Government Requests for Google Data Continue to Rise

The volume of government requests to Google for user data is continuing to increase, something that should come as no surprise in the current climate. In its latest transparency report, the company said that it received more than 25,000 requests for user data in the first six months of 2013, an...

iScripts MultiCart 2.4 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Cross-Site Scripting / Cross-Site Request Forgery / Mass Accounts Takeover

Exploit Title : iScripts MultiCart same product id for which you submited the review. Cross-site request forgery input type...

PlaySMS <= 0.9.9.2 - CSRF Vulnerability

Exploit for php platform in category web applications Playsms is an open source SMS managment system , suffers from Cross-site request forgery through which attacker can manipulate user data via sending him malicious craft url. Playsms is not using any security token to prevent it against CSRF.Yo...

PlaySms 0.9.9.2 - Cross-Site Request Forgery

PlaySms 0.9.9.2 - Cross-Site Request Forgery Exploit Title : PlaySMS input type=hidden size=10 maxlength=10 name=up...

PlaySMS 0.9.9.2 Cross Site Request Forgery

Exploit Title : PlaySMS...

Nearly 2000 Sites Vulnerable to Ruby on Rails Cookie Problem

A lingering security issue in Ruby on Rails that stems from a setting in the framework’s cookie-based storage mechanism is still present in almost 2,000 websites. Sites using an old version of Ruby on Rails that relies on CookieStore, the framework’s default cookie storage mechanism, are at risk...

U.S. Government Requests for Google User Data Doubled Since 2010

In the first six months of this year, Google received seven wiretap orders from the United States government and complied with all of them. The company also received 207 pen register requests in the same period and complied with 89 percent of them, according to Google’s new transparency report. T...

Apple Says It Has 'Never Received an Order Under Section 215'

In a new report detailing the number and kind of requests for user information it’s gotten from various governments, Apple said it has never received a request for information under Section 215 of the USA PATROT Act and would likely fight one if it ever came. The company also disclosed that it ha...

JReport Cross Site Request Forgery

================================================================================================================================================================ JREPORT Cross Site Request Forgery Vulnerability...

WHMCS 5.2.8 SQL Injection Vulnerability (0day)

dork:- inurl:submitticket.php site:.com inurl:submitticket.php site:.net inurl:submitticket.php site:.us inurl:submitticket.php site:.eu inurl:submitticket.php site:.org inurl:submitticket.php site:.uk intext:"Powered by WHMCompleteSolution" intext:"Powered by WHMCompleteSolution"...

Unnamed Android Vulna Ad Library Abused to Steal User Data

A popular Android mobile ad library available on Google Play can be used to collect device data or execute malicious code, security researchers have discovered. The most alarming aspect to the library is that close to 2 percent of Android apps with more than 1 million downloads on Google Play use...

PHP168 explosion vulnerability, you can query any user data-bug warning-the black bar safety net

PHP168 program built-in“user”module contains the user profile display page. In many practical scenarios, this page is not the front Desk use, but can be directly through the URL access. Page routing is:/homepage.php/username/member-profile To PHP168 official demo site, for example, to view any us...

Joomla! Component JVideoClip 1.5.1 - 'uid' SQL Injection

source: https://www.securityfocus.com/bid/62610/info The JVideoClip component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

PHP168 a magical loophole, you can query any user data-bug warning-the black bar safety net

Brief description: Country micro-PHP168 appeared a magic array, can cause the whole station to the user data leakage. The leaked content includes total Station user passwords in cipher text, email, password, salt, IP and other sensitive information. Detailed description: PHP168 program...

[OS X Auditor] free Mac OS X computer forensics tool

OS X Auditor parses and hashes the following artifacts on the running system or a copy of a system you want to analyze: the kernel extensions the system agents and daemons the third party's agents and daemons the old and deprecated system and third party's startup items the users' agents the user...

Google, Facebook, Yahoo File NSL Transparency Motions

Google, Yahoo and Facebook filed amended requests today with the U.S. Foreign Intelligence Surveillance Court FISC reiterating their desire to publish numbers on requests for user data related to national security. Google, meanwhile, went a step further asking for an open, public hearing with the...

Yahoo Transparency Report Reveals More Than 12K U.S. Government Data Requests

Following the lead of Google, Twitter and other major Internet companies, Yahoo has issued its first transparency report, revealing that it received more than 12,000 requests for user data from the U.S. government in the first half of 2013. The company disclosed user content in nearly a third of...

Multiple Vulnerabilities in X2CRM

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in X2CRM, which can be exploited to include arbitrary local files and execute arbitrary PHP code, as well as to perform Cross-Site Sripting XSS attacks against users of vulnerable application. 1 PHP File Inclusion in X2CRM...

UBUNTU-CVE-2013-3374

Unspecified vulnerability in Request Tracker RT 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information user preferences and caches via unknown vectors, related to a "limited session re-use."...

Microsoft Fixes ASLR/DEP Bypass Bug

Buried in the details of the Microsoft Patch Tuesday release for August is the explanation of an important change that the company made to Windows that defeats a group of exploit mitigation bypasses. The change is a small one, but it prevents dangerous attacks that previously worked on most...