EMC SourceOne Email Management Account Lockout Feature Brute Force Vulnerability

EMC SourceOne Email Management is an email management application. EMC SourceOne Email Management fails to properly set up the email account lockout feature, allowing remote attackers to exploit the vulnerability to gain access to user information via a brute force attack...

IBM WebSphere Commerce Debug Logging Local Information Disclosure Vulnerability

IBM WebSphere Commerce is the industry's leading next-generation e-business solution. Some command line scripts of IBM WebSphere Commerce run in debug state, which can record user data to log files and lead to information leakage...

KPPW最新版SQL注入漏洞，修补不严

简要描述： KPPW最新版SQL注入漏洞，修补不严 详细说明： 1.看了http://wooyun.org/bugs/wooyun-2010-086216。这篇帖子，正巧也在审计KPPW，也就去看了用一下最新版对于爆出问题的修补方式。最新版为了防止该漏洞，添加了一个验证。 if$gUserInfo'uid' != $pk'uid' kekezu::showmsg'无权操作',NULL,NULL,NULL,'error'; return false; 2.$gUserInfo'uid'是用户id，是我们不可控的。所以这里不能再用xfkxfk大牛的方法构造uid了。那么我们再看一下save函...

The vulnerability of the Windows operating system, which allows a malicious individual to compromise the confidentiality of information

The Microsoft Windows operating system contains a vulnerability in the Active Directory services, related to incorrect handling of user exit. Exploiting this vulnerability can allow attackers to access user information by reopening the application from which the user exited. Due to the error in...

DEBIAN-CVE-2015-2940

Cross-site request forgery CSRF vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors...

UBUNTU-CVE-2015-2935

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."...

MallMold 2.5 app/action/newsletterAction.php SQL注入漏洞

/app/action/newsletterAction.phppublic function statistics //create a image header'Content-type:image/gif'; echo base64decode'R0lGODlhAQABAIAAAAAAAAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw=='; $sn = trim$GET'sn'; $email = trim$GET'ue'; $this-model'newsletter'-statistics$sn, $email;...

U.S. Government Requests for Yahoo User Data Drop

Yahoo received nearly 5,000 requests for user data from the United States government in the last six months of 2014 and disclosed some content in nearly 25 percent of those cases. The company said in its new transparency report that it received between 0-999 National Security Letters from the U.S...

WordPress Marketplace 2.4.0 Add Administrator

!/usr/bin/python Exploit Name: WP Marketplace 2.4.0 Remote Command Execution Vulnerability discovered by Kacper Szurek http://security.szurek.pl Exploit written by Claudio Viviani -------------------------------------------------------------------- The vulnerable function is located on...

CVE-2 0 1 4-4 4 2 3 analysis process and findings-vulnerability warning-the black bar safety net

Primer Some time ago the“steamed rice”on his blog published the article“on a non-jailbroken iPhone 6 iOS 8.1.3 on phishing attacks stealing App Store passwords”, see the article later to try to reproduce the whole process. Since the“steamed rice”the entire process is described more clearly, combi...

Installer Hijacking Vulnerability in Android Devices

A vulnerability in Google's Android OS has been discovered that could allow an attacker to change or replace a seemingly safe Android application with malware during installation. An attacker exploiting this vulnerability could access and steal user data on compromised devices without user...

Phabricator: SSRF vulnerability (access to metadata server on EC2 and OpenStack)

In bug 50537, haquaman reported a SSRF vulnerability in the meme creation section of Phabricator. Ticket T6755 was created and the HackerOne issue was closed as "Won't fix". T6755 states that "attackers can use the machine's ability to access the network, which may allow them to find services and...

Facebook Transparency Report: Government Requests Down

Facebook today reported a slight drop in government requests for user data, bucking a trend that peaked during the first half of 2014 with the highest numbers the company had seen. Its latest transparency report covers the second half of last year, and shows slight dips in requests for user data,...

Mozilla Firefox Buffer Overflow Vulnerability (CNVD-2015-01286)

Mozilla Firefox is a web browser developed by the Mozilla Foundation in conjunction with the open source community. Mozilla Firefox suffers from a buffer overflow vulnerability because it fails to scope check properly before copying user-supplied data into a sufficiently sized buffer, allowing an...

CVE-2014-4804

Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003, when SPI inclusion is enabled, allows remote attackers to obtain sensitive user data by visiting an unspecified page...

CVE-2014-4804

Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003, when SPI inclusion is enabled, allows remote attackers to obtain sensitive user data by visiting an unspecified page...

Government Requests for Twitter User Data Continue to Grow

The appetite for Twitter user data from governments around the world continues to grow, with the volume of such requests increasing by 40 percent in the second half of 2014. Requests from the United States government alone went up 29 percent, the company said in its latest transparency report...

Topline Systems Opportunity Form vulnerable to information disclosure

Overview Topline Systems Opportunity Form contains an information disclosure vulnerability. Description CWE-200: Information Exposure Topline Systems Opportunity Form is a macro-enabled Excel spreadsheet that contains connection strings to a public-facing database. By running procedures included ...

Reddit Publishes its First Transparency Report

Reddit on Thursday published its first transparency report, joining the litany of technology and online service providers who have already shed light on their privacy practices, and the extent to which governments makes requests for user information. Reddit thrives on user-submitted content...

Apple MAC OS X Yosemite SceneKit Out-of-Bounds Vulnerability

Apple MAC OS X Yosemite is the latest operating system developed by Apple. Apple MAC OS X Yosemite handles SceneKit with an out-of-bounds error that allows remote attackers to exploit the vulnerability to execute arbitrary code to obtain user information...