Uzbey: HTML Form Without CSRF Protection Vulnerability

HTML Form Without CSRF Protection Vulnerability Respected Sir/Madam I Hope Your Cooperate With Me Cause It's Not Easy To Find Vulnerability On Your Official Website Vulnerability description Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or...

Motorola SBG901 Wireless Modem Cross Site Request Forgery

Exploit Title : Motorola SBG901 Wireless Modem CSRF Vulnerability Google dork : N/A Exploit Author: Blessen Thomas Date : 06/01/2014 Vendor Homepage : http://www.arrisi.com/modems/ Software Link : N/A Version : Motorola SBG901 Wireless modem Tested on : Windows 7 CVE : CVE-2014-3778 Type of...

Motorola SBG901 Wireless Modem - CSRF Vulnerability

Exploit for hardware platform in category web applications Exploit Title : Motorola SBG901 Wireless Modem CSRF Vulnerability Google dork : N/A Exploit Author: Blessen Thomas Date : 06/01/2014 Vendor Homepage : http://www.arrisi.com/modems/ Software Link : N/A Version : Motorola SBG901 Wireless...

Motorola SBG901 Wireless Modem - Cross-Site Request Forgery

Motorola SBG901 Wireless Modem - Cross-Site Request Forgery Exploit Title : Motorola SBG901 Wireless Modem CSRF Vulnerability Google dork : N/A Exploit Author: Blessen Thomas Date : 06/01/2014 Vendor Homepage : http://www.arrisi.com/modems/ Software Link : N/A Version : Motorola SBG901 Wireless...

Microsoft Privacy Policy Promises No Targeted Advertisements

In a series of revisions to its services agreement, Microsoft says it will not scan the contents of its users’ files nor will it monitor their communications in order to target advertising based on perceived customer interests. The move is a dramatic one when contrasted with many of the Redmond,...

Facebook Set to Let Users Edit Own Advertising Info

Facebook announced today it will soon be rolling out a new feature to give users more control when it comes to the types of advertisements they see on the site. If users are tired of getting barraged with ads for shoes, video games or discount plane tickets, they’ll not only be able to stop the...

AlienVault OSSIM av-centerd Util.pm get_log_line Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault Ossim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the av-centerd SOAP service. The issue lies in the handling of the getlogline request...

AlienVault OSSIM av-centerd Util.pm set_file Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault OSSIM. Authentication is not required to exploit this vulnerability. The specific flaw exists within the av-centerd SOAP service. The issue lies in the handling of the setfile requests d...

Discuz blasting disregard CAPTCHA-vulnerability warning-the black bar safety net

? php classfuckdz publicfunctionsgk$user $a=filegetcontents"http://www.soyun.org/chaapi.php?so=$user&auto="; $a=iconv"UTF-8", "GB2312//IGNORE", $a; pregmatchall"/7%".& lt;/isU",$a,$arr; unset$arr0; foreach$arras$key=$r return$r; publicfunctiongetuid$host,$uid $ip= rand1 0 0, 2 4 4.'.'. rand1 0 0,...

Beware Of Fake 'HeartBleed Bug Remover Tool', Hijacks System with Malware

I am considering that you all must have read my last article on OpenSSL Heartbleed, a critical bug in the OpenSSL's implementation of the TLS/DTLS heartbeat extension that allows attackers to read portions of the affected server’s memory, potentially revealing users data, that the server did not...

EFF Who Has Your Back Privacy Report Hails Apple, Yahoo

Technology companies have responded to the challenge to privacy and civil liberties unearthed by the Snowden leaks with a determined effort to increase transparency around government requests for user data. Some have done a better job than others. Large ISPs such as AT&T, Verizon and Comcast...

Legal Guidelines Say Apple Can Extract Data From Locked iOS Devices

If law enforcement gets hold of your locked iPhone and has some interest in its contents, Apple can pull all kinds of content from the device, including texts, contacts, photos and videos, call history and audio recordings. The company said in a new document that provides guidance for law...

Facebook Enhances Privacy Settings with Anonymous Login

Anonymous is the new black for Facebook. The social network announced a number of changes to how users interact with third-party apps via Facebook logins, the most interesting being a service called Anonymous Login. Facebook chief executive officer Mark Zuckerberg told developers at the company’s...

ORACLE Subdomain Page Defaced by Indian Hacker

A group of Indian Hackers dubbed as I-HOS TEAM has successfully defaced a page on the sub domain of Oracle Corporation, biggest provider of enterprise software, computer hardware and Services. The users visiting the domain are being greeted with a custom webpage with black background and the them...

Easytalk垂直权限问题（逻辑漏洞可提权getshell）

简要描述： Easytalk处理用户数据的时候未足够过滤，导致可以进行权限提升 详细说明： 晚上习惯性的打开代码分析分析函数，看到了这样一处 漏洞文件: /Easytalk/Home/Lib/Action/GuideAction.class.php //保存设置,注册用户时候，向导保存设置 public function doset $user=M'Users'; $userdata=$POST"user";//获取用户提交的所有数据 // ok，此处的用户userdata数据是来自post的，而并未过滤一些敏感字段 $userdata"nickname"=...

IRCCloud: HTML Form without CSRF protection

Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Attack details Form name: Form action:...

New Zeus Variant Comes Complete With a Signed Certificate

Yet another variant of the Zeus banking Trojan has surfaced; this one comes disguised as an Internet Explorer document and uses an authentic digital certificate to download a rootkit onto infected machines. According to researchers at the SSL firm Comodo, more than 200 examples of the Trojan have...

shopnc最新版存储型xss漏洞

简要描述： shopnc存储型xss漏洞 详细说明： shopnc版本测试http://www.shopnctest.com/c2c/2013/demo/ shopnc用户个人主页处存在存储型XSS，可以获取用户敏感cookie信息。 在买家首页，分享心情处 测试代码为:"alertdocument.cookie// cookie收信平台 "alertdocument.cookie/ 如图 漏洞证明： 如上描述...

D-Link DIR-600L跨站请求伪造漏洞

D-Link DIR-600L是款无线路由器产品。 D-Link DIR-600L修订版A1固件版本1.0、修订版B1固件版本2.0，没有正确检查某些请求的合法性，这可使某些用户通过HTTP请求执行未授权操作。 0 D-Link DIR-600L 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.dlink.com/ Exploit Title: Dlink DIR-600L Hardware Version AX Firmware Version 1.00 CSRF Vulnerability Google Dork:...

Time Warner Cable Publishes First Transparency Report

Time Warner Cable has joined a half-dozen telecommunications and technology companies that, in the past six months, have published their first transparency report on government and law enforcement requests for user data and content. Since the Edward Snowden leaks began last June, transparency...