CVE-2013-5157

The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter daemon interfaces, which allows attackers to post Tweets via a crafted app that sends direct requests to the daemon...

CVE-2013-5158

In Apple iOS before version 7, the Social subsystem did not properly restrict access to the Twitter icon cache, enabling physically proximate attackers to disclose information about recent Twitter interactions. Affected component: Social subsystem cache handling in iOS 6.x and earlier. Root cause...

CVE-2013-5158

The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons, which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors...

phpLinks Cross Site Scripting

Exploit Title: PhpLinks Cross Site Scripting Vulnerability Date: 2013 15 September Author: Arsan Vendor Homepage: www.newphplinks.com Version : All Version Tested on: Linux & Windows Category: webapps Google Keywords: inurl:"/index.php?PID=" intext:"Powered By phpLinks" + Exploit :...

FBI Cyber Division put 'Syrian Electronic Army' Hackers in wanted list

The Syrian Electronic Army SEA, a pro-regime hacker group that emerged during Syrian anti-government protests in 2011, and involved in cyber attacks against western media organizations are now in the FBI's wanted list. The Federal Bureau of Investigation has issued an alert warning of cyber attac...

OSX <= 10.8.4 - Local Root Priv Escalation (py)

No description provided by source. !/usr/bin/python Original MSF Module: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudopasswordbypass.rb Exploit Title: OSX = 10.8.4 Local Root Priv Escalation Root Reverse Shell Date: 08-27-2013 Exploit Author: David...

Palms 3.6 Cross Site Scripting

1010101010101010101010101010101010101010101010101 0 0 1 /'\ /' /\ \ 1 0 /\ \ \ /, \ \ \ 0 1 //\ Dr.3v1l 0 1 0WebSecurity.IR 1 0 0 1 + E-Mail : [email protected] 1 0 + Y! : Doctor.3v1l 0 1 1 0 0 1 I'm 3v1l member from BlackDevils B0ys Team 1 0 0 1 1...

Dennis Fisher and Mike Mimoso Discuss the NYT Attack, News of the Week

Dennis Fisher and Mike Mimoso discuss the big stories of the last couple of weeks, including the Syrian Electronic Army’s attacks against the registrar for the New York Times and Twitter, and the release of Facebook’s first transparency report. Download: digitalunderground124 Subscribe to the...

Registrar Hack at Root of NY Times and Twitter Attacks

UPDATE–The attack that took down the New York Times Web site Tuesday afternoon, along with domains belonging to Twitter and the Huffington Post, was accomplished through the use of compromised credentials belonging to a reseller for the registrar that those companies use to buy their domains...

New York Times, Twitter and Huffington Post Domains hijacked by Syrian Electronic Army

Media companies including the New York Times, Twitter and the Huffington Post has been unavailable since Tuesday after the external malicious attack by a group of hackers supporting Syrian President Bashar Assad. For the second time this month, the New York Times' website has gone down. "The New...

Syrian Electronic Army Hack Results in Compromise of Domain Data For NY Times, Twitter

The Syrian Electronic Army, a group known for attacking high-profile media sites in the last year or so, has in the last few hours compromised the domain information for a large number of sites, including the New York Times home page and some of Twitter’s domains. Security researchers say that th...

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities Exploit Title: Hotel Software and Booking system 1.8 - SQL Injection / Cross Site Scripting Date: 21 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.cbhotel.eu/...

Samsung DVR Firmware 1.10 - Authentication Bypass

Samsung DVR Firmware 1.10 - Authentication Bypass Title: Samsung DVR authentication bypass Version affected: firmware version = 1.10 Vendor: Samsung - www.samsung-security.com Discovered by: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it Twitter: @andreaf83 Status...

Twitter OAuth Data Leaked From Third-Party App

An attacker, who may have gotten the information from the database of a third party, claims to have access to the OAuth login tokens and secrets for every Twitter user. He has posted more than 15,000 of the entries online and claims that he can now access the account of any user he wishes. Twitte...

Redhack hits Istanbul Metropolitan Municipality & Sewerage Administration systems

The Redhack hacking Group hacked into the websites of Istanbul Metropolitan Municipality, Water and Sewerage Administration. Hacker resets the credentials and announced the new login details on twitter i.e. "User: Redhack-Password: Redhack". The hacked portal URL is :...

Twitter Account 'Classifier' Detects Fraudulent Accounts

Fraudulent Twitter accounts are a booming business, accounting for significant underground money for spammers, fake antivirus scams, drive-by downloads and phishing schemes. But research presented at USENIX yesterday proposes a means for driving up the cost for attackers to get these campaigns of...

Redhack hits Istanbul Metropolitan Municipality & Sewerage Administration systems

The Redhack hacking Group hacked into the websites of Istanbul Metropolitan Municipality, Water and Sewerage Administration. Hacker resets the credentials and announced the new login details on twitter i.e. "User: Redhack-Password: Redhack". The hacked portal URL is :...

WordPress Xhanch - My Twitter插件跨站请求伪造漏洞(CVE-2013-3253)

Bugtraq ID:61629 CVE ID:CVE-2013-3253 WordPress是一种使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志 WordPress Xhanch - My Twitter插件存在一个跨站请求伪造漏洞，允许远程攻击者构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作 0 WordPress Xhanch - My Twitter Plugin 2.7.5 厂商解决方案 WordPress Xhanch - My Twitter Plugin 2.7.7已经修复此漏洞，建议用户下载更新：...

CVE-2013-3253

Cross-site request forgery CSRF vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change unspecified settings...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change unspecified settings...