Remote Code Execution via Unauthorised File upload in Cforms 14.7

Advisory: Remote Code Execution via Unauthorised File upload in Cforms 14.7 Advisory ID: - Author: Zakhar Fedotkin Affected Software: Wordpress Plugin Cforms II 14.x-14.7 Release: 12th Nov 2014 Vendor URL: https://wordpress.org/plugins/cforms2/ Vendor Status: fixed CVE-ID: -...

Wordpress Plugin Cforms 14.7 Remote Code Execution Vulnerability

Cforms version 14.7 suffers from a remote code execution vulnerability. Advisory: Remote Code Execution via Unauthorised File upload in Cforms 14.7 Author: Zakhar Fedotkin Affected Software: Wordpress Plugin Cforms II 14.x-14.7 Release: 12th Nov 2014 Vendor URL:...

Cforms 14.7 Remote Code Execution

Advisory: Remote Code Execution via Unauthorised File upload in Cforms 14.7 Advisory ID: - Author: Zakhar Fedotkin Affected Software: Wordpress Plugin Cforms II 14.x-14.7 Release: 12th Nov 2014 Vendor URL: https://wordpress.org/plugins/cforms2/ Vendor Status: fixed CVE-ID: -...

Cforms & CformsII <= 14.7 - Remote Code Execution via Unauthorised File Upload

...

Updated php-pear-CAS packages fix CVE-2014-4172

Updated php-pear-CAS packages fix security vulnerabilities: A flaw in php-pear-CAS before 1.3.3, utilized by Moodle, has been found which could potentially allow unauthorised access and privilege escalation CVE-2014-4172...

Easy Media Gallery < 1.3.0 - CSRF & Cross-Site Scripting (XSS)

Most of the AJAX actions from the plugin v1.2.59 and below are lacking capability and in some cases CSRF checks as well, which could lead to unauthorised actions being performed and Cross-Site Scripting issues...

Forgotten password features leaks information to the user that could be used to gain unauthorised access to Confluence

Using the forgotten password feature in Confluence it is possible to find out which email addresses are stored in the system from the responses given from the form when submitted. These responses need to be made generic so that it is not possible to tell which email addresses are or are not store...

Egresser - Tool to Enumerate Outbound Firewall Rules

Egresser is a tool to enumerate outbound firewall rules, designed for penetration testers to assess whether egress filtering is adequate from within a corporate network. Probing each TCP port in turn, the Egresser server will respond with the client’s source IP address and port, allowing the clie...

Ninth Grade Students Hack into ATM Machine during School Lunch Break

When I was in school, I used to play outdoor games like basketball and badminton. When I was in college, I started taking more interest in playing computer games rather going out. But nowadays, children have completely changed their hobbies to programming, hacking, bug bounties in such a ways tha...

FreeBSD : Joomla! -- Core - Multiple Vulnerabilities (9fa1a0ac-b2e0-11e3-bb07-6cf0490a8c18)

The JSST and the Joomla! Security Center report : 20140301 - Core - SQL Injection Inadequate escaping leads to SQL injection vulnerability. 20140302 - Core - XSS Vulnerability Inadequate escaping leads to XSS vulnerability in comcontact. 20140303 - Core - XSS Vulnerability Inadequate escaping lea...

[WiFi Network Monitor] Tool to Watch/Monitor your Wireless network from hackers/rogue/unauthorised users

WiFi Network Monitor is the free tool to remotely scan and discover all the systems connected to your Wireless network. It helps you to keep a watch on your Wi-Fi network and safe guard it from Hackers as well as other unauthorised users. Its swift scan powered by 'ARP based Multi-threading'...

Joomla! -- Core - Multiple Vulnerabilities

The JSST and the Joomla! Security Center report: 20140301 - Core - SQL Injection Inadequate escaping leads to SQL injection vulnerability. 20140302 - Core - XSS Vulnerability Inadequate escaping leads to XSS vulnerability in comcontact. 20140303 - Core - XSS Vulnerability Inadequate escaping lead...

FreeBSD : OpenX -- SQL injection vulnerability (3e33a0bb-6b2f-11e3-b042-20cf30e32f6d)

Revive reports : A SQL-injection vulnerability was recently discovered and reported to the Revive Adserver team by Florian Sander. The vulnerability is known to be already exploited to gain unauthorised access to the application using brute force mechanisms, however other kind of attacks might be...

OpenX -- SQL injection vulnerability

Revive reports: An SQL-injection vulnerability was recently discovered and reported to the Revive Adserver team by Florian Sander. The vulnerability is known to be already exploited to gain unauthorised access to the application using brute force mechanisms, however other kind of attacks might be...

17-year-old alleged Anonymous Hacker charged for unauthorised access

A 17 year old alleged hacker accused of being associated with Anonymous hacker appeared in Parramatta Children's Court on Friday, over multiple unauthorised access crime on the behalf of hacktivist collective Anonymous. The Australian Federal Police AFP issued a statement over the matter, saying...

[20130401] - Core - Privilege Escalation

Inadequate permission checking allows unauthorised user to delete private messages...

Umbraco CMS - Remote Command Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Umbraco CMS Remote Command Execution'...

UK Police Charge another alleged Anonymous member in Hacking Cases

UK Police Charge another alleged Anonymous member in Hacking Cases A student has been charged with involvement in cyber attacks by the hacking group Anonymous against companies that withdrew online payment services from WikiLeaks. Peter David Gibson, from Hartlepool, will appear before magistrate...

Joomla! 1.6 < 1.6.2 Multiple Vulnerabilities (deprecated)

Binary data 5893.prm...

Former employee held for hacking server of BPO unit in Hyderabad !

A former software professional on Saturday was arrested for allegedly hacking the server of a city-based BPO company, where he previously worked, police said. The hacker identified as Shaik Mahammad Ghouse Bhasa allegedly secured unauthorised access to the computer systems of M/s IVOICE Network...