CVE-2015-8232

CVE-2015-8232 affects the Drupal UC Profile module (6.x-1.x) prior to version 6.x-1.3. The vulnerability arises from incomplete access checks when accessing profiles, potentially allowing remote attackers to disclose sensitive information from anonymous user profiles via unspecified vectors. The ...

CVE-2015-8232: Exposure of Sensitive Information to an Unauthorized Actor

The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumstances, which might allow remote attackers to obtain sensitive information from the anonymous user profile via unspecified vectors...

PT-2015-7752

Name of the Vulnerable Software and Affected Versions Drupal UC Profile module versions 6.x-1.x before 6.x-1.3 Description The issue allows remote attackers to obtain sensitive information from the anonymous user profile under certain circumstances due to improper access checks. Recommendations F...

CmsTop Media Edition SQL Injection Vulnerability

CmsTop is a content management system CMS for domestic media websites, mainly serving online media, newspapers, magazines, radio and television, government and large and medium-sized enterprises, etc., and has served more than one hundred well-known media websites. There is a SQL injection...

致远A8-V5协同管理软件日志信息泄露

致远A8-V5日志信息泄露，包括UC认证信息和ctp信息,ctp日志内含有密码信息一、ctp信息泄露包含系统内运行信息，如某某用户登录，某某用户操作功能等等http://a8v51.seeyon.com/seeyon/logs/ctp.log可以利用此处泄露信息获取系统内大量账户信息，包括密码信息二、UC认证信息泄露，包括token等信息http://a8v51.seeyon.com/seeyon/logs/uc.log如果UC配置在互联网或者本地恶意员工利用可以劫持UC登录。...

Mail.ru: XSS at af.attachmail.ru

XSS via attached SVG on sandbox domain af.attachmail.ru. xss via .svg file, working into UC BROWSER MINI only. Video poc: https://www.youtube.com/watch?v=E5akSwOXaKs&feature=youtu.be...

Spy Agencies Hijack Google Play Store to Install Spyware on Smartphones

I have an Android phone with a five different gmail accounts configured in it. But what if any one of them get compromised via phishing, malware or any other way? The Hacker would be able to access my Google account and obviously Google Play Store account too, which allows anyone to install any...

CVE-2015-0683

Cisco Unified Communications Domain Manager 8.14 allows remote authenticated users to obtain sensitive information via a file-inclusion attack, aka Bug ID CSCup94744...

Information disclosure

Cisco Unified Communications Domain Manager 8.14 allows remote authenticated users to obtain sensitive information via a file-inclusion attack, aka Bug ID CSCup94744...

Facebook Launches Free Mobile Internet Service In India

Last year, the founder of the Social Network giant highlighted the future of universal Internet access, the dream that Facebook founder Mark Zuckerberg wants to fulfill — Making Internet access available to everyone across the world just like a service as essential as of 911 in the case of an...

知道key的情况下对ucserver进行注射

简要描述： 因为帮finger解决问题，无意中看到的漏洞。 怎么拿到key要问finger。 详细说明： 在/ucserver/control/feed.php内有一段代码： function onadd $this-load'misc'; $appid = intval$this-input'appid'; $icon = $this-input'icon'; $uid = intval$this-input'uid'; $username = $this-input'username'; $bodydata =...

CVE-2014-6445

Multiple cross-site scripting XSS vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 uE or 2 uC parameter...

CVE-2014-6445: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 uE or 2 uC parameter...

PT-2014-7221

Name of the Vulnerable Software and Affected Versions Contact Form 7 Integrations plugin versions 1.0 through 1.3.10 Description The issue allows remote attackers to inject arbitrary web script or HTML via the uE or uC parameters in the includes/toAdmin.php file. This can lead to cross-site...

CVE-2014-6691

The UC Browser HD aka com.uc.browser.hd application 3.3.1.469 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The UC Browser HD aka com.uc.browser.hd application 3.3.1.469 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6691

The UC Browser HD aka com.uc.browser.hd application 3.3.1.469 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6691

The vulnerability CVE-2014-6691 affects UC Browser HD (com.uc.browser.hd) for Android, version 3.3.1.469. The issue is that the app does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. Impact is i...

CVE-2014-6691: Undefined Security Weakness

The UC Browser HD aka com.uc.browser.hd application 3.3.1.469 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7369

Name of the Vulnerable Software and Affected Versions UC Browser HD version 3.3.1.469 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from SSL servers...