Full Disclosure Security Mailing List Shuts Down

The Full Disclosure security mailing list, which has been one of the main discussion forums for vulnerability and exploit information for 12 years, is shutting down because “‘one of our own’ would undermine the efforts of the last 12 years”, one of the creators said. John Cartwright, one of the...

Chat2 Cross Site Scripting / SQL Injection

Exploit Title: Chat2 Blind SQL Injection Chat2 Cross site scripting Date: 2014 18 March Author: Dr.3v1l Tested on: Windows Category: webapps Google Dork: inurl:"/chatrooms.php" + Exploit SQL: http:///Chat2/jumpin.php URL encoded POST input userid was set to :...

Twitter enables StartTLS for Secure Emails to prevent Snooping

TWITTER is taking users' privacy and security very seriously and in an effort to prevent Government snooping, the company has secured your Twitter emails with with TLS Transport Layer Security. Twitter emails were previously using a plain text communication protocol, that now has been upgraded to...

Justin Bieber Twitter account hacked, Spammed malicious links to 50 Million Followers

Pop Singer Justin Bieber's Twitter account hacked for around 15 minutes before it was corrected! The Twitter account with 50.2 Million Followers was compromised i.e. Twitter account with the second most Twitter followers. Spammers tweeted in Indonesian language from his hacked account with the...

Dilbert Cross Site Scripting

================================================================================ Cross Site Scripting on The Official Dilbert Website ================================================================================ Site: www.dilbert.com Date: 25/02/2014 Author: s4r4d0 Contact: s4r4d0atyahoodotcom...

Phabricator: Login CSRF using Twitter OAuth

This bug is related to bug report 774 Log in a user to another account by @dawidczagan as this bug also allows a user to be logged in as the attacker. The main reason is that no state is maintained in the authentication flow. Although the Twitter flow still uses OAuth 1.0A, which has no state...

Interpretation of the Bible – exploits the intermediate level skills of analysis-vulnerability warning-the black bar safety net

Inscription: From the last update feel has been a long, long time, and what time less are excuses himself becomes the lazy's true, give us an apology, after the update will speed up, today do not speak the vulnerability analysis, with me to discuss the exploits of some of the principles on the...

[Twitter Password Dump v2.0] Command-line Tool to Recover Twitter Password from Web Browsers

Twitter Password Dump is the command-line tool to instantly recover your lost Twitter password from all the popular web browsers. Currently it can recover your Twitter password from following applications, Firefox Internet Explorer v6.x - v10.x Google Chrome Chrome Canary/SXS CoolNovo Browser Ope...

Pina CMS - Multiple Vulnerabilities

Pina CMS - Multiple Vulnerabilities Title: Pina CMS SQL Injection and XSS Vulnerabilities Vendor: www.pinacms.com Vendor Notified: 15-02-2014 Vendor Replied: 16-02-2014 Release in Public: 18-02-2014 Tested on: Windows/Linux Author/Found by: Shadman Tanjim Website: www.secupent.com and...

Pina CMS - Multiple Vulnerabilities

Title: Pina CMS SQL Injection and XSS Vulnerabilities Vendor: www.pinacms.com Vendor Notified: 15-02-2014 Vendor Replied: 16-02-2014 Release in Public: 18-02-2014 Tested on: Windows/Linux Author/Found by: Shadman Tanjim Website: www.secupent.com and www.vulnerability.io Email: [email protected]...

Forbes Hacked by Syrian Electronic Army; Website and Twitter accounts Compromised

Forbes is the latest victim in a long line of high-profile attacks by the Syrian Electronic Army SEA, sending a reminder to the international community that cyber warfare is alive and well. The pro-Assad group also took responsibility for hacking multiple Forbes websites and hijacked three Twitte...

CVE-2013-0234

Cross-site scripting XSS vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the paramstwitterusername parameter to action/widgets/save...

Cross site scripting

Cross-site scripting XSS vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the paramstwitterusername parameter to action/widgets/save...

CVE-2013-0234

CVE-2013-0234 is a cross-site scripting (XSS) vulnerability affecting the Twitter widget in Elgg prior to 1.7.17 and 1.8.x prior to 1.8.13. The issue allows remote attackers to inject arbitrary web script or HTML through the params[twitter_username] parameter to action/widgets/save. Multiple conn...

CVE-2013-0234

Cross-site scripting XSS vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the paramstwitterusername parameter to action/widgets/save...

CNN's Twitter, Facebook and website hacked by Syrian Electronic Army

A well-known pro-Syrian hacker group known as Syrian Electronic Army SEA, aligned with President Bashar al-Assad, who successfully attacked The New York Times, Huffington Post, and Twitter, BBC, National Public Radio, Al-Jazeera, Microsoft, Xbox, Skype and responsible for cyber-attacks against...

[Social Password Decryptor v4.0] All-in-one Social Network Password Recovery Software

Social Password Decryptor is the FREE software to instantly recover Passwords for popular Social Networks such as Facebook, Twitter, Google Plus etc. It can automatically discover and recover all the social passwords stored by web browsers & messengers including Firefox, Chrome, IE, GTalk and mor...

ASUS RT-N56U Remote Root

!/usr/bin/env python from time import sleep from sys import exit import urllib2, signal, struct, base64, socket, ssl Title: ASUS RT-N56U Remote Root Shell Exploit - appsname Discovered and Reported: October 2013 Discovered/Exploited By: Jacob Holcomb/Gimppy - Security Analyst @ ISE Contact: Twitt...

Twitter Forces HTTPS Connections to its API

UPDATE: As of yesterday, Twitter’s application programming interface API will only recognize traffic traveling via Transport Layer Security TLS or Secure Sockets Layer SSL. Any applications connecting to the API in plaintext will no longer work. There is a vast selection of third-party Twitter...

[Twitter Password Decryptor v5.0] Recover Lost Twitter Password from all Web Browsers & Messengers

Twitter Password Decryptor is the FREE software to instantly recover Twitter account passwords stored by popular web browsers. Most web browsers store the login passwords for visited websites so that user don't have to remember and enter the password every time. Each of these web browsers use the...