OpenEMR 4.2.0 Authentication Bypass Vulnerability

OpenEMR versions 4.2.0 and 4.2.0 patch 1 suffer from an authentication bypass vulnerability. Title: Authentication bypass in OpenEMR CVE Reference: CVE-2015-4453 Product: OpenEMR Vendor: http://www.open-emr.org/ Tested versions: 4.2.0 and 4.2.0 patch 1 Affected versions: 2.8.3 to 4.2.0 patch 1...

The vulnerability of the Windows operating system allows a malicious individual to obtain user authentication information.

The vulnerability of the Windows operating system exists in the implementation of system calls such as URLDownloadA, URLDownloadW, URLDownloadToCacheFileA, URLDownloadToCacheFileW, URLDownloadToFileA, URLDownloadToFileW, URLOpenStream, and URLOpenBlockingStream. During these calls, the operating...

Apple Safari Remote URI Spoofing Vulnerability

Apple Safari is a web browser developed by Apple, Inc. and is the default browser that comes with the Mac OS X and iOS operating systems. A security vulnerability exists in Apple Safari that allows attackers to conduct phishing attacks by exploiting the vulnerability to construct malicious WEB...

Empire backup Wang(Empirebak) \class\functions.php and\class\combakfun.php GETSHELL vul-vulnerability warning-the black bar safety net

catalog 1. Vulnerability Description 2. Vulnerability trigger conditions 3. Vulnerability the range of 4. Vulnerability code analysis 5. Defense method 6. Offensive and defensive thinking 1. Vulnerability description EmpireBak is a completely free, dedicated to Mysql for big data backup with the...

Ersatz Scheme Deceives Hackers, Protects Stored Passwords

Researchers at Purdue University have developed a scheme that protects stolen passwords from offline cracking. The project is explained in a paper called “ErsatzPasswords – Ending Password Cracking” pdf written by Purdue University researchers Mohammed H. Almeshekah, Christopher N. Gutierrez,...

Threat Outbreak Alert RuleID15411: Email Messages Distributing Malicious Software on May 20, 2015

Medium Alert ID: 38936 First Published: 2015 May 20 19:13 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15411 may contain the following files: Name | Size...

HackerOne: Fake URL + Additional vectors for homograph attack

Hello! I would like to report about a new issue based on "@" character in URL. It shows user real URL but when he clicks "Proceed", he is redirected to another website. For example, it seems as normal HackerOne URL:...

Shopify: Content Spoofing

Hi, Content Spoofing almost all in the myshopify admin account. Content Spoofing an attack technique used to trick a user into thinking that fake web site content is legitimate data. https://YOURSHOP.myshopify.com/admin?error=CONTENT SPOOFING...

Hacker Who Stole Money From Bill Gates Arrested in Philippines

What if you get into the bank account of the World’s most richest person? Maybe it could be difficult for you as well as I. But not for this guy… ...Konstantin Simeonov Kavrakov, a Bulgarian hacker, who hacked into the ATM and stole thousands of dollars from the bank account of Microsoft mogul Bi...

Shopify: Open redirection in OAuth

Hello, When we specify an invalid scope then the authorize url redirects to the site mentioned in redirecturi. So, attacker can create an app and use it as open redirector to redirect victims to fake sites. eg. Attacker can host same phishing page and hack the victims. Proof Of Concept :...

IC3 Issues Alert for Fake Government Websites

The Internet Crime Complaint Center IC3 has released an alert that warns consumers of fraudulent government-services websites that mimic legitimate ones. Scam operators lure consumers to these fraudulent websites in order to steal their personal identifiable information PII and collect fees for...

Threat Outbreak Alert RuleID13978: Email Messages Distributing Malicious Software on March 17, 2015

Medium Alert ID: 37858 First Published: 2015 March 13 14:51 GMT Last Updated: 2015 March 18 16:30 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13978 and...

Adobe: Open redirect and reflected xss in http://youthvoices.adobe.com/community?return_url=[payload her]

Hi, there is a xss vulnerability and open redirect vulnerability in the returnurl parameter for the following component: http://youthvoices.adobe.com/community?returnurl= If a users tries to register or login after following this url:...

WordPress Webdorado Spider Event Calendar 1.4.9 - SQL Injection Vulnerability

Exploit for php platform in category web applications . Exploit Title: WordPress: Webdorado Spider Event Calendar = 1.4.9 SQL Injection Date: 2015-02-12 Exploit Author: Mateusz Lach Vendor Homepage: https://www.facebook.com/WebDorado or http://www.webdorado.com Software Link:...

Threat Outbreak Alert RuleID13472: Email Messages Distributing Malicious Software on February 9, 2015

Medium Alert ID: 37396 First Published: 2015 February 9 15:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13472 may contain the following files: Name |...

HackerOne: Improper way of validating a program

Hello HackerOne, I found out that it's easy to publish a program that isn't yours. January 20, 2015 I created a program named Puffer Bird and I leave the sandbox to prepare to launch the program. Then, I requested for a program review. January 21, 2014 at 1:08 AM I received an email from...

Beware! Fake WhatsApp PLUS App Rumored to be Next Official WhatsApp Release

Several reports from the popular news websites had suggested that WhatsApp, the widely popular messaging application, is working on a new version of its instant messaging client, called WhatsApp PLUS, in order to provide its users a lot of handy new features. However the news seems to be complete...

Gogo In-flight Internet issues Fake SSL Certificates to its own Customers

Gogo — one of the largest providers of in-flight Internet service — has been caught issuing fake SSL certificates, allowing the inflight broadband provider to launch man-in-the-middle MITM attacks on its own users, view passwords and other sensitive information. The news came to light when securi...

tnftp (FreeBSD 8910) - tnftp Client Side

tnftp FreeBSD 8910 - tnftp Client Side !/usr/bin/env python2 Exploit Title: tnftp BSD exploit Date: 11/29/2014 Exploit Author: dash Vendor Homepage: www.freebsd.org Version: FreeBSD 8/9/10 Tested on: FreeBSD 9.3 CVE : CVE-2014-8517 tnftp exploit CVE-2014-8517tested against freebsd 9.3...

US-CERT Alerts Users to Holiday Phishing Scams and Malware Campaigns

US-CERT reminds users to remain vigilant when browsing online this holiday season. E-cards from unknown senders may contain malicious links. Fake advertisements or shipping notifications may deliver infected attachments. Spoofed e-mail messages and fraudulent posts on social networking sites may...