8440 matches found
IceWarp WebMail口令取回功能输入验证漏洞
BUGTRAQ ID: 34827 CVECAN ID: CVE-2009-1469 Merak Email Server是一个全面的办公室局域网或Internet通讯邮件解决方案。 Merak邮件服务器的WebMail模块在登陆页面提供了“忘记口令”取回功能，忘记了登录口令的用户可以在这里向邮件服务器提供他们的邮件地址，之后服务器检查系统中是否存在这个地址并将相关的用户口令发回到这个地址。 在点击Forgot Password页面的提交按键时，所发送的HTTP POST请求包含有类似于以下的负载：...
32bit FTP (09.04.24) - CWD Response Universal Overwrite (SEH)
32bit FTP 09.04.24 - CWD Response Universal Overwrite SEH !/usr/bin/python | || | / \ | | | | | | | | | - | | | / / | | |||| || // / |\ || Bug : 32bit FTP 09.04.24 CWD Response Universal Seh Overwrite Exploit Refer : http://www.milw0rm.com/exploits/8611 Tested on : Xp sp3 ENVB Exploited by :...
IceWarp Merak Mail Server 9.4.1 - Forgot Password Input Validation
IceWarp Merak Mail Server 9.4.1 - Forgot Password Input Validation source: https://www.securityfocus.com/bid/34827/info IceWarp Merak Mail Server is prone to an input-validation vulnerability because it uses client-supplied data when performing a 'Forgot Password' function. Attackers can exploit...
IceWarp Merak Mail Server 9.4.1 - 'Forgot Password' Input Validation
source: https://www.securityfocus.com/bid/34827/info IceWarp Merak Mail Server is prone to an input-validation vulnerability because it uses client-supplied data when performing a 'Forgot Password' function. Attackers can exploit this issue via social-engineering techniques to obtain valid users'...
IceWarp WebMail Mail Forgery
Advisory: IceWarp WebMail Server: Client-Side Specification of "Forgot Password" eMail Content During a penetration test, RedTeam Pentesting discovered that the emails sent by the IceWarp WebMail Server when using the "Forgot Password" function are generated on the client side. Furthermore, the...
85% of malicious sites only online for 24 hours
From PC Advisor Carrie-Ann Skinner More than 80 percent of websites that had been poisoned with malicious code between 2008 and 2009 were removed within 24 hours, says AVG. The security vendor’s Web Threat Profile Report estimated that on any one day between 8 and 14 million web users are being...
JobHut 1.2 Remote Password Change/Delete/Activate User Vulnerability
No description provided by source. -------------------------------------------------- JobHut = 1.2 manageUsers Remote password change Vulnerability ---------------------------------------------------- founder : ThE g0bL!N Script Download: http://jobhut.spranger.us/ version:= 1.2 thx: to K-159 for...
JobHut 1.2 Remote Password Change/Delete/Activate User Vulnerability
Exploit for unknown platform in category web applications ==================================================================== JobHut 1.2 Remote Password Change/Delete/Activate User Vulnerability ====================================================================...
Ken "Skywing" Johnson joins Microsoft security team
Microsoft has hired yet another well-known security researcher to join its ever-growing team of exploit and defense experts. This time it’s Ken Johnson, known in the hacker world as Skywing. Johnson is known as an expert on debugging and reverse engineering, and has done a tremendous amount of wo...
Facebook doesn't believe it's really Kevin Mitnick
In an ironic twist, Kevin Mitnick, a social engineering master who went to jail for impersonating others to get information to access computer networks without authorization, couldn’t access his own Facebook account for weeks because administrators at the social networking site didn’t believe he...
GMail, GTalk phishing scam underway
Attention GMail and GTalk users: There’s a major spam run underway with social engineering lures to steal your login cretentials. This image shows a GMail message that purports to be an account termination warning from Google but, if a user is tricked into clicking on the link, he/she is redirect...
Design/Logic Flaw
Unspecified vulnerability in the Oracle Applications Platform Engineering component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows local users to affect confidentiality via unknown vectors...
PHPmotion 2.1 Cross Site Request Forgery
PHPmotion Source of pwned.html file: Once your victim has visited your evil page, You may now be able to log...
PHPmotion <= 2.1 CSRF Vulnerability
No description provided by source. PHPmotion = 2.1 CSRF vulnerability Author: Ausome1 Email: [email protected] Website: http://www.enigmagroup.org Description: Change a member's password and/or email...
PHPmotion 2.1 - Cross-Site Request Forgery
PHPmotion 2.1 - Cross-Site Request Forgery PHPmotion Source of pwned.html file: Once your victim has visited your evil page, You may now be able to log into their PHP...
PHPmotion <= 2.1 CSRF Vulnerability
Exploit for unknown platform in category web applications =================================== PHPmotion Source of pwned.html file: input type="submit" value="Update settings"...
Social engineering the use of three steps-vulnerability warning-the black bar safety net
This should be the x-Files made on the article Everyone must know the super-hacker Kevin Mitnick, right, deep for his social engineering impressed by, the United States Department of Defense, the Pentagon, the CIA, the North American air defense system...... Is he a stroll of the place, no one...
GSC Privilege Escalation Exploit
Name: Michael Gray Website: www.ownerarium.net Contact: [email protected] Discovered Exploit: 06-05-2008 Vulnerable Software Title: GSC Vulnerable Version: = 2067 Severity: CRITICAL Website: http://www.getgsc.com Reported to vendor: Yes Actively exploited: Yes Exploit Discovery...
gsc-kick.txt
Name: Michael Gray Website: www.ownerarium.net Contact: [email protected] Discovered Exploit: 06-05-2008 Vulnerable Software Title: GSC Vulnerable Version: = 2067 Severity: CRITICAL Website: http://www.getgsc.com Reported to vendor: Yes Actively exploited: Yes Exploit Discovery...
Cisco Building Broadband Service Manager Cross-Site Scripting Vulnerability
Cisco Building Broadband Service Manager BBSM 5.3 SP2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability exists due to an input validation error in certain web pages associated with the BBSM web...