Threat Outbreak Alert: Fake Bank Statement Notification Email Messages on August 1, 2013

Medium Alert ID: 30275 First Published: 2013 August 1 14:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank statement notification for the recipient. The text in the email message attempts to convince the recipien...

Apple’s Developer Center Offline for 32 Hours; Compromised ?

It’s been over a day now since Apple’s online Dev Center went offline, and latest message can be seen in the screenshot, which explains that the current maintenance has took a lot longer than they expected. "We apologize that maintenance is taking longer than expected. If your program membership...

apache24 -- several vulnerabilities

Apache HTTP SERVER PROJECT reports: moddav: Sending a MERGE request against a URI handled by moddavsvn with the source href sent as part of the request body as XML pointing to a URI that is not configured for DAV will trigger a segfault. modsessiondbd: Make sure that dirty flag is respected when...

Cross site scripting

Cross-site scripting XSS vulnerability in viewcreate.php aka the Create View page in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message...

Serva32 2.1.0 TFTPD service buffer overflow vulnerability

Overview Serva32 2.1.0 TFTPD service contains a buffer overflow vulnerability. Description The Serva32 2.1.0 TFTPD service contains a buffer overflow vulnerability when parsing large read requests. When the application reads in a large buffer the application crashes. --- Impact An unauthenticated...

Henry Schein Dentrix G5 uses hard-coded database credentials shared across multiple installations

Overview Henry Schein Dentrix G5, a dental practice management software suite, uses hard-coded database access credentials that are shared across multiple installation sites. An attacker who is able to obtain the credentials for one site may be able to gain access to other sites using the same...

Dell PowerConnect 6248P series switch denial of service vulnerability

Overview Dell PowerConnect 6248P series switches contain a denial of service vulnerability when parsing malformed requests. Description Dell PowerConnect 6248P series switches contain a denial of service vulnerability when parsing malformed requests which could cause the switch to crash and becom...

CS-Cart v3.0.4 configured with PayPal Standard Payments design vulnerability

Overview CS-Cart v3.0.4 and possibly other versions configured with PayPal Standard Payment is susceptible to a client-side attack that results in an attacker purchasing items without having to pay for them. Description It has been reported that CS-Cart v3.0.4 configured with PayPal Standard...

A lightweight php framework full-Station injection-vulnerability warning-the black bar safety net

http://www.cephp.com/ Baidu search lightweight php framework, the first one is this CEPHP, hand cheap under test actually exists injection, download the source code and actually found the whole Station involved in the database operation of all the presence of injection, the variable is completely...

CentOS Update for mysql CESA-2013:0121 centos5

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Google Chrome blocks access to Twitpic for Malware risk

Suddenly today Google Chrome start detecting Twitpic.com as malware threat. Twitpic is one of the most popular website for Sharing photos and videos on Twitter. Twitpic denies and said that there is no malware on the website and is trying to contact Google. We also notice that, Twitter profiles a...

Discuz X2 后台getshell(当mysql为root时）

简要描述： 危险语句过滤，可以绕过 详细说明： 最近帮朋友看了一个站，DZx2的，拿到了创始人都没办法getshell 百度无果，自己本地架设了一下 1，当mysql是root时 站长---数据库---升级 尝试 select '1' into outfile 'E:\2.txt' 会提示 Type 查询语句安全威胁 Query select '1' into outfile 'E:\2.txt' 为什么会这样呢？ \config\configglobal.php中 限制了into outfile函数 尝试绕过 /!select/ '1' /!into outfile/ 'E:\3.tx...

Buffer overflow

Buffer overflow in IBM Informix 11.50 through 11.50.xC9W2 and 11.70 before 11.70.xC7 allows remote authenticated users to execute arbitrary code via a crafted SQL statement...

Sensitive information of 1 Million people breached at Nationwide Insurance

Nationwide Insurance was breached last week and Sensitive information of about 1 Million people is at risk. The FBI is investigating a breach, including policy and non-policy holders. Nationwide mailed notices to all affected individuals last Friday. Insurance Commissioner Ralph Hudgens issued th...

Anonymous Takes Down NISD Over Student Tracking

Hacker group Anonymous claims he took down North-side Independent School District's website www.NISD.net on Saturday to protest the district's use of tracking badges. On Sunday, Nov. 25, the same hacktivist released a statement via Pastebin giving the school district "1-3 days" to meet with paren...

ZPanel <= 10.0.1 CSRF/XSS/SQLi/Password Reset

Exploit for multiple platform in category web applications Exploit Title: ZPanel = 10.0.1 CSRF, XSS, SQLi, Password Reset Date: 04/11/2012 Exploit Author: pcsjj Vendor Homepage: http://www.zpanelcp.com/ Version: 10.0.1 Software Link: http://sourceforge.net/projects/zpanelcp/files/latest/download...

Baidu Ueditor Open Source Editor for the Java version of jsp file upload vulnerability-vulnerability warning-the black bar safety net

The system default file upload process jsp filter is not strict cause can upload a jsp file,the jsp, you know how system privileges can execute arbitrary commands ! The problem is in the imageUp. jsp here use java regular expression to validate the uploaded file file name Re-set the file name whe...

Mutiny Technology virtual appliance command injection vulnerability

Overview The Mutiny Technology virtual appliance contains a command injection vulnerability which could allow an attacker to inject commands into the appliance. Description CWE-77: Improper Neutralization of Special Elements used in a Command 'Command Injection'The Mutiny Technology virtual...

Key Systems Electronic Key Lockers command injection and weak authentication vulnerabilities

OVERVIEW Key Systems Electronic Key Lockers contain a command injection vulnerability which may allow a remote unauthenticated attacker to inject commands into the electronic key locker. Key Systems Electronic Key Lockers also contains weak authentication which could allow an attacker...

PhpTax pfilez Parameter Exec Remote Code Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "PhpTax pfilez...