Uber: SMS/Call spamming due to truncated phone number

Due to improperly validation of phone numbers during the Android Rider sign-up, it was possible to spam a phone number with verification calls and texts. By inputting an 11 or 12 digit phone number, it would be truncated to 10 digits, resulting in the same number from varying inputs...

Backdoored D-Link Router Should be Trashed, Researcher Says

A researcher who found a slew of vulnerabilities in a popular router said it’s so hopelessly broken that consumers who own them should throw them away. Pierre Kim said attackers could easily exploit the vulnerabilities and use the device as a spamming zombie or a man-in-the-middle tool. “I advise...

Gratipay: An adversary can harvest email address for spamming.

The website is displaying email address. These email address can be harvested by automated programs called bots and then used as a target for spamming. 1. Use any Email extractor tool or Add on. Here I have used Chrome Email Extractor Add on offered by Mr. Alien. 2. In Browser open...

Gratipay: Mail spaming

Hello, We can bomb spam any email we want using your website. POC : 1.register 2.go to https://gratipay.com/hussein98d/emails/ and add your victim's email 3.start intercepting requests and click on "resend" 4.replay the same request many time , the victim's email will be spammed with Gratipay...

Mumblehard Malware Targets Linux and FreeBSD Servers

Thousands of computers and web servers running Linux and FreeBSD operating systems have been infected over past five years with sophisticated malware that turn the machines into spambots. The new Linux malware, discovered by the security researchers from the antivirus provider Eset, has been dubb...

X (Formerly Twitter): Improper Verification of email address while saving Account Settings

Signup for Ads on twitter and navigate to "Account Settings" on ads.twitter.com/accounts Enter any email address and save Account Settings. Notice that the email address gets updated successfully. There is no verification email that is sent out to confirm that the email account updated actually...

DCP-Portal 5.5 advertiser.php password Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/8739/info Multiple SQL Injection vulnerabilities have been discovered that affect DCP-Portal scripts. These issues are likely due to a lack of sufficient sanitization performed on user supplied URI parameters. Attacks hav...

IBM OmniFind Crawler Denial of Service Vulnerability

No description provided by source. Crawler endless loop CVE-2010-3899 The crawler has no recursion depth limit. A site with dynamic parameter manipulation can cause an endless loop. This loop will block the crawler thread and use permanent server resources. Too many blocks can lead to a denial of...

Evilsentinel <= 1.0.9 (multiple vulnerabilities) Disable Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo ' Evilsentinel = 1.0.9 Disable Exploit by BlackHawk [email protected] http://itablackhawk.altervista.org Thanks to rgod for the php code and Marty for the Love '; if $argc3 echo Usage: php .$argv0. Host Path newmail...

WePay: CSRF on email address operations. Also performing unintended operations.

After authentication in the WePay application, a user can navigate to the "My Settings" tab and perform operations like makeprimary and resend on the email addresses. These operations do not have any CSRF tokens present in the request. The only value unknown to an attacker present in the request ...

Vulnerabilities in HVM MSI injection

ISSUE DESCRIPTION The implementation of the HVM control operation HVMOPinjectmsi, while checking whether a particular IRQ was already set up in the necessary way, fails to properly check all respective conditions. In particular it doesn't check the returned pointer for being non-NULL before de-...

HackerOne: Spamming any user from Reset Password Function

It is possible to spam any user whose email-id is known. This can be combined with csrf attack i.e automated to send 50 emails with a click. This is reset password form --- Forgot password To retrieve your password enter the email address you used to sign up. Here, authencity token can be used mo...

IRCCloud: Unwanted Spamming Using CSRF [LOGGED IN USER]

ALL DETAILS INCLUDING FIX IS IN VIDEO...

Vulnerability in Facebook discloses Primary Email Address of any account

When you sign up on Facebook, you have to enter an email address and that email address becomes your primary email address on Facebook. In a recent disclosure by a Security researcher, Stephen Sclafani - The Social Networking site Facebook was vulnerable to disclosure of primary email address of...

Phishers hijacking Facebook Pages using apps

Another phishing campaign come in action recently targeting Facebook accounts and company pages with millions of followers. Phishers continue to devise new fake apps for the purpose of harvesting confidential information. Not a new method, but very creative phishing example in Facebook hacking...

Phishers hijacking Facebook Pages using apps

Another phishing campaign come in action recently targeting Facebook accounts and company pages with millions of followers. Phishers continue to devise new fake apps for the purpose of harvesting confidential information. Not a new method, but very creative phishing example in Facebook hacking...

Rodpicom Botnet spreading via Skype and MSN Messenger

Malwares are getting updated during the age of social networking. FortiGuard Labs researchers have discovered a new malware called 'Rodpicom Botnet' that spreads via messaging applications such as Skype and MSN Messenger. Dubbed W32/Rodpicom.A - Rodpicom Botnet sends a message to the victim with ...

Philippine court suspends Anti Cybercrime law

The Philippine Supreme Court on Tuesday suspended implementation of Republic Act 10175 or the Cybercrime Prevention Act for 120 days, while it decides whether certain provisions violate civil liberties. The law, signed last month, aims to combat Internet crimes such as hacking, identity theft,...

Role of free Hosting in Cyber Crime

Role of free Hosting in Cyber Crime Zscaler experts notice that free hosting and DNS providers abused for hosting Phishing Pages, Spamming, Botnets or Malwares. Many free hosted sites considered as spam. They list "x90x.net" Free hosting Provider which used to host many Facebook Phishing sites...

HITB2011KUL - Attacking Privacy of Social Network Users

Document Title: =============== HITB2011KUL - Attacking Privacy of Social Network Users References: =========== Download: http://www.vulnerability-lab.com/resources/videos/425.wmv View: http://www.youtube.com/watch?v=xGuV0Om67n8 Release Date: ============= 2012-02-05 Vulnerability Laboratory ID...