8797 matches found
Google Changes SafeSearch Option for Administrators
Google is removing a feature that allowed administrator to require their users to employ a search option that removes explicit content from search results. The decision is tied to the fact that the option required the use of an unsecured connection to Google, something that the company said allow...
Shiro: successful authentication without specifying user name or password
It was discovered that Apache Shiro authenticated users without specifying a user name or a password when used in conjunction with an LDAP back end that allowed unauthenticated binds...
DLA-66-1 apache2 - security update
Bulletin has no description...
cmseasy 再次绕过前台sql盲注(无需登录)
简要描述： cmseasy 再次绕过前台sql盲注无需登录 详细说明： 我们直接进入: archiveact.php:611-628: function respondaction includeonce ROOT . '/lib/plugins/pay/' . front::$get'code' . '.php'; $payclassname = front::$get'code'; $payobj = new $payclassname; $uri = $SERVER"REQUESTURI"; $uriget = strstr$uri, '?'; $uriget =...
Retrieving all tables and their columns at once MSSQL
In the Name of ALLAH the Most Beneficent and the Merciful Zenodermus, Ch3rn0by1 and Me was workinn on MSSQL.. when Zenodermus thought to make a DIOS for MSSQL.. previously at Код: http://websec.ca/kb/sqlinjection DIOS is under the heading Retrieving Multiple Tables and Columns Код: AND 1=0; BEGIN...
Cisco 1800 Series ISR ISDN Basic Rate Interface Denial of Service Vulnerability
Cisco 1800 Series Integrated Services Routers ISR contain a vulnerability in the hardware entropy collection module when the Integrated Services Digital Network ISDN Basic Rate Interface BRI is configured and connected to a public switched network. This could allow an attacker with knowledge of t...
phpyun设计缺陷可用别的账户money付款，清空别的账户money为0
简要描述： 后台在处理订单的时候，直接获取cookie中的uid，此uid可以伪造成他人的uid，导致可用他人的money付款。 经过测试，虽然自己并不能获得支付成功的积分，但是可以扣除他人账户余额。 详细说明： 漏洞文件\api\tenpay\index.php: $sql=$db-query"select from ".$dbconfig"def"."companyorder where orderid='$POSTdingdan'"; $row=mysqlfetcharray$sql; //通过订单编号获取点单价格 $userid=int$COOKIE'uid';...
Facebook Says 95 Percent of Notification Email Encrypted
All that’s missing from the organic encrypt the web movement seems to be a hashtag. Otherwise, no one can accuse major web providers of slacking as leading players such as Microsoft and Yahoo, prompted by the Snowden leaks, have made noteworthy leaps in the last 15 months to encrypt everything fr...
Advance-Flow vulnerable to SQL injection
Overview Advance-Flow provided by OSK Co., LTD contains an issue in processing input data, which may result in SQL injection. Yoshinori Ohta of Business Architects Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnershi...
Cryptography Expert Says, 'PGP Encryption is Fundamentally Broken, Time for PGP to Die'
A Senior cryptography expert has claimed multiple issues with PGP email encryption - an open source end-to-end encryption to secure email. Before continuing, I would like to clarify that covering this topic doesn't mean you should stop using PGP encryption, instead we are bringing to you what...
qibocms某功能缺陷可致前台管理登录
简要描述： RT.前台管理登录，由于是通用文件，涉及多个系统。 详细说明： 0x1 前台admin登录 inc/function.inc.php: function mymd5$string,$action="EN",$rand='' //字符串加密和解密 global $webdb; if$action=="DE"//处理+号在URL传递过程中会异常 $string = strreplace'QIBO|ADD','+',$string; $secretstring = $webdbmymd5.$rand.'5j,.^&;?.%@!'; //绝密字符串,可以任意设定...
Shop7z多个漏洞大礼包
简要描述： 前台存储型XSS打后台，后台限制不严导致敏感数据访问，自己给自己充值TAT，等等···· 详细说明： 0x01 前台XSS，使用官方最新的免费版源代码 在注册用户的时候，地址当中输入XSS代码 " 如图 然后注册，显示注册成功 这时候查看一下后台---会员信息管理--会员管理---该会员详细信息 可以看到xss代码已经插进去了 而xss平台也能收到cookies信息 0x02 未授权访问 http://127.0.0.1/admin/huiyuandetail.asp?id=831 该地址在免费版中未做权限检查，导致可以直接在这里遍历会员信息，同时可以修改任意会员信息 相关代...
Square Launches Bug Bounty, Hires Top Security Researcher
The bug bounty phenomenon began mainly with major software vendors and security companies, which were the main targets for security researchers and attackers. But it is now moving to virtually every corner of the Web and software ecosystem, and the latest company to join the party is Square, the...
Discuz 5.x 6.x 7.x 前台SQL注入漏洞一枚
简要描述： 自从补课补完了 感觉自己都完全荒废了。 睡觉 看电视 看小说。 唉。 得开始努力学习考大学 哦也。 看到map牛 发了几个dz7.2的 也看到还在更新 我也就看了看 前台注入一枚, 也都知道 如果ucenter 和 DZ 在一个裤里面的话就可以拿到uckey 拿到uckey了 然后……。 很简单的一个洞。 详细说明： http://download.discuz.net/Discuz/7.2/Discuz7.2SCGBK.zip 刚在官网下的这个。 首先说一下 这洞需要有权限发布投票才行 刚注册的会员是不能发布投票的 我看了下默认发布投票需要的权限...
End-to-End Encryption for Yahoo Mail Coming Next Year
Today at Black Hat 2014 hacking conference, Yahoo! Chief Information Security Officer Alex Stamos announced that the company will start giving its consumers the option of end-to-end encryption in its Mail service by next year. Google showed off a PGP-based encryption plugin for Gmail back in June...
Yahoo to Release End-to-End Encryption for Email Users
LAS VEGAS–Yahoo plans to enable end-to-end encryption for all of its Mail users next year. The company is working with Google on the project and the encryption will be mostly transparent for users, making it as simple as possible to use. Alex Stamos, CISO at Yahoo, said that the project has been ...
QuasiBot - Webshell Manager aka HTTP Botnet
QuasiBot is a complex webshell manager written in PHP, which operate on web-based backdoors implemented by user himself. Using prepared php backdoors, quasiBot will work as C&C trying to communicate with each backdoor. Tool goes beyond average web-shell managers, since it delivers useful function...
discuz 7.2&discuz x<=2 后台注入
简要描述： 第二发 详细说明： 以dz7.2来说，漏洞位于task.php 57行， $query = $db-query"SELECT t., mt.csc, mt.dateline FROM $tablepretasks t LEFT JOIN $tablepremytasks mt ON mt.taskid=t.taskid AND mt.uid='$discuzuid' WHERE $sql AND t.available='2' $newbieadd ORDER BY displayorder, taskid DESC LIMIT $startlimit, $tpp";...
Signal — Open Source iPhone App to Make Free End-to-End Encrypted Voice Calls
Good News for Privacy Lovers!! An open source software group Open Whisper Systems has released the first free and Open Source phone call application for iPhone users, which is specifically designed to make secure and encrypted calls. When we talk about the privacy of our messages and voice calls,...