3 Mobile UK Hacked – 6 Million Customers' Private Data at risk

Three, one of UK's biggest mobile operators, has become the latest victim of a massive data breach that reportedly left the personal information and contact details of 6 Million of its customers exposed. The company admitted the data breach late Thursday, saying that computer hackers gained acces...

LocalTapiola: HTML Injection in email /webApp/lahti (viestinta.lahitapiola.fi)

Steps to reproduce 1. Open link http://viestinta.lahitapiola.fi/webApp/lahti 2. Set "Etunimi" Welcome 3. Set "Sähköposti" to victim email 4. Other fields may be arbitrary 5. Submit form F134348 Result Victim receive an email from [email protected] which contains a link to a...

scps.nyu.edu XSS vulnerability

Vulnerable URL: https://www.scps.nyu.edu/webapps/checkPSAvailability.htm?action=availability=json=prompt/OPENBUGBOUNTY/...

Tesco Bank Hacked — Cyber Fraudsters Stole Money From 20,000 Accounts

Almost 20,000 Tesco Bank customers have had their money stolen from their accounts after the banking arm of UK's biggest retailer fall victim to a hacking attack this weekend. As a result of the hack, Tesco Bank has frozen online transactions in an attempt to protect its customers from, what it...

SweetRice 1.5.1 Backup Disclosure

Title: SweetRice 1.5.1 - Backup Disclosure Application: SweetRice Versions Affected: 1.5.1 Vendor URL: http://www.basic-cms.org/ Software URL: http://www.basic-cms.org/attachment/sweetrice-1.5.1.zip Discovered by: Ashiyane Digital Security Team Tested on: Windows 10 Bugs: Backup Disclosure Date:...

Mindoktor: Lack of CSRF in App allows attackers to change patient PII data

Due to the lack of CSRF it's possible for an attacker to change PII data on a user account. The vulnerable endpoint is: https://app.pentestapi.mindoktor.io/api/v1/user/profile A example request: POST /api/v1/user/profile HTTP/1.1 Host: app.pentestapi.mindoktor.io User-Agent: Mozilla/5.0 Macintosh...

Unspecified Vulnerability in Oracle Fusion Middleware Oracle Discoverer Component (CNVD-2016-10058)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's business innovation platform for enterprise and cloud environments, which provides middleware, software collections, etc. Oracle Discoverer is one of the querying of a variety of information, generating reports, and Web...

au.biomet3i.com XSS vulnerability

Open Bug Bounty ID: OBB-186556 Description| Value ---|--- Affected Website:| au.biomet3i.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Vera Bradley Retail Chain Breached

Retailer Vera Bradley warned customers on Wednesday of a compromise of its point-of-sale system that allowed hackers to make off with an undisclosed number of credit card records. The breach impacts only retail customers who shopped at one of 159 Vera Bradley locations between July 25 and Sept. 2...

CVE-2016-1000009

Technical details about CVE-2016-1000009 are not provided in the supplied documents; no affected products, exploit methods, impacts, or remediation are disclosed here. Monitor updates from official sources for new information.

NSA Contractor Secretly Charged With Stealing Classified Secrets

The Federal Bureau of Investigation arrested a National Security Agency contractor working for Booz Allen Hamilton and charged him with stealing highly classified documents. Harold T. Martin III, of Glen Burnie, Md was charged in a criminal complaint filed in late August that became public...

Null reset codes were allowed

More info at https://haxx.ml/post/149975211631/how-i-hacked-your-cfp-and-probably-some-other...

Null reset codes were allowed

More info at https://haxx.ml/post/149975211631/how-i-hacked-your-cfp-and-probably-some-other...

Boozt Fashion AB: Git available containing passwords.

Hi, I've found .git repository available on http://████/.git/ Using https://github.com/kost/dvcs-ripper you can download source files, even if directory listing is forbidden. I've managed to download some object files from repository. One of them...

CVE-2016-4464

The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token...

PLANET VDR-300NU ADSL Router - DNS Change

PLANET VDR-300NU ADSL Router - DNS Change !/bin/bash PLANET VDR-300NU ADSL ROUTER Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, which is...

Combat a VPN platform vulnerability discovery-vulnerability warning-the black bar safety net

CSRF Used to those not accustomed to the habit of Habit first look at the change the password no matter what to do the capture and see, because something tells me he has a problem Just started to get back the password Like the debug the next data packet, intuition tells me there is a problem, the...

FortiClient SSL-VPN 5.4 Clear Text Password Extraction

Title : Extracting clear text passwords from running processesFortiClient CVE-ID : none Product : FortiClient SSLVPN Service : FortiTray.exe Affected : =5.4 Impact : Critical Remote : No Website link : http://forticlient.com/ Reported : 31/08/2016 Authors : Viktor Minin https://1-33-7.com Alexand...

Opera Browser Sync Service Hacked; Users' Data and Saved Passwords Compromised

Opera has reset passwords of all users for one of its services after hackers were able to gain access to one of its Cloud servers this week. Opera Software reported a security breach last night, which affects all users of the sync feature of its web browser. So, if you’ve been using Opera’s Cloud...

nl.piscines-online.com XSS vulnerability

Open Bug Bounty ID: OBB-178032 Description| Value ---|--- Affected Website:| nl.piscines-online.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...