Russia arrests 50 hackers who stole $25 million from Banks

Russian authorities have arrested a gang of 50 hackers suspected of stealing more than 1.7 Billion Rubles over US$25 Million from banks and other financial institutions in the country since 2011. The same criminal gang had tried to steal a further 2.273 Billion Roubles by issuing false payment...

Buffer overflow vulnerability in multiple Huawei products (CNVD-2016-03608)

Huawei NGFW Module and others are firewall products from Huawei, China. A buffer overflow vulnerability exists in the Smart DNS feature of multiple Huawei products. An attacker could exploit this vulnerability to cause a denial of service or execute arbitrary code by constructing a malformed...

Slack: Open Redirect on slack.com

Hi, my report has tow interesting parts here First ====== In this report 104087 the attacker uploads a svg file to execute JavaScript and redirect to any domain I have found a new way to execute full html files on victim machine instead of downloading them by adding a bunch of binary chars before...

CVE-2016-4007

Multiple unspecified vulnerabilities in the obs-service-extractfile package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with "illegal options."...

Design/Logic Flaw

Multiple unspecified vulnerabilities in the obs-service-extractfile package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with "illegal options."...

Silicon Graphics LibTiff Denial of Service Vulnerability (CNVD-2016-02226)

Silicon Graphics LibTiff is the United States Silicon Graphics, Inc. of a read and write TIFF Tagged Image File Format file library. A denial of service vulnerability exists in the setrow function in the thumbnail.c file in Silicon Graphics LibTiff 4.0.6 and earlier versions. An attacker can...

Illegal Romance - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Illegal Romance published at the 'play' market has multiple vulnerabilities...

United Nations Rules in Favor of WikiLeaks Founder Julian Assange

VICTORY! As a result of the legal action against WikiLeaks founder Julian Assange by both British and Swedish Governments, he has been arbitrarily detained by the United Kingdom and Sweden since his arrest in London over five years ago. However, Assange filed a complaint against both the...

openSUSE Security Update : cups-filters (openSUSE-2016-67)

This update fixes the following security issue : CVE-2015-8327 adds backtick and semicolon to the list of illegal shell escape characters bsc957531. This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

SUSE-SU-2016:0112-1 Security update for foomatic-filters

This update fixes the following security issues: CVE-2015-8327: adds backtick and semicolon to the list of illegal shell escape characters bsc957531. CVE-2015-8560: fixed code execution via improper escaping of ; bsc957531...

SUSE-SU-2016:0092-1 Security update for cups-filters

This update fixes the following security issue: CVE-2015-8327 adds backtick and semicolon to the list of illegal shell escape characters bsc957531...

IPTV Brute-Force - Search And Brute Force Illegal IPTV Server

This program is just a demonstration. DO NOT USE IT FOR PERSONAL purpose What is this? IPTV is a simple python script that let you crawl the search engines in order to fetch those sites that stream illegal tv programs. This script leverage the fact the a lot of those sites use the same CMS to...

Denial of Service

Overview Versions of hapi prior to 11.1.3 are affected by a denial of service vulnerability. The vulnerability is triggered when certain input is passed into the If-Modified-Since or Last-Modified headers. This causes an 'illegal access' exception to be raised, and instead of sending a HTTP 500...

Cyrus IMAP index_urlfetch integer overflow vulnerability(CVE-2 0 1 5-8 0 7 8)-vulnerability warning-the black bar safety net

CVECAN ID: CVE-2 0 1 5-8 0 7 8 Cyrus IMAP server Carnegie Mellon University developed the e-mail server. Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 version, imap/index. c in function indexurlfetch there is an integer overflow vulnerability, a remote attacker via urlfetch range check and sectionoffset...

CSL DualCom GPRS CS2300-R SPT is vulnerable.

The CSL DualCom GPRS CS2300-R SPT is an alarm signaling board from CSL DualCom, UK, which provides a communication link between the burglar alarm and the monitoring center, allowing signals to be sent to the monitoring center when the alarm goes off, via the mobile network, ordinary phone lines o...

Shopify: Arbitrary write on s3://shopify-delivery-app-storage/files

Short ==== The policy used to upload files via the Delivery app is too generic which results in an arbitrary write and replace of files in the files/ directory. Disclaimer: While I was unable to create a second store to fully test this I can't create new development stores right now, support is...

Hacking Team Android browser attacks during the vulnerability analysis Stage0-vulnerability warning-the black bar safety net

A, vulnerability introduction Hacking team of the year broke out for android4. 0. x-4.3. x android browser vulnerabilities to attack the use of the code. The exploit code, by successive use of a plurality of browser and kernel vulnerabilities, is done through javascript to the virtual memory writ...

China Police Arrest 15,000 Suspects for Alleged Cyber Crimes

China Police has arrested nearly 15,000 people on suspicion of cyber crimes as part of an operation dubbed "Cleaning the Internet," according to reports. According to the Chinese Ministry of Public Security MPS, the suspects have been arrested for their involvement in cyber crimes that "jeopardiz...

thinksaas最新版存储xss

简要描述： 过滤不当 详细说明： 最新版下载地址http://www.thinksaas.cn/service/down/ 跟前面thinksaas最新版xss2 WooYun: thinksaas最新版xss2 thinksaas最新版xss WooYun: thinksaas最新版xss 原理都一样 吐槽下 官网不让注册帐号 就在本地测试了 前人的我测试一个现在还可以 当然 漏洞文件肯定是不一样的 漏洞文件 在app/article/action/add.php 25行中没有过滤 48行插入数据库 isLogin; switch $ts case "" : if...

NSA to Destroy Bulk Collection of Surveillance Data

The National Security Agency will restrict access to, and ultimately destroy, millions of US phone records previously collected by the spy agency, the Office of the Director of National Intelligence ODNI announced Monday. The federal law was passed in June ending the NSA’s bulk collection of U.S...