漫游用友集团各大系统

简要描述： 漫游用友集团各大系统 详细说明： 在一个月黑风高的夜晚，用友某员工的集团办公平台账号，悄悄地泄露了。 // Send message Transport transport=session.getTransport; transport.connect"192.168.210.160" , 25, "ch2","1r"; transport.sendMessagemessage,new Addressnew InternetAddress"[email protected]" ; transport.close;...

Magento Server MAGMI Plugin 0.7.17a - Remote File Inclusion

Exploit found date: 10/24/2014 Security Researcher name: Parvinder Bhasin Contact info: [email protected] twitter: @parvinderb - scorpio Currently tested version: Magento version: Magento CE - 1.8 older MAGMI version: v0.7.17a older Download software link: Magento server:...

76M Households, 7M Businesses Impacted in JPMorgan Chase Breach

A securities filing on Thursday revealed that up to 76 million households and seven million small businesses, far more than initially thought, were implicated in the cyber attack that hit JPMorgan Chase over the summer, making it one of the largest data breaches in U.S. history. The New York-base...

Cicada-known Enterprise Portal system v2. 5 sql injection to admin-vulnerability warning-the black bar safety net

The problem is when the user modifies the information of the place /system/module/user/control.php public function edit$account = " if!$ account or RUNMODE == 'front' $account = $this-app-user-account; if$this-app-user-account == 'guest' $this-locateinlink'login'; if! empty$POST...

NativeChurch Theme - Arbitrary File Download

Description The NativeChurch WordPress theme was affected by an Arbitrary File Download security vulnerability. https://example.com/wp-content/themes/NativeChurch/download/download.php?file=../../../../wp-config.php...

The Fappening 3 — Jennifer Lawrence New Photos Leaked Online

It seems like there is no end of “celebrity photo leaks”. As part of the Fappening 3 hack, some new naked photos of Jennifer Lawrence have apparently been leaked online in the “third round” of celebrity photo leaks including, top model Cara Delevingne, actress Anna Kendrick. On Friday, new...

Phpok漏洞礼包组合可shell

简要描述： Phpok漏洞礼包，组合可shell 详细说明： 1.2处存储行xss 2.添加管理员帐号密码+利用点 3.后台写shell 1. 第一处 我们先来注册一个帐号。 其中帐号这内容为 a';document.write''// 注册好之后。 后台 需要点击才能激活xss 第二处 留言 留言主题...

Home Depot Urges Credit Monitoring Vigilance

Home Depot told its customers today to monitor their bank and credit card accounts for fraud as it continues to investigate the “unusual activity” on its networks that could turn out to be one of the biggest data breaches in U.S. history. “We’re looking into some unusual activity that might...

Apple Fixes Glitch in Find My iPhone App Connected to Celbrity Photo Leak

UPDATE–Apple has patched the vulnerability in its Find My iPhone app that likely was used in the attack that led to the publication of private photos belonging to dozens of celebrities over the weekend. The victims of the breach included actors, models and athletes such as Jennifer Lawrence and...

Nearly 100k Bugzilla Users Affected by Data Disclosure

The email addresses and encrypted passwords of nearly 100,000 users of Mozilla’s Bugzilla system were left on a publicly accessible server for several months earlier this year, the company said. The disclosure comes just a few weeks after Mozilla advised members of its Mozilla Developer Network t...

Heartbleed Exploit Linked to Community Health Data Breach

Update: The Heartbleed OpenSSL vulnerability is now the centerpiece of the Community Health Systems data breach. Dave Kennedy, CEO of security consultancy TrustedSec, said yesterday that three sources close to the CHS investigation told him that a Heartbleed exploit was the hackers’ initial way i...

IBM Sametime Meet Server 8.5 Cross Site Scripting

Exploit Title: IBM Sametime Meet Server 8.5 Reflect Cross Site Script Google Dork: intitle:"Meeting Center - IBM Lotus Sametime" Date: 11/08/2014 CVSS Score: http://nvd.nist.gov/cvss.cfm?calculator&version=2&vector=AV:N/AC:M/Au:N/C:P/I:N/A:N%29 CVE-ID:...

Xiaomi Phones Secretly Sending Users' Sensitive Data to Chinese Servers

Chinese telecoms equipment suppliers have previously been criticized by some countries due to suspected backdoors in its products, and if United States has banned its several major government departments, including NASA, Justice and Commerce Departments, from purchasing Chinese products and...

Thousands of Mozilla Developers Emails and Password Exposed Accidentally

Mozilla on Friday notified users of its Mozilla Developer Network MDN that the company has accidentally exposed the e-mail addresses and cryptographically protected passwords of thousands of Mozilla developers. The email addresses of over 76,000 members of its Developer Network, along with 4000...

Canada NRC Hit by Apparent Chinese Cyber Attack

One of Canada’s premier research and technology organizations was hit with a cyber-attack recently that forced the cooperative offline; the attack – which appears to be Chinese in origin – was so serious the organization is being forced to rebuild its entire system. The National Research Council ...

Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

Brute-Forcing Botnet Sniffs Out Lax POS Systems

Over a two-week time span earlier this year, a botnet composed of thousands of computers actively sought out and broke into exposed point of sale POS systems that used poor or default passwords. The botnet, dug up and dubbed BrutPOS by security firm FireEye, leveraged more than 5,000 machines and...

Brazilian Payment Fraud Campaign Steals Billions

UPDATE–Hackers are targeting Brazil’s Boleto payment system, the second most popular payment method in the country, and have conducted hundreds of thousands of fraudulent transactions, though researchers differ over how much money has been stolen. Formally known as Boleto Bancario, Boletos are...

ZEEJOBSITE 2.0 - Remote File Upload Vulnerability

No description provided by source. ZEEJOBSITE v2.0 remote file Upload author: ZoRLu msn: [email protected] home: www.z0rlu.blogspot.com dork: [email protected] date: 08/11/2008 aha simdi gönderiyorum saat 10:40 : first register to site you add this code your shell to head GIF89a;...

ProQuiz 2.0.2 - Multiple Vulnerabilities

No description provided by source. Exploit Title: ProQuiz v2.0.2 - Multiple Vulnerabilities Date: 18/7/2012 Author: L0n3ly-H34rT My Site: http://se3c.blogspot.com/ Contact: [email protected] Vendor Homepage: http://proquiz.softon.org/ Software Link:...