CVE-2013-5158

The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons, which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors...

CVE-2013-5157

The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter daemon interfaces, which allows attackers to post Tweets via a crafted app that sends direct requests to the daemon...

Code injection

The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter daemon interfaces, which allows attackers to post Tweets via a crafted app that sends direct requests to the daemon...

Information disclosure

The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons, which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors...

CVE-2013-5158

In Apple iOS before version 7, the Social subsystem did not properly restrict access to the Twitter icon cache, enabling physically proximate attackers to disclose information about recent Twitter interactions. Affected component: Social subsystem cache handling in iOS 6.x and earlier. Root cause...

CVE-2013-5157

The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter daemon interfaces, which allows attackers to post Tweets via a crafted app that sends direct requests to the daemon...

CVE-2013-5157

Summary: CVE-2013-5157 affects the Twitter subsystem in Apple iOS prior to 7, where lack of API conformity allowed non-conforming apps to access Twitter daemon interfaces and post Tweets by sending direct requests to the daemon. This is due to insufficient access controls on the Twitter daemon in...

CVE-2013-5158

The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons, which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors...

phpLinks Cross Site Scripting

Exploit Title: PhpLinks Cross Site Scripting Vulnerability Date: 2013 15 September Author: Arsan Vendor Homepage: www.newphplinks.com Version : All Version Tested on: Linux & Windows Category: webapps Google Keywords: inurl:"/index.php?PID=" intext:"Powered By phpLinks" + Exploit :...

FBI Cyber Division put 'Syrian Electronic Army' Hackers in wanted list

The Syrian Electronic Army SEA, a pro-regime hacker group that emerged during Syrian anti-government protests in 2011, and involved in cyber attacks against western media organizations are now in the FBI's wanted list. The Federal Bureau of Investigation has issued an alert warning of cyber attac...

OSX <= 10.8.4 - Local Root Priv Escalation (py)

No description provided by source. !/usr/bin/python Original MSF Module: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/sudopasswordbypass.rb Exploit Title: OSX = 10.8.4 Local Root Priv Escalation Root Reverse Shell Date: 08-27-2013 Exploit Author: David...

Palms 3.6 Cross Site Scripting

1010101010101010101010101010101010101010101010101 0 0 1 /'\ /' /\ \ 1 0 /\ \ \ /, \ \ \ 0 1 //\ Dr.3v1l 0 1 0WebSecurity.IR 1 0 0 1 + E-Mail : [email protected] 1 0 + Y! : Doctor.3v1l 0 1 1 0 0 1 I'm 3v1l member from BlackDevils B0ys Team 1 0 0 1 1...

Dennis Fisher and Mike Mimoso Discuss the NYT Attack, News of the Week

Dennis Fisher and Mike Mimoso discuss the big stories of the last couple of weeks, including the Syrian Electronic Army’s attacks against the registrar for the New York Times and Twitter, and the release of Facebook’s first transparency report. Download: digitalunderground124 Subscribe to the...

Registrar Hack at Root of NY Times and Twitter Attacks

UPDATE–The attack that took down the New York Times Web site Tuesday afternoon, along with domains belonging to Twitter and the Huffington Post, was accomplished through the use of compromised credentials belonging to a reseller for the registrar that those companies use to buy their domains...

New York Times, Twitter and Huffington Post Domains hijacked by Syrian Electronic Army

Media companies including the New York Times, Twitter and the Huffington Post has been unavailable since Tuesday after the external malicious attack by a group of hackers supporting Syrian President Bashar Assad. For the second time this month, the New York Times' website has gone down. "The New...

Syrian Electronic Army Hack Results in Compromise of Domain Data For NY Times, Twitter

The Syrian Electronic Army, a group known for attacking high-profile media sites in the last year or so, has in the last few hours compromised the domain information for a large number of sites, including the New York Times home page and some of Twitter’s domains. Security researchers say that th...

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities Exploit Title: Hotel Software and Booking system 1.8 - SQL Injection / Cross Site Scripting Date: 21 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.cbhotel.eu/...

Samsung DVR Firmware 1.10 - Authentication Bypass

Samsung DVR Firmware 1.10 - Authentication Bypass Title: Samsung DVR authentication bypass Version affected: firmware version = 1.10 Vendor: Samsung - www.samsung-security.com Discovered by: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it Twitter: @andreaf83 Status...

Twitter OAuth Data Leaked From Third-Party App

An attacker, who may have gotten the information from the database of a third party, claims to have access to the OAuth login tokens and secrets for every Twitter user. He has posted more than 15,000 of the entries online and claims that he can now access the account of any user he wishes. Twitte...

Redhack hits Istanbul Metropolitan Municipality & Sewerage Administration systems

The Redhack hacking Group hacked into the websites of Istanbul Metropolitan Municipality, Water and Sewerage Administration. Hacker resets the credentials and announced the new login details on twitter i.e. "User: Redhack-Password: Redhack". The hacked portal URL is :...