653 matches found
Unity 3D Forums Hacked by OurMine Hacking Group
By Waqas The OurMine hackers are back in the news again. This time the group hacked and defaced the official domain of Unity 3D Forums leaving a deface page along with a note over the weekend. The hack which took place on 30th April allowed the Saudi Arabia-based OurMine hacking group to...
Automattic: Cross Domain leakage of sensitive information - Leading to Account Takeover at Instagram Brand
Product / URL https://instagram-brand.com/register/reset/?email= Description and Impact After a user clicks on the password reset link obtained in inbox, the page for password resetting functionality opens. If you monitor the HTTP Requests that are done while that page is loaded, you will come to...
the php framework slim architecture on the presence of the XXE vulnerability, XXE typically present in the form of-vulnerability warning-the black bar safety net
Modern cms framework laraval/symfony/slim, leading to today's php vulnerability appears point, principle, using method, has undergone some changes, this series can hope to summarize their excavation of such a cms vulnerability. slim is one of the design ideas ahead of the well-known of php light...
Debian GNU/Linux Compromise Security
The multiple vulnerabilities of the ibfillisqlda function in the DBD-Firebird database driver for the Debian GNU/Linux operating system are caused by a buffer overflow in the stack. Exploitation of these vulnerabilities could allow an attacker to compromise security measures...
Bumble: crossdomain.xml too permissive on eu1.badoo.com, us1.badoo.com, etc.
Description The file crossdomain.xml that is hosted at https://eu1,us1,etc.badoo.com/crossdomain.xml is too permissive in the scope of allowed domains to access the content in the domain using Flash. When you contact Badoo via https://us1.badoo.com/feedback/, you can upload a file. This file can ...
PT-2015-2332
Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 18.0.0.252 Adobe Flash Player versions 19.x prior to 19.0.0.207 Adobe AIR versions prior to 19.0.0.213 Adobe AIR SDK versions prior to 19.0.0.213 Adobe AIR SDK & Compiler versions prior to 19.0.0.213...
PT-2015-2285
Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.11 Description The issue is related to the TLS Handshake Protocol implementation in Secure Transport, which accepts a Certificate Request message within a session where no Server Key Exchange message has been...
ZTE GPON F427 Authorization Bypass / Cleartext Password Storage
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Title: ZTE GPON F427 and possibly F460/F600 - authorization bypass and cleartext password storage Author: Jerzy Patraszewski Date: 10 July 2015 Affected software : =================== ZTE GPON: F427 Version: V3.0 Firmware Image:...
Experian Breach Spills Personal Info of 15 Million T-Mobile Customers
A massive data breach at the credit-reporting agency Experian could wind up having major implications for 15 million T-Mobile customers. The telecom uses the agency, one of the “big three” credit reporting bureaus, to check the credit ratings of its customers. News broke last night however that a...
Max Ping Echo Reply Size
An attacker might send an echo reply with large data, trying to compromise the security of the victim's machine...
Chinese Telecom Routes Russian Domestic Internet Traffic through China
Russian Internet traffic, including the domestic one, has continuously been re-routed outside the country due to routing errors by China Telecom, which could result in compromising the security of Russian communications. Internet monitoring service Dyn reported Thursday in a blog post that the...
NSA-Approved Samsung Knox Stores PIN in Cleartext
A security researcher has tossed a giant bucket of ice water on Samsung’s thumbs up from the NSA approving use of certain Galaxy devices within in the agency. The NSA’s blessing, given under the agency’s Commercial Solutions for Classified Program, meant that the Samsung Galaxy 4, 5 and Galaxy No...
Solaris 2.3/2.4/2.5/2.5.1/2.6/7.0 snoop (print_domain_name) Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/858/info If a solaris machine is running snoop in verbose mode, it may be possible to compromise its security remotely by exploiting a buffer overflow in snoop. The problem is a buffer with a predefined length of 1024 tha...
MapInfo Discovery 1.0/1.1 MapFrame.asp mapname Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/10927/info Multiple remote vulnerabilities are reported in MapInfo Discovery. The first issue is reported to be an information disclosure vulnerability. An attacker may gain access to potentially sensitive error log...
Allaire JRun 2.3 Arbitrary Code Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1831/info Jrun contains a vulnerability that allows a user to compile and execute JSP code from an arbitrary file on the webserver's filesystem. This bug is due to the way JSP execution is invoked -- if a requested...
anaconda clipper 3.3 - Directory Traversal vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2512/info Clipper is a headline-gathering tool from Anaconda! Partners which, in certain versions, is vulnerable to directory traversal attacks. By including '/../' sequences in requested URLs, an attacker can cause the...
Docker 0.11 - VMM-Container Breakout
Docker 0.11 - VMM-Container Breakout / shocker: docker PoC VMM-container breakout C 2014 Sebastian Krahmer Demonstrates that any given docker image someone is asking you to run in your docker setup can access ANY file on your host, e.g. dumping hosts /etc/shadow or other sensitive info,...
PF Chang's China Bistro Confirms Credit and Debit Card Breach
Following the massive data breaches at eBay, Neiman Marcus Group and Michaels Stores, yet another private equity company Centerbridge Partners-backed restaurant chain P.F. Chang’s China Bistro suffered a potential Credit and Debit card data breach. The Asian-themed casual dining restaurant chain...
PT-2014-1230
Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 5.0u61, 6u71, 7u51, and 8 JRockit versions R27.8.1 and R28.3.1 Java SE Embedded version 7u51 Description The issue affects confidentiality and integrity via unknown vectors related to Security. It is associated with...
