Suit Filed Against NSA, Obama Over Surveillance Program

A group of people, including a former federal prosecutor and the parents of a Navy SEAL sniper killed in action, have filed a class-action law suit against the National Security Agency, Verizon and President Obama over the NSA’s collection of cell phone data. The suit says the order that enabled...

Elastix 2.4.0 Cross Site Scripting Vulnerability

Elastix version 2.4.0 suffers from a cross site scripting vulnerability Exploit Title: elastix 2.4.0 XSS Vulnerability Date: 28/05/2013 Exploit Author: cheki Vendor Homepage: elastix.org Software Link: http://www.elastix.org/index.php/en/downloads/main-distro.html Version: Elastix 2.4.0 Stable CV...

SA-CONTRIB-2013-048 - Edit Limit - Access Bypass

Edit Limit enables you to set time and count-based limits on how and when a user can edit nodes or comments. The module doesn't sufficiently check user access when editing comments to see if the user has the necessary permissions to edit a comment outside of the limits applied by this module. Thi...

MayGion IP Cameras Firmware 09.27 - Multiple Vulnerabilities

MayGion IP Cameras Firmware 09.27 - Multiple Vulnerabilities Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...

SA-CONTRIB-2013-050 - Webform - Cross Site Scripting (XSS)

The Webform module allows the creation of custom webforms and surveys. Webform module does not sanitize the labels of created components fields when displaying a list of components to be used in e-mails or downloaded CSV files. This vulnerability is mitigated by the fact that an attacker must hav...

MayGion IP Cameras multiple vulnerabilities

Advisory ID Internal CORE-2013-0322 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Date published: 2013-05-28 Date of last update: 2013-05-28 Vendors contacted: MayGion Release mode: Coordinated release 2. Vulnerability Information Class:...

Zavio IP Camera Command Injection / Bypass

Core Security - Corelabs Advisory http://corelabs.coresecurity.com Zavio IP Cameras multiple vulnerabilities 1. Advisory Information Title: Zavio IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0302 Advisory URL:...

TP-Link IP Camera Hardcoded Credentials / Command Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com TP-Link IP Cameras Multiple Vulnerabilities 1. Advisory Information Title: TP-Link IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0318 Advisory URL:...

Struts2 remote code execution vulnerability(S2-0 1 3) temporary solutions-vulnerability warning-the black bar safety net

Struts2 again broke remote code execution vulnerability, specifically as detailed in the Struts2 remote code execution vulnerability analysisS2-0 1 3 of The following is the LH Team out of a temporary solution: Modified files: org. apache. struts2. views. util. DefaultUrlHelper 2 8 1–2 8 4 lines:...

Apache-Struts IncludeParams < 2.3.14.1 RCE Linux

Apache-Struts2 / OpenSymphony-Xwork RCE Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Wordpress Flagallery-Skins SQL Injection

Exploit Title : Wordpress Flagallery-skins plugin SQL Injection Exploit Author : Ashiyane Digital Security Team Home : www.ashiyane.org Security Risk : Medium Dork : inurl:/wp-content/plugins/flagallery-skins/compactmusicplayer/gallery.php?playlist= Tested on: Linux...

Moderate: Red Hat Security Advisory: Red Hat Network Satellite spacewalk-backend security update

Updated spacewalk-backend packages that fix one security issue are now available for Red Hat Network Satellite 5.3, 5.4, and 5.5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

WordPress Plugin ProPlayer 4.7.9.1 - SQL Injection

WordPress Plugin ProPlayer 4.7.9.1 - SQL Injection Exploit Title : WordPress ProPlayer Plugin SQL Injection Exploit Author : Ashiyane Digital Security Team Plugin Link : http://wordpress.org/plugins/proplayer/ Home : www.ashiyane.org Security Risk : High Version : 4.7.9.1 Dork :...

WordPress ProPlayer Plugin SQL Injection

Exploit Title : WordPress ProPlayer Plugin SQL Injection Exploit Author : Ashiyane Digital Security Team Plugin Link : http://wordpress.org/plugins/proplayer/ Home : www.ashiyane.org Security Risk : High Version : 4.7.9.1 Dork : inurl:wp-content/plugins/proplayer/playlist-controller.php?id= Teste...

SA-CONTRIB-2013-047 - Google Authenticator login - Access Bypass

This module will allow you to add Time-based One-time Password Algorithm also called "Two Step Authentication" or "Multi-Factor Authentication" support to user logins. It works with Google's Authenticator app system and support most if not all OATH based HOTP/TOTP systems. Accidental removal of...

Memory corruption found using Address Sanitizer — Mozilla

Security researcher Abhishek Arya Inferno of the Google Chrome Security Team used the Address Sanitizer tool to discover a series of use-after-free, out of bounds read, and invalid write problems rated as moderate to critical as security issues in shipped software. Some of these issues are...

Low: Red Hat Security Advisory: hypervkvpd security and bug fix update

An updated hypervkvpd package that fixes one security issue and one bug is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

AlienVault OSSIM 4.1.2 SQL Injection Vulnerability

AlienVault OSSIM versions 4.1.2 and below suffer from remote SQL injection vulnerabilities. RunRunLevel Web Security Research - AlienVault OSSIM multiple SQL Injection vulnerabilities Vendor Website : http://www.alienvault.com INDEX --------------------------------------- 1. Background 2...

Hacker insulted Thai Prime Minister, official website defaced with abusive comments

The official website of the Office of the Thai Prime Minister was quickly taken down after a hacker defaced the website with abusive message pasted next to an altered photograph of a laughing Prime Minister Yingluck Shinawatra. The words "I'm a slutty moron" appeared briefly alongside a picture o...

AlienVault OSSIM 4.1.2 SQL Injection

RunRunLevel Web Security Research - AlienVault OSSIM multiple SQL Injection vulnerabilities Vendor Website : http://www.alienvault.com INDEX --------------------------------------- 1. Background 2. Description 3. Affected Products 4. Vulnerabilities 5. Solution 6. Credit 7. Disclosure Timeline 1...