SA-CORE-2012-004 - Drupal core - Multiple vulnerabilities

Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7. Access bypass User module search - Drupal 6 and 7 A vulnerability was identified that allows blocked users to appear in user search results, even when the search results are viewed by unprivileged users. This...

Team Ghostshell Allegedly Dumps 1.6 M Aerospace, Nanotechnology Records

Hacktivist collective Team Ghostshell is claiming this morning to have spilled 1.6 million accounts from a handful of companies in the aerospace, nanotechnology, banking, law, education and government realm, a hack the group deems Project White Fox. The group claims White Fox is its “final stand”...

SA-CONTRIB-2012-171 - Webmail Plus - SQL injection - (unsupported)

The Webmail plus module is a full-featured email client for Drupal. It's designed to provide email for any or all members of a Drupal site. The module doesn't sufficiently sanitize user input as it is used in a database query. CVE: CVE-2012-5590 Versions affected All Webmail Plus module versions...

Final Report on DigiNotar Hack Shows Total Compromise of CA Servers

The attacker who penetrated the Dutch CA DigiNotar last year had complete control of all eight of the company’s certificate-issuing servers during the operation and he may also have issued some rogue certificates that have not yet been identified. The final report from a security company...

SA-CONTRIB-2012-119 - Excluded Users - Cross Site Scripting (XSS)

Excluded Users is a helper module which allows administrators to select users to not appear in user listings. The module displays a list of user names and email addresses without sanitizing them. In the event that someone manages to insert malicious code into a user name or email address, this...

LulzSec Affiliate, Ryan Cleary, Indicted in U.S.

Ryan Cleary, the 20 year-old Essex, England hacker associated with the hacker collective LulzSec, was indicted by a federal grand jury in the United States on Tuesday. According to an FBI press release, the grand jury indicted Cleary with one count of conspiracy and two counts of the unauthorized...

SA-CONTRIB-2012-066 - Spaces and Spaces OG - Access Bypass

CVE: CVE-2012-2303 Spaces is an API module intended to make configuration options generally avaliable only at the sitewide level to be configurable and overridden by individual "spaces" on a Drupal site. The spaces and spacesog modules part of the spaces package in some cases do not apply the...

Anonymous Takedown several Vatican Websites

Anonymous Takedown several Vatican Websites The Italian Anonymous Hackers took down the Vatican's website Vatican.va on Wednesday in retaliation for the "corruption" of the Roman Catholic Church. On an Italian-language website Anonymous accused the Catholic Church of being responsible for various...

CSF Firewall - Buffer Overflow (PoC)

/ Exploit Title: CSF Firewall Buffer overflow p0c DownLoaD : http://www.configserver.com/free/csf.tgz Date: 2011-12-09 Author: FoX HaCkEr site : www.sec4ever.com MaiL : [email protected] Tested on: CentOS3/4 ============================================================================== FiLe : CSF.c...

CSF Firewall - Buffer Overflow (PoC)

CSF Firewall - Buffer Overflow PoC / Exploit Title: CSF Firewall Buffer overflow p0c DownLoaD : http://www.configserver.com/free/csf.tgz Date: 2011-12-09 Author: FoX HaCkEr site : www.sec4ever.com MaiL : [email protected] Tested on: CentOS3/4...

CSF Firewall Buffer Overflow

Exploit for linux platform in category dos / poc Exploit Title: CSF Firewall Buffer overflow p0c DownLoaD : http://www.configserver.com/free/csf.tgz Date: 2011-12-09 Author: FoX HaCkEr site : www.sec4ever.com MaiL : email protected Tested on: CentOS3/4...

CVE-2011-3705

Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files...

Information disclosure

Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files...

CVE-2011-3705

CVE-2011-3705 affects Arctic Fox CMS 0.9.4. Affected component is PHP files (notably acp/includes/edit.inc.php and similar) where a direct request to a PHP file can cause an error message that reveals the installation path, enabling information disclosure. The abuse is a remote attack that does n...

CVE-2011-3705

Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files...

FOX Sports website database hacked and leaked by Shad0w

FOX Sports website database hacked and leaked by Shad0w One of the Biggest Fox Sports website with world rank 678 and millions of Readers/Day got hacked. Hacker named "Shad0w " release SQL injection Vulnerability on one of the sub domain of Fox Sports and exploit it to extract the database. Leake...

FOX Sports website database hacked and leaked by Shad0w

FOX Sports website database hacked and leaked by Shad0w One of the Biggest Fox Sports website with world rank 678 and millions of Readers/Day got hacked. Hacker named "Shad0w" release SQL injection Vulnerability on one of the sub domain of Fox Sports and exploit it to extract the database. Leaked...

Its Fail 2011 - Year of Hacks !

Its Fail 2011 - Year of Hacks ! According to IT security experts Year 2011 have labeled as the "Year of the Hack" or "Fail 2011". Hacking has become much easier over the years allowing hackers to hack into systems easier then ever before, which is why 2011 had a lot of hacking happen so far...

DigiNotar Hacker Says He Has GlobalSign Database Backups, Other Data

As GlobalSign continues the investigation into the claimed compromise of its CA infrastructure, the attacker who says he breached DigiNotar and Comodo said in another message on Pastebin Wednesday that not only did he hack GlobalSign, but he has the private key used to sign the certificate for th...

GlobalSign Stops Issuing Certs As It Investigates Claims of Compromise

GlobalSign, a major certificate authority that was named by the hacker who has claimed credit for the DigiNotar hack as another CA he has compromised, has stopped issuing certificates for the time being while it investigates the claims and determines whether its network has in fact been...