City Directory Review and Rating Script - 'search.php' SQL Injection

Exploit Title: City Directory Review and Rating Script SQL Injection Vulnerability Date: 22.12.2012 Author: 3spi0n Script Vendor or Software Link: http://b-scripts.com/en/18-city-reviewer-yelp-clone.html Category: WebApps Type: SQL Injection MySQLi Tested On: Ubuntu 12.10 - Win7...

Anonymous leaks database from Israeli Musical Act Magazine site #OpIsrael

This Morning Anonymous member with twitter handle @OsamaTheGod leaked a huge database from server of Israeli Musical Act Magazine act.co.il. The leaked database posted on public note website and includes users ID, username, password in clear text, IP address and phone numbers. Hacker posted data ...

MyBB AJAX Chat - Persistent Cross-Site Scripting

Title: MyBB AJAX Chat Persistent XSS Vulnerability Date: 12/12/2012 Exploit Author: Mr. P-teo Vendor Homepage: http://www.mybb.com/ Software Link: http://mods.mybb.com/view/ajax-chat Version: 1 Tested on: Windows The Persistent XSS vulnerability lies within the chatframe.php page. Persistent /...

Multiple critical vulnerabilities in Maxthon and Avant browsers

Hi, Below you can find a short summary of discovered vulnerabilities in Maxthon and Avant browsers. Such vulnerabilities were demonstrated during HITBAMS2012 security conference and more recently at HackPra. Affected Products - Maxthon www.maxthon.com - Avant Browser www.avantbrowser.com Security...

Joomla! Component com_jooproperty 1.13.0 - Multiple Vulnerabilities

1 1 0 I'm D4NB4R member from Inj3ct0r Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Exploit Title: Joomla comjooproperty SQL injection && Cross site scripting Vulnerability Dork: inurl:comjooproperty Date: 10-12-2012 Author: Daniel Barragan "D4NB4R" Twitter:...

MyBB Profile Blogs Plugin 1.2 - Multiple Vulnerabilities

Exploit Title: MyBB Profile Blog plugin multiple vulnerabilities. Google Dork: inurl:member.php intext:"Profile Blogs" for MyBB Date: 12.9.2012 Exploit Author: Zixem Vendor Homepage: http://fklar.pl/ Software Link: http://mods.mybb.com/view/profile-blogs Version: 1.2+ Tested on: Linux. MyBB Profi...

Twitter Downplays SMS-Spoofing Issue

Twitter officials say that a researcher’s claims that the service is open to an SMS-spoofing vulnerability are not completely accurate, and that Twitter users in the United States are not vulnerable to the attack. Moxie Marlinspike of Twitter’s security team said that the company in August had...

Twitter Resolves SMS Bug (For Some Users)

UPDATE–A day after an independant security researcher disclosed a vulnerability in SMS-enabled Twitter accounts, the social network giant announced it’s fixed the flaw – at least for some users. Those who use a “long code” and/or cannot use a PIN code remain at risk. The update came Tuesday eveni...

Twitter SMS-Spoofing Bug Allows Attackers to Send Tweets From Users' Accounts, Edit Profiles

There is a bug in the way that Twitter handles a feature that enables users to post messages via SMS and the researcher who discovered the bug says that it allows anyone who knows a user’s mobile number to not only tweet from the user’s account but also modify information in the user’s profile. T...

Marketing Development Script SQL Injection Vulnerability

Marketing Development Script suffers from a remote SQL injection vulnerability. Note that this finding houses site-specific data. Exploit Title; Marketing Development Script SQL Injection Vulnerability Date; 3/12/12 Author; 3spi0n Script Vendor or Software Link; http://www.marketingdev.com/...

CVE-2012-5541

Cross-site scripting XSS vulnerability in the Twitter Pull module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.0-rc3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "data coming from Twitter."...

Cross site scripting

Cross-site scripting XSS vulnerability in the Twitter Pull module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.0-rc3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "data coming from Twitter."...

CVE-2012-5541

The CVE-2012-5541 issue affects the Drupal Twitter Pull module (6.x-1.x and 7.x-1.x branches). The underlying vulnerability stems from insufficient filtering of data coming from Twitter, enabling XSS via unspecified vectors. Affected versions are Twitter Pull 6.x-1.x prior to 6.x-1.3 and 7.x-1.x ...

CVE-2012-5541

Cross-site scripting XSS vulnerability in the Twitter Pull module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.0-rc3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "data coming from Twitter."...

[SECURITY] Fedora 17 Update: libsocialweb-0.25.21-1.fc17

libsocialweb is a social data server which fetches data from the "social we b", such as your friend's blog posts and photos, upcoming events, recently play ed tracks, and pending eBay auctions. It also provides a service to update your status on web services which support it, such as MySpace and...

Twitter for iPhone - Man in the Middle Security

Twitter for iPhone - Man in the Middle Security source: https://www.securityfocus.com/bid/56665/info Twitter for iPhone is prone to a security vulnerability that lets attackers to perform a man-in-the-middle attack. Attackers can exploit this issue to capture and modify pictures that the user see...

Twitter for iPhone - Man in the Middle Security

source: https://www.securityfocus.com/bid/56665/info Twitter for iPhone is prone to a security vulnerability that lets attackers to perform a man-in-the-middle attack. Attackers can exploit this issue to capture and modify pictures that the user sees in the application. Twitter for iPhone 5.0 is...

Twitter 5.0 Eavesdropping Proof Of Concept

Twitter App vulnerable to eavesdropping Vendor: Twitter Inc. Product: Twitter 5.0 Tested on: iPhone 4 iOS 6.0 Vendor notification: Nov 10, 2012. Risk level: Low Researcher: Carlos Reventlov Link: http://reventlov.com/advisories/twitter-app-vulnerable-to-partial-mitm The Twitter 5.0 app for the...

Rollingstone.com Cross Site Scripting

---------------------------------------------------------------------------------------------------- Title : Rollingstone.com reflected Cross Site Scripting XSS vulnerability Vendor : Wenner Media http://www.jannswenner.com/ Description : Rollingstone.com web-site is vulnerable to reflected...

Guadeloupe National Domain registrar hacked, Twitter & Google domain credentials leaked

Guadeloupe is a Caribbean island located in the Leeward Islands, in the Lesser Antilles. Today a hacker going by name "UR0B0R0X" claimed to hack into the "Network Information Center Guadeloupe" nic.gp, which is Guadeloupe National Domain registrar having control over domains of big companies like...