Google Android SMS and MMS Message Tampering Vulnerability

Google Android is an open source operating system based on Linux, mainly used in portable devices. A security vulnerability exists in Google Android, which allows malicious applications to exploit the vulnerability to tamper with the sending and receiving status of SMS and MMS messages to carry o...

The vulnerability of the iOS operating system, which allows a hacker to trigger a device service failure.

The vulnerability of the iOS operating system is related to errors in the code. Exploiting this vulnerability allows a malicious actor to cause a device to fail to respond to service requests by sending a specially crafted Unicode text message, which is not properly processed when sent via SMS or...

Security Advisory-Authentication Bypass Vulnerability on E587 Mobile WiFi

Huawei E587 products have an authentication bypass vulnerability that could be exploited by an attacker to graft commands to obtain and change configuration information, send short messages, and restart the device without login Vulnerability ID: HWPSIRT-2015-02001. This Vulnerability has been...

Gallery Bank <= 3.0.101 - SQL Injection

The Gallery Bank – Responsive Photo Gallery plugin exposes a Short Code named ‘gallerybank’, in order to allow site publishers to insert galleries into pages / posts. This Short Code is vulnerable to a UNION based SQL Injection. This is possible by manipulating the field ‘showalbums’ when using...

phpyun 某漏洞可导致被脱裤

简要描述： rt 详细说明： https://images.seebug.org/upload/201502/091901402eced8dfc9c75ab0fb6f29e24b27dc7a.png 用cmd跳到php云的/data/backup/目录 然后再输出 “dir /x”执行 可以看到短文件名 http://localhost/phpyun/data/backup/PHPYUN1.SQL PHPYUN此处数字递增.SQL 0-N 手工都可以找出来 漏洞证明： Windows short filenames...

WordPress Contact Form DB 2.8.26 Cross Site Scripting

Title: WordPress 'Contact Form DB' plugin - XSS Version: 2.8.26 Author: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2015/01/26 Download: https://wordpress.org/plugins/contact-form-7-to-database-extension/ Contacted WordPress: 2015/01/26...

Codiad short_name Cross-Site Scripting Vulnerability

Codiad is an open source Web-based IDE application for writing and editing code online . A cross-site scripting vulnerability exists in Codiad components/filemanager/dialog.php, which allows injection of arbitrary web script or HTML via the shortname parameter, which can obtain sensitive...

MailMax-4.6-POP3-

MailMax v4.6 POP3 "USER" Remote Buffer Overflow Exploit No Login Needed Newer version's not tested, maybe vulnerable too A hard one this, the shellcode MUST be lowercase. Plus there are many opcode's that break the payload and opcodes that gets changed, like "\xc3" gets converted to "\xe3", and...

GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Malicious Git and Mercurial HTTP Server For CVE-2014-9390', 'Description' = %q This module exploits CVE-2014-9390, which affect...

Malicious Git and Mercurial HTTP Server For CVE-2014-9390

This module exploits CVE-2014-9390, which affects Git versions less than 1.8.5.6, 1.9.5, 2.0.5, 2.1.4 and 2.2.1 and Mercurial versions less than 3.2.3 and describes three vulnerabilities. On operating systems which have case-insensitive file systems, like Windows and OS X, Git clients can be...

Cisco Aironet DHCP Denial of Service Vulnerability

A vulnerability in the DHCP subsystem of Cisco Aironet access points could allow an unauthenticated, adjacent attacker to create a denial of service condition. The vulnerability is due to an error condition that may occur when very short DHCP leases are in use. If an attacker can prevent the acce...

Information disclosure

The Short Stories aka com.ireadercity.c48 application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7509

The A Very Short History of Japan aka com.ireadercity.c51 application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7491

The CVE-2014-7491 entry concerns The Short Stories (com.ireadercity.c48) Android app, version 3.0.2. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive information via a crafted certific...

CVE-2014-7509

CVE-2014-7509 affects the Android app “A Very Short History of Japan” (package com.ireadercity.c51) v3.0.2, which does not verify X.509 certificates in SSL, enabling MITM attackers to spoof servers and exfiltrate sensitive data via a crafted certificate. Root cause: missing server certificate val...

CVE-2014-7491

The Short Stories aka com.ireadercity.c48 application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Each of the big CMS vendor CMS the presence of of the same design flaws-vulnerability warning-the black bar safety net

Brief description: In order to write this exploit I have downloaded a lot of CMS doing a lot of experiments, and. Most of which are talked about are the dark clouds already on the Register of vendors, including: Ecshop, And PHPwind, and 74CMS, etc... Here is submitted to on the one hand in order ...

fkey <= 0.0.2 - Local File Accessibility Exploit

No description provided by source. / fkeyv0.0.2: local/remote file accessibility exploit. by: vade79/v9 [email protected] fakehalo/realhalo netris homepage/URL: http://www.freshmeat.net/projects/fkey compile: gcc xfkey.c -o xfkey syntax: ./xfkey /etc/shadow 2/savefilename bug: fkey is a finger-like...

Invision Power Board <= 3.3.4 unserialize Regex Bypass

No description provided by source. ?php / So this is the patch that sanitizes, static public function safeUnserialize $serialized // unserialize will return false for object declared with small cap o // as well as if there is any ws between O and : if isstring $serialized && strpos $serialized, \...

Microsoft Windows 2000/2003/XP Keyboard Event Privilege Escalation Weakness

No description provided by source. source: http://www.securityfocus.com/bid/14743/info Microsoft Windows is prone to a privilege escalation weakness. This issue is due to a design error when desktop applications handle keyboard events sent through the keybdevent function. The specific issue is th...