chromium -- multiple vulnerabilities

Google Chrome Releases reports: 172342 High CVE-2013-0916: Use-after-free in Web Audio. Credit to Atte Kettunen of OUSPG. 180909 Low CVE-2013-0917: Out-of-bounds read in URL loader. Credit to Google Chrome Security Team Cris Neckar. 180555 Low CVE-2013-0918: Do not navigate dev tools upon drag an...

WordPress Finalist SQL Injection

++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++ ++++++++++++++++ Exploit Title: wordpress finalist plugins SQL injection Vulnerability Exploit Author: Ashiyane Digital Security Team Home : www.Ashiyane.org Vendor Homepage: www.thefaceshop.com.sg Software Link:...

Innovative Web Ideas SQL Injection

Exploit Title: Innovative Web Ideas CMS SQL injection Vulnerability Exploit Author: Ashiyane Digital Security Team Home : www.Ashiyane.org Vendor Homepage: www.parasdairy.com Software Link: www.midas.com.np Tested on: Windows 7 Dork: intext:"Powered by : Innovative Web Ideas" & inurl:id=...

WordPress Level Four Storefront SQL Injection

Exploit Title: wordpress plugin v3 level four storefront SQL injection Vulnerability Exploit Author: Ashiyane Digital Security Team Home : www.Ashiyane.org Vendor Homepage: www.clubhousenairn.co.uk Software Link: www.levelfourstorefront.com version:3 Tested on: Windows 7 Dork:...

Plan B SQL Injection

Exploit Title: Plan B CMS SQL injection Vulnerability Exploit Author: Ashiyane Digital Security Team Home : www.Ashiyane.org Vendor Homepage: www.clubhousenairn.co.uk Software Link: www.planbonline.co.uk Tested on: Windows 7 Dork: intext:"Website Development: Plan B" & inurl:id=...

South Korea Cyber Attack, Wiper malware and Chinese IP Address

Yesterday we reported about a massive Cyber attack on South Korea that was responsible for shutting down networks of South Korean banks and TV broadcasters. Police are still investigating the cyber attack but the country's Communications Commission has revealed that the hacking originated from a...

WordPress LeagueManager插件'league_id'参数SQL注入漏洞

BUGTRAQ ID: 58503 CVECAN ID: CVE-2013-1852 WordPress LeagueManager是管理和显示Sports Leagues的插件。 LeagueManager 3.8及其他版本在leaguemanagerexport页面内的'leagueid'参数的实现上存在SQL注入漏洞，利用此漏洞可允许攻击者执行未授权数据库操作。 0 WordPress LeagueManager 3.8 厂商补丁： WordPress --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

WordPress Plugin LeagueManager 3.8 - SQL Injection

!/usr/bin/ruby Exploit Title: WordPress LeagueManager Plugin v3.8 SQL Injection Google Dork: inurl:"/wp-content/plugins/leaguemanager/" Date: 13/03/13 Exploit Author: Joshua Reynolds Vendor Homepage: http://wordpress.org/extend/plugins/leaguemanager/ Software Link:...

SA-CONTRIB-2013-034 - Node Parameter Control - Access Bypass

This module enables you to limit the visibility of the fields on the node edit form. The module doesn't sufficiently check access before allowing users to view and edit the configuration options allowing anonymous and authenticated users the ability to view and edit the configuration options. CVE...

Facebook hacking accounts using another OAuth vulnerability

Remember the last OAuth Flaw in Facebook, that allow an attacker to hijack any account without victim's interaction with any Facebook Application, was reported by white hat Hacker 'Nir Goldshlager'. After that Facebook security team fixed that issue using some minor changes. Yesterday Goldshlager...

CentOS Update for libipa_hbac CESA-2013:0508 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Ryan McGeehan and Chad Greene

Ryan McGeehan, the director of incident response at Facebook and Chad Greene, the manager of the Facebook CERT on Thursday both explained how the social network has planned red team exercises in the past to prepare the company’s security team for a real attack...

Slideshow: Scenes from CanSecWest 2013

VIEW SLIDESHOW Scenes from CanSecWest 2013 The CanSecWest security conference in Vancouver last week included technical presentations on bypassing ASLR and DEP and the intricacies of Android research, as well as a fascinating talk on the red team exercises Facebook’s security team runs. We put...

Phishers hijacking Facebook Pages using apps

Another phishing campaign come in action recently targeting Facebook accounts and company pages with millions of followers. Phishers continue to devise new fake apps for the purpose of harvesting confidential information. Not a new method, but very creative phishing example in Facebook hacking...

Phishers hijacking Facebook Pages using apps

Another phishing campaign come in action recently targeting Facebook accounts and company pages with millions of followers. Phishers continue to devise new fake apps for the purpose of harvesting confidential information. Not a new method, but very creative phishing example in Facebook hacking...

SA-CONTRIB-2013-033 - Simple Corporate theme - Cross Site Scripting (XSS)

This third-party contributed theme change Drupal's interface. The theme doesn't properly sanitize user-entered content in the 3 slide gallery on the homepage leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would have to have the...

SA-CONTRIB-2013-025 - Fresh Theme - Cross Site Scripting (XSS)

This third-party contributed theme change Drupal's interface. The theme doesn't properly sanitize user-entered content in the 3 slide gallery on the homepage leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would have to have the...

SA-CONTRIB-2013-030 - Clean Theme - Cross Site Scripting (XSS)

This third-party contributed theme change Drupal's interface. The theme doesn't properly sanitize user-entered content in the 3 slide gallery on the homepage leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would have to have the...

SA-CONTRIB-2013-028 - Responsive Blog Theme - Cross Site Scripting (XSS)

Responsive Blog Theme is a light weight Drupal 7 theme with a modern look and feel. The theme doesn't properly sanitize user-entered content in the social icon leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would have to have the...

SA-CONTRIB-2013-031 - Premium Responsive theme - Cross Site Scripting (XSS)

This third-party contributed theme change Drupal's interface. The theme doesn't properly sanitize user-entered content in the 3 slide gallery on the homepage leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would have to have the...