Cisco Finesse User Data in Query Vulnerability

A vulnerability in HTTP queries of Cisco Finesse could allow an unauthenticated, remote attacker to collect potentially sensitive user data. The vulnerability is due to insecure transmission of user data in an HTTP query. An attacker could exploit this vulnerability by capturing the HTTP query...

German Video Game 'Crytek' Websites go offline after Security Breach

It seems that German Video Game company 'Crytek' has been the latest victim of hacking attacks on its website and few forums, and caused Crytek's family of websites to go offline. According to the company, "Our Crytek.com, Mycryengine.com, Crydev.net and MyCrysis.com sites were all subject to a...

SEA Hacks Messaging App Tango, Leaks User Information

The Syrian Electronic Army SEA reportedly hacked into a database belonging to the free messaging and video sharing app Tango over the weekend, potentially compromising millions of users’ information. The SEA – a group of hackers that attacks websites to spread pro-Bashar al-Assad propaganda –...

Ubuntu Forums hacked; 2 million user's personal Information compromised

Ubuntuforums.org, The popular Ubuntu Forums site, has posted a message on its index page, informing its near 2 million users that it has suffered a serious security breach. "There has been a security breach on the Ubuntu Forums," reads the page. The site was defaced by hacker with Twitter handle...

Zoho Information Disclosure / Mixed Content

ZOHO INTERNAL INFORMATION DISCLOSURE Content type is not specified /INSECURE TRANSITION FROM HTTP TO HTTPS IN FORM ================================================================================================================================================== Report-Timeline: ================...

Google, Microsoft Seek Help in Lifting FISA Gag Order

Google and Microsoft have locked arms with a number of civil liberties advocates in filing a brief with the secret Foreign Intelligence Surveillance Court hoping to lift a gag order preventing the two tech giants from releasing information on their role in the NSA’s surveillance activities. To...

[waraxe-2013-SA#105] - Multiple Vulnerabilities in Spider Catalog Wordpress Plugin

waraxe-2013-SA105 - Multiple Vulnerabilities in Spider Catalog Wordpress Plugin =================================================================================== Author: Janek Vind "waraxe" Date: 22. May 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-105.html Description of...

WordPress Plugin WP Private Messages - msgid SQL Injection

WordPress Plugin WP Private Messages - msgid SQL Injection source: https://www.securityfocus.com/bid/60854/info WP Private Messages plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query...

Stolen Opera Code-Signing Certificate Used to Sign Malware

Opera Software said it was able to contain the impact of a security breach that resulted in the theft of an expired code-signing certificate used to sign malware distributed to Windows users during a 36-minute stretch on June 19. Opera developer Sigbjorn Vik said the browser maker was victimized ...

Google Adds Phishing, Malware Info to Transparency Report

Google divulged new statistics today about its Safe Browsing program, a service it uses to flag websites it suspects of peddling malware and phishing. According to the numbers, most of the “unsafe website” warnings it pushes to users on Google Search and in browsers, stem from malware and not...

Elemata CMS RC3.0 - global.php?id SQL Injection

Elemata CMS RC3.0 - global.php?id SQL Injection Exploit Title : Elemata CMS RC3.0 SQL Injection Date : 23 June 2013 Exploit Author : CWH Underground Site : www.2600.in.th Vendor Homepage : http://www.elemata.com/ Software Link :...

Elemata CMS RC3.0 - 'global.php?id' SQL Injection

Exploit Title : Elemata CMS RC3.0 SQL Injection Date : 23 June 2013 Exploit Author : CWH Underground Site : www.2600.in.th Vendor Homepage : http://www.elemata.com/ Software Link : http://jaist.dl.sourceforge.net/project/elematacms/Elemata%203.x/ElemataRC3.0.zip Version : RC 3.0 Tested on : Windo...

Google Requests More Transparency to Dispel PRISM

Google’s chief legal officer addressed a letter to Attorney General Eric Holder and FBI Director Robert Mueller contesting recent media reports regarding the breadth of the National Security Agency’s surveillance programs and requesting that his company be allowed to publish more national securit...

Microsoft Office PNG File CVE-2013-1331 Buffer Overflow Vulnerability

Description Microsoft Office is prone to a remote stack-based buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue by enticing a victim to open a malicious PNG file. Successfully exploiting this issu...

Napata CMS 1.5.2013 PHP Code Injection Vulnerability

Napata CMS version 1.5.2013 suffers from a remote command execution vulnerability. Exploit Title : Napata CMS PHP Code Injection Date : 5 June 2013 Exploit Author : CWH Underground Site : www.2600.in.th Vendor Homepage : http://napata-cms.blogspot.com/ Software Link :...

Drupal resets 1 Million Passwords after Data Breach

A Drupal data breach was announced by the official Drupal Association, that Passwords for almost one million accounts on the Drupal.org website are being reset after hackers gained unauthorized access to sensitive user data. The security of the open source content management system has been...

Drupal resets 1 Million Passwords after Data Breach

A Drupal data breach was announced by the official Drupal Association, that Passwords for almost one million accounts on the Drupal.org website are being reset after hackers gained unauthorized access to sensitive user data. The security of the open source content management system has been...

PhpTax 0.8 - File Manipulation 'newvalue' / Remote Code Execution

,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / \ / / XXXXXX /\ / XXXXXX / / XXXXXX / ------' Exploit Title : PhpTax File Manipulationnewvalue,field Remote Code...

Spider Catalog 1.4.6 Multiple Vulnerabilities

Spider Catalog version 1.4.6 is a Wordpress plugin that suffers from multiple cross site scripting, path disclosure, and remote SQL injection vulnerabilities. Author: Janek Vind "waraxe" Date: 22. May 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-105.html Description of...

[waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin

waraxe-2013-SA103 - Multiple Vulnerabilities in phpMyAdmin =============================================================================== Author: Janek Vind "waraxe" Date: 25. April 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-103.html Description of vulnerable software:...