everyone' and 'Users' group, for the...
Electronic Arts Origin Client 9.5.5 Privilege Escalation
Electronic Arts Origin Client 9.5.5 Multiple Privilege Escalation Vulnerabilities Vendor: Electronic Arts Inc. Product web page: https://www.origin.com Affected version: 9.5.5.2850 353317 9.5.3.636 350385 9.5.2.2829 348065 Summary: Origin formerly EA Download Manager EADM is digital distribution...
Electronic Arts Origin Client 9.5.5 - Multiple Privilege Escalation Vulnerabilities
Electronic Arts Origin Client 9.5.5 - Multiple Privilege Escalation Vulnerabilities Electronic Arts Origin Client 9.5.5 Multiple Privilege Escalation Vulnerabilities Vendor: Electronic Arts Inc. Product web page: https://www.origin.com Affected version: 9.5.5.2850 353317 9.5.3.636 350385...
Electronic Arts Origin Client 9.5.5 - Multiple Privilege Escalation Vulnerabilities
Electronic Arts Origin Client 9.5.5 Multiple Privilege Escalation Vulnerabilities Vendor: Electronic Arts Inc. Product web page: https://www.origin.com Affected version: 9.5.5.2850 353317 9.5.3.636 350385 9.5.2.2829 348065 Summary: Origin formerly EA Download Manager EADM is digital distribution...
UBUNTU-CVE-2013-7252
kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack...
帝友P2C借贷系统前台getshell#1
简要描述： 帝友P2C借贷系统前台getshell1 详细说明： 这次是帝友公司旗下出的另一套电子商务cms 不是帝友p2p！ 官方最新版本是 帝友P2C借贷系统V1.01 上传头像处存在getshell 已官方演示站做演示 已注册账号，账号密码都是test1a 访问 http://p2c.diyou.cc/?user&m=approve/safe 上传头像，抓包 修改数据包，插入一句话木马，修改后缀为php后缀 虽然回显500，但是phpshell已经上传了 dyupfiles/avatar/diyou/用户id.php 得到...
Wordpress Infocus3 Theme Arbitrary File Download Vulnerability
Exploit for php platform in category web applications Title : Wordpress Infocus3 Theme Arbitrary File Download Vulnerability Author : KillerX Date : 5/1/2015 KillerX Facebook : http://www.facebook.com/xXalreshyXx Ask : http://ask.fm/ALRESHY Twitter : https://twitter.com/killerx00x Email :...
Wordpress Infocus2 Theme Arbitrary File Download Vulnerability
Exploit for php platform in category web applications Title : Wordpress Infocus2 Theme Arbitrary File Download Vulnerability Author : KillerX Date : 5/1/2015 KillerX Facebook : http://www.facebook.com/xXalreshyXx Ask : http://ask.fm/ALRESHY Twitter : https://twitter.com/killerx00x Email :...
DOJ Launches Cyber Unit, Claims Privacy is Mission Critical
WASHINGTON D.C. – Leslie Caldwell, assistant attorney general in the criminal division of the Department of Justice announced on Thursday the creation of a new team within its Computer Crime and Intellectual Property Section CCIPS during a talk at a Georgetown Law conference titled, “Cybercrime...