3140 matches found
ThinkSNS defense to bypass the idea(union select real unlimited sql injection)-vulnerability warning-the black bar safety net
ThinkSNS defense to bypass the 2 Detailed description: This code with the I good hard Ah. to: code area public function PostFeed // Return data format $return = array'status'=1, 'data'="; // The user to send content $d'content' = isset$POST'content' ? filterkeywordh$POST'content' : "; // Raw data...
WordPress zM Ajax Login & Register Plugin 1.0.9 Local File Inclusion Vulnerability
Exploit for php platform in category web applications Exploit Title: CVE-2015-4153 - WordPress zM Ajax Login & Register Plugin Local File Inclusion Date: 2015/06/01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://zanematthew.com/ Software Link:...
Google to Introduce New Photo-Sharing Platform to Kill Instagram
Google is reportedly going to launch a new online photo-sharing service and storage option at its developer conference later this month, which Bloomberg says, will not be a part of its Google+ social network. At the moment, Google offers a photo sharing service known as "Google+ Photos," which...
elFinder 2 Remote Command Execution (Via File Creation) Vulnerability
Exploit for php platform in category web applications + Author: TUNISIAN CYBER + Title: elFinder 2 Remote Command Execution Via File Creation Vulnerability + Date: 06-05-2015 + Vendor: https://github.com/Studio-42/elFinder + Type: WebAPP + Tested on: KaliLinux Debian + Twitter: @TCYB3R + Time Lin...
elFinder 2 - Remote Command Execution (via File Creation)
elFinder 2 - Remote Command Execution via File Creation + Author: TUNISIAN CYBER + Title: elFinder 2 Remote Command Execution Via File Creation Vulnerability + Date: 06-05-2015 + Vendor: https://github.com/Studio-42/elFinder + Type: WebAPP + Tested on: KaliLinux Debian + Twitter: @TCYB3R + Time...
HybridAuth Social Login - Less Critical - Information Disclosure - SA-CONTRIB-2015-097
HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. The module may store user passwords in plain text. This vulnerability is mitigated by the fact that the option "Ask user for...
MediaSuite CMS - Artibary File Disclosure
MediaSuite CMS - Artibary File Disclosure . | | / | | \ \ | | \ / | |\ / / /\ \ / \ | / ^ / / || / / / / /\ /\ \ \ \ | / \ / http://twitter.com/h4SEC / \ | \ \ Proof Video: https://www.youtube.com/watch?v=7yxbfD1YK8Y / // / \ / My + Author : KnocKout E-Mail : [email protected]...
X (Formerly Twitter): DOM based cookie bomb
Hi, I would like to report an issue that allows attackers to plant a "cookie bomb" on a victim's browser, so that the victim will be unable to access any Twitter services. PoC 1. Go to http://innerht.ml/pocs/twitter-dom-based-cookie-bomb/ 2. Click on the "DoS" link 3. Wait for a moment 4. Now...
X (Formerly Twitter): Privecy Issue : view "Protected users" followers and following
Hi When Twitter user account change his privacy settings =https://twitter.com/settings/security and enable "Protect my Tweets " others users "Not in the Follow list" should Not be able to see the user's follower an following list but I just found out away to see any Protected users" follower an...
X (Formerly Twitter): Privacy Issue on protected tweets
Hello Twitter Security Team, Problem: Here is a privacy issue that break your privacy for protected tweets. Details: I have two accounts on twitter @dia2diab and @Dia2diabTest , from the first one i changed the settings of Tweet privacy to be "Protect my Tweets" and now if you access one of my...
WordPress Plugin All In One WP Security & Firewall 3.9.0 - SQL Injection
Exploit Title : WordPress All In One WP Security & Firewall 3.9.0 SQL Injection Vulnerability Exploit Author : Claudio Viviani Vendor Homepage : https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/ Software Link :...
5 Biggest Hosting Companies hacked by Syrian Electronic Army
Once again, Syrian Electronic Army SEA has gain media attention by compromising a number of popular web hosting brands of one of the leading web-hosting companies Endurance International Group INC that manages over 60 different hosting brands. SEA, a pro-hacker group supposed to be aligned with...
X (Formerly Twitter): HTTP Response Splitting (CRLF injection) due to headers overflow
Hi, I would like to report another HTTP Response Splitting vulnerability caused by header fields "overflow" that allows attackers to inject arbitrary headers in the response. Note that this issue is similar to 52042 but the root cause is different. Also, the below PoC is not the only affected pag...
X (Formerly Twitter): XSS in twitter.com/safety/unsafe_link_warning
The following page has XSS. https://twitter.com/safety/unsafelinkwarning?unsafelink=vulnerableparam Steps to reproduce: 1. Go to the following URL using IE:...
X (Formerly Twitter): Insecure direct object reference - have access to deleted DM's
Hello, The bug is straight and simple, I have access to deleted DM's. Once a DM is deleted a user/app will still be able to access the DM's using show DM endpoint Attack Scenario ==================== Their are two accounts Sam and Molly , Sam Dm's Molly something important and both quickly delete...
Samsung Patches Social Media Vulnerability in Millions of Devices
Samsung patched a vulnerability last month in SNS Provider, a popular application that manages other social media apps present in millions of its devices. If exploited the bug could have given attackers the ability to access to any personal information users stored on Facebook, LinkedIn and...
X (Formerly Twitter): Twitter Ads Campaign information disclosure through admin without any authentication.
Hi Twitter !! I just wanted to report a major flaw which I found in https://ads.twitter.com , hoping it make twitter more secure and I am glad for being a part of it. Vulnerability Name: OWASP:A6 Sensitive data Exposure Vulnerable URL: https://ads.twitter.com/admin/accountstypeahead.json?query=...
X (Formerly Twitter): Cross site Port Scanning bug in twitter developers console
This vulnerability allow a port scanning a remote machine on internet . an attacker can scan a remote machine through this vulnerability using twitter ip as a proxy . The vulnerability exit on url https://dev.twitter.com/rest/tools/console through console an attacker can use GET or POST request...
Twitter Changes Abuse Reporting Process to Address Doxing
Twitter has revised and simplified its rules and process for reporting abusive behavior on the service, and users now have the ability to report people who are posting their personal information. The change essentially gives Twitter users a method to combat doxing, which is the process of dumping...