Valve Patches Trivial XSS Bug in Steam

Valve Corp., has patched a cross-site scripting vulnerability on its popular Steam gaming platform that could be exploited by viewing a maliciously crafted profile. The flaw could allow an attacker to carry out phishing attacks or execute malicious scripts just by opening a crafted profile page. ...

Opera server breach incident

News Opera server breach incident Share August 26th, 2016 Earlier this week, we detected signs of an attack where access was gained to the Opera sync system. This attack was quickly blocked. Our investigations are ongoing, but we believe some data, including some of our sync users’ passwords and...

Popular Download Service μTorrent wants you to pay for its Software

Just to enhance the services being rendered. The popular peer-to-peer file sharing software application is aiming to achieve new heights by making their software be a paid scheme. uTorrent is one of the clients of BitTorrent Inc. the parent company which implements a BitTorrent protocol. Where ea...

某大型政府服务系统Oracle注入(使用量大)

简要描述： rt，霍霍。为了生活费也是蛮拼的。。。。 详细说明： 问题厂商:深圳太极软件有限公司 一套专门的政务服务系统 用户量：大 影响：广 注入点 browsebgxz.do?method=dept&deptid=（deptid存注入） google关键字：inurl:browsebgxz.do?method= 案例: http://www.gygxzw.gov.cn:8066/browsebgxz.do?method=dept&deptid=556631684 http://61.189.156.73/browsebgxz.do?method=dept&deptid=0094204...

discuz!某自带工具可拿shell

简要描述： discuz!某自带工具，由于使用不当，可以造成webshell。 而且经过调查，使用者数量较大。 详细说明： discuz! 安装包中会自带一个转换工具 convert 这个工具由于存在安全问题，可以拿shell 一般存在网站目录 convert 或 utility/convert 而且经过调查，使用数量还是很大的。 使用前题是data目录可写，这也是这个工具的使用前题。 分析： 文件： utility\convert\include\doconfig.inc.php 中 保存配置，跟踪到saveconfigfile...

Q&A: Adrian Stone of the BlackBerry Security Team

LAS VEGAS–Here’s something that you might not know about RIM: it has a rather large security response and research team. The maker of the BlackBerry phones–once the must-have fashion accessory for executives and Barack Obama–historically has been almost silent on the way that it handles product...

Hackers Claims to compromise Intel's Sensitive Data

Hackers Claims to compromise Intel's Sensitive Data A security researcher under the name of "WeedGrower", or "X-pOSed" has been on a roll since the start of 2012. He has ambushed huge sites such as AOL, NASA, Hotmail, Myspace, Xbox, USBank, Yahoo, and VISA, he has also leaked sensitive data on mo...

Feeling Heat Facebook Adds Google+ Like Privacy Controls

History has taught us that monopolies are bad for consumers. It was true in the first decades of the 20th century with Standard Oil, and in the final decade of the same century with Microsoft. Its been true, in recent years, with social networking behemoth, Facebook, also. But now, with Google’s...

Tough Road Ahead for Adobe on Security

Microsoft and its endless portfolio of products have been the favorite targets of attackers for more than a decade now. But if the events of the past year or so are any indication, it looks like that dubious distiniction now belongs to Adobe. The last 12 months have been rough for Adobe, the make...

Directory traversal

Directory traversal vulnerability in include/unverified.inc.php in Linux Web Shop LWS php User Base 1.3beta allows remote attackers to include and execute arbitrary local files via the template parameter...

CVE-2008-7240

CVE-2008-7240 describes a directory traversal vulnerability in Linux Web Shop (LWS) PHP User Base 1.3beta. The flaw is in include/unverified.inc.php and allows remote attackers to include and execute arbitrary local files by manipulating the template parameter. Public references (X-Force, Securit...

Remote file inclusion

PHP remote file inclusion vulnerability in templates/default/header.inc.php in Linux Web Shop LWS php User Base 1.3 BETA allows remote attackers to execute arbitrary PHP code via a URL in the menu parameter...

CVE-2008-1043

Affected software: Linux Web Shop (LWS) PHP User Base 1.3 BETA. Vulnerability type: PHP remote file inclusion in templates/default/header.inc.php. Root cause / vector: remote attackers can supply a URL in the menu parameter, leading to arbitrary PHP code execution. Impact (as stated): arbitrary c...

phpuserbase-lfi.txt

Author : BeyazKurt - [email protected] Script : php User Base 1.3b Risk : Local File Include Download : http://sourceforge.net/project/showfiles.php?groupid=200632 File : include/unverified.inc.php Code : Exploit : Vuln.Com/include/unverified.inc.php?template=CODE ----------------------------...

PHPUserBase 1.3b - 'unverified.inc.php' Local File Inclusion

Author : BeyazKurt - [email protected] Script : php User Base 1.3b Risk : Local File Include Download : http://sourceforge.net/project/showfiles.php?groupid=200632 File : include/unverified.inc.php Code : Exploit : Vuln.Com/include/unverified.inc.php?template=CODE ----------------------------...