Foursquare vulnerability that exposes 45 million users' email addresses

A location based Social Networking platform with 45 million users,'Foursquare' was vulnerable to the primary email address disclosed. Foursquare is a Smartphone application that gives you details of nearby cafes, bars, shops, parks using GPS location and also tells about your friends nearby...

WordPress Seo Link Rotator Cross Site Scripting

Exploit Title : Wordpress Seo Link Rotator Plugin Cross Site Scripting Exploit Author : ACC3SS Vendor Homepage : http://www.seolinkrotator.com Software Link : http://www.seolinkrotator.com/download/files/seolinkrotator.zip Date : 2014-01-19 Tested on : Windows 7 / Mozilla Firefox Web Browser...

Ammyy Admin 3.2 - Authentication Bypass

Ammyy Admin 3.2 - Authentication Bypass Title: ==== Ammyy Admin - Hidden hard-coded option and Access Control vulnerability. Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ==== - CVE-2013-5581 for hidden hard-coded...

Apple iTunes < 11.1.4 Multiple Vulnerabilities (uncredentialed check)

The version of Apple iTunes on the remote host is prior to version 11.1.4. It is, therefore, affected by multiple vulnerabilities : - The included versions of the WebKit, libxml, and libxslt components in iTunes contain several errors that can lead to memory corruption and arbitrary code executio...

iTunes < 11.1.4 Tutorials Content Injection (Mac OS X)

The version of iTunes installed on the remote Mac OS X host is a version prior to 11.1.4. It is, therefore, affected by an error related to the iTunes Tutorials window that could allow an attacker in a privileged network location to inject content. C Tenable Network Security, Inc...

CVE-2014-0806

The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for Android provide Geolocation API data without verifying user consent, which allows remote attackers to obtain sensitive location information via a web site that makes API calls...

Verizon Releases First Transparency Report, Says Government Requests INcreasing

After months of public calls from privacy advocates and security experts, Verizon on Wednesday released its first transparency report, revealing that it received more than 164,000 subpoenas and between 1,000 and 2,000 National Security Letters in 2013. The report, which covers Verizon’s landline,...

Information disclosure vulnerability in Sleipnir Mobile for Android

Overview Sleipnir Mobile for Android contains an issue in handling Geolocation API, which may result in the disclosure of a user's location. Sleipnir Mobile for Android is a web browser for Android devices. Sleipnir Mobile for Android contains an issue in handling Geolocation API, which may resul...

Starbucks Patches Vulnerable iOS App

Starbucks has patched a vulnerability in its iOS app that was found last week spilling user data, including usernames and passwords, by adding what it’s called an “additional safeguard measure” to protect its customers. While it’s a relatively quick turnaround for the company – it only took about...

EFF Argues For Search Warrant Requirement to Get Cell Location Data

With each day bringing new information about the way that intelligence agencies and law enforcement are tracking the activities and movements of U.S. citizens, the issue of when these organizations can legally obtain such data has become a major one. Now, a case that seemingly has little connecti...

NSA Monitors Google PREF Cookie to Spy

The National Security Agency is monitoring a certain type of cookie – deployed by the search giant Google – as yet another tool in their increasingly public surveillance apparatus. This, according to slides from an April 2013 NSA presentation acquired by the Washington Post, is the latest...

Wordpress Formcraft Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress formcraft Plugin Sql Injection Exploit Author : Ashiyane Digital Security Team Google Dork : inurl:/wp-content/plugins/formcraft Software Link : www.wordpress.org Tested on: Windows , Linux Date: 2013/12/2 Exploit : S...

CO-TRAVELER : NSA’s Cellphone Location Tracking Tool gathering 5 Billion records a day

None...

Two Million stolen Facebook, Twitter login credentials found on 'Pony Botnet' Server

Security researchers at Trustwave's SpiderLabs found a Netherlands-based Pony Botnet Controller Server with almost two Million usernames and passwords, stolen by cybercriminals from users of Facebook, Twitter, Google, Yahoo and other websites. In a blog post, the researchers mentioned that after...

pacemaker security, bug fix, and enhancement update

1.1.10-14 - Log: crmd: Supply arguments in the correct order Resolves: rhbz996850 - Fix: Invalid formatting of log message causes crash Resolves: rhbz996850 1.1.10-13 - Fix: cman: Start clvmd and friends from the init script if enabled 1.1.10-12 - Fix: Consistently use 'Slave' as the role for...

WordPress Blogggie Shell Upload

Exploit Title : Wordpress Themes Bloggie Arbitrary File Upload Vulnerability Author : ReC0ded Vendor : http://themify.me/ Download : http://themify.me/themes/Bloggie Date : 22, November 2013. Type : php, html, htm, asp, etc. Category : Web Applications Vulnerability : File Upload Tested On :...

Apple iOS本地安全限制绕漏洞(CVE-2013-5193)

BUGTRAQ ID: 63723 CVECAN ID: CVE-2013-5193 iOS是由苹果公司为移动设备所开发的操作系统，支持的设备包括iPhone、iPod touch、iPad、Apple TV。 Apple iOS 7.0.4之前版本存在本地安全限制绕过漏洞，物理位置接近的攻击者可利用此漏洞无需密码，即可绕过某些安全限制，完成交易，执行未授权操作。此漏洞源于没有有效授权App及In-App购买权限。 0 Apple iOS 7.0.4 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2013-6794

Cross-site scripting XSS vulnerability in the Calendar module in Olat 7.8.0.1 b20130821 N1 allows remote attackers to inject arbitrary web script or HTML via the Location field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in the Calendar module in Olat 7.8.0.1 b20130821 N1 allows remote attackers to inject arbitrary web script or HTML via the Location field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2013-6794

Cross-site scripting XSS vulnerability in the Calendar module in Olat 7.8.0.1 b20130821 N1 allows remote attackers to inject arbitrary web script or HTML via the Location field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...