Lingxia I.C.E CMS Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/python ICE CMS Blind SQLi 0day. mrme@pluto ice$ python icecold.py -p localhost:8080 -t 10.3.100.25:8500 -d /ice/ | ---------------------------------------------------- | | Lingxia I.C.E CMS Remote Blind SQL Injection Exploit | | by mrme - net-ninja.net...

Juniper Netscreen 5.0 VPN Username Enumeration Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14595/info The Juniper Netscreen VPN implementation will identify valid usernames in IKE aggressive mode, when pre-shared key authentication is used. This allows for attackers to obtain a list of valid VPN users. With a...

AlienVault OSSIM 3.1 Reflected XSS and Blind SQL Injection

No description provided by source. !/usr/bin/python ''' AlienVault has a reflected XSS vulnerability in the url parameter of top.php. Proof of Concept: Enticing a logged in user to visit the following URL where an attacker is hosting an cookie grabber will allow for the hijacking of the user...

Ingenium Learning Management System 5.1/6.1 Reversible Password Hash Weakness

No description provided by source. source: http://www.securityfocus.com/bid/5970/info Ingenium Learning Management System uses a weak algorithm to hash user and administrative credentials. Passwords may be trivially obtained by reversing the password hash. An attacker must be able to gain...

FlexBB <= 0.6.3 Cookies Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl use Tk; use Tk::BrowseEntry; use Tk::DialogBox; use LWP::UserAgent; $mw = new MainWindowtitle = UnderWHAT?! ; $mw-geometry '420x343' ; $mw-resizable0,0; $mw-Label-text = '', -font = 'Verdana 8',-foreground='red'-pack; $mw-Label-text = 'FlexBB =...

CVE-2013-7041

The pamuserdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack...

CVE-2013-0174

The external node classifier ENC API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request...

Cross site request forgery (csrf)

The external node classifier ENC API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request...

CVE-2013-0174

The external node classifier ENC API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request...

CVE-2013-7041

The pamuserdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack...

PT-2014-2428

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.1 Description The issue allows remote attackers to obtain the hashed root password via an API request to the external node classifier ENC API. Recommendations For versions prior to 1.1, update to version 1.1 or late...

CVE-2013-0174: Exposure of Sensitive Information to an Unauthorized Actor

The external node classifier ENC API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request...

iDevAffiliate 5.x SQL Injection

Exploit Title: iDevAffiliate = v5.x SQL Injection Vulnerability Google Dork: Use your head Date: 4/21/2014 Vendor Homepage: http://www.idevdirect.com/ Version: = v5.x Author: Robert Cooper robert.cooperatareyousecure.net Tested on: Linux/Windows Vulnerable Parameter: ad= PoC:...

MGASA-2014-0088 Updated freeradius package fixes security vulnerability

SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlmpap module if the password source uses an unusually long hashed password CVE-2014-2015...

Tajikistan Domain Registrar hacked; Google, Yahoo, Twitter, Amazon also defaced

Google’s primary search domain for Tajikistan had seemingly been hacked yesterday, along with other high profile domains including Yahoo, Twitter, Amazon -- redirected to a defaced page. Actually neither Google, nor Twitter servers have been hacked, rather website of Tajikistan's Domain registrar...

World’s largest Bitcoin Poker website hacked, 42000 user passwords leaked

World’s largest Bitcoin poker website 'SealsWithClubs' has been compromised and around 42,000 users' credentials are at risk. Seals With Club has issued a Mandatory Password Reset warning to their users, according to a statement published on the website. The service admitted their database had be...

vBulletin Zero Day Used to Hack MacRumors, vBulletin

A hacker group calling itself Inj3ct0r is taking responsibility for the compromise of more than 860,000 passwords at MacRumors.com as well as a separate attack on vBulletin.com, makers of the vBulletin software powering a number of high-profile forums including MacRumors and Ubuntu Forums. The...

MacRumors forum hacked; more than 860,000 accounts compromised

Popular Mac news and information site MacRumors user forums have been breached by hackers on Monday this week. More than 860,000 usernames, emails and hashed passwords were potentially compromised. Users are advised to users that they change their passwords on the forums, as well as any other sit...

Design/Logic Flaw

The Make Meeting Scheduler module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to bypass intended access restrictions for a poll via a direct request to the node's URL instead of the hashed URL...

Bitcoin Talk forum hacked; Database for Sale by Hacker; Website currently down

Bitcoin Talk, the popular Bitcoin discussion forum, has been hacked and as it stands the site is currently unreachable. Bitcointalk has been down for nearly 6 hours. The forums have been allegedly hacked and Defaced by "The Hole Seekers" and selling 150,000 emails and hashed passwords stolen from...