EFF Evaluates Internet Companies on Privacy, Transparency

Internet companies are making it a standard practice to publish transparency reports and advocate for users’ privacy concerns with law enforcement and legislators. And while some do it well, there’s plenty of room for improvement among ISPs such as AT&T and Verizon, and large companies such as...

World's most secure messaging service offers £10,000 if you crack it

Privacy conscious phone users are being offered a new app that claims to be the world's first totally secure messaging service. A London-based iPhone messaging app claims to be unhackable and is offering reward to anyone who can intercept a message sent by it. Redact believes that messages sent v...

phpMyAdmin 3.5.84.0.0-RC2 - Multiple Vulnerabilities

phpMyAdmin 3.5.84.0.0-RC2 - Multiple Vulnerabilities waraxe-2013-SA103 - Multiple Vulnerabilities in phpMyAdmin =============================================================================== Author: Janek Vind "waraxe" Date: 25. April 2013 Location: Estonia, Tartu Web:...

phpMyAdmin 3.5.8/4.0.0-RC2 - Multiple Vulnerabilities

waraxe-2013-SA103 - Multiple Vulnerabilities in phpMyAdmin =============================================================================== Author: Janek Vind "waraxe" Date: 25. April 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-103.html Description of vulnerable software:...

KIK Messenger Password Disclosure

KIK Messenger stores password in plain text This is the conclusion of Mobile Security Company, a Dutch organisation specialized in security audits of mobile applications. The username and password are stored in the com.kik.chat.plist file. This file can be viewed on a jailbroken device or when...

Transparency Reports Should Be Standard Practice

With less than three full months gone in 2013, Facebook, Apple and Microsoft all have admitted publicly to serious security breaches, something that would have seemed like an elaborate practical joke just a couple of years ago. But the times and the climate have changed, and if you needed more...

DaloRADIUS Web Management Multiple Vulnerabilities

DaloRADIUS Web Management is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-1413

COMPASS SECURITY ADVISORY http://www.csnc.ch/ CVE ID : CVE-2013-1413 CSNC ID: CSNC-2013-003 Product: i-doit Vendor: synetics Gesellschaft fьr Systemintegration mbH Subject: Cross-site Scripting - XSS Risk: High Effect: Remotely exploitable Author: Stephan Rickauer [email protected] Date:...

Google For First Time Reports FBI Non-Warrant Requests for User Data

Google today revealed – if in vague terms – it last year received less than 1,000 “national Security letters” from federal authorities seeking financial and communications data on up to almost 2,000 individuals. The disclosure of such government requests marks a first for a major Internet service...

Google Play Gives User Data to App Devs

Android application developer Dan Nolan claims that the Google Play store sends software developers the names, approximated locations, and email addresses of every individual that downloads one of their applications. Nolan created a “Paul Keating Insult Generator” application that is apparently...

Hackers breach Twitter and 250,000 accounts compromised

In recent The Hacker News updates, we have reported about some major hacking events and critical vulnerabilities i.e Cyber attack and spying on The New York Times and Wall Street Journal by Chinese Hackers, Security Flaws in UPnP protocol, Botnet attack hack 16,000 Facebook accounts, 700,000...

Google Complied With 88 Percent of U.S. User Data Requests

Google received more than 8,000 requests for user data from the U.S. government in the second half of 2012, and nearly all of them were the result of a subpoena or search warrant. The number of those requests that the company complied with by producing some or all of the data in question is still...

Default application files available for download via the application server.

see: https://jira.atlassian.com/browse/JRA-31187 e.g. https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/ and https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/web.xml . FishEye shouldn't write any user data to the WEB-INF directory. The only files which are viewable there, should be the sam...

Default application files available for download via the application server.

see: https://jira.atlassian.com/browse/JRA-31187 e.g. https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/ and https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/web.xml . FishEye shouldn't write any user data to the WEB-INF directory. The only files which are viewable there, should be the sam...

California Attorney General Fighting for Mobile Privacy Rights

UPDATE – In an attempt to reign in the tendency of indifference toward consumer privacy among mobile application developers, California Attorney General Kamala D. Harris today made public a list of guidelines regulating the ways in which mobile application developers and technology companies hand...

Facebook for Android - LoginActivity Information Disclosure

Facebook for Android - LoginActivity Information Disclosure source: https://www.securityfocus.com/bid/57173/info Facebook for Android is prone to an information-disclosure vulnerability. Successful exploits allows an attacker to gain access to sensitive information. Information obtained may aid i...

青果教务漏洞任意妹子成绩以及照片随便看

简要描述： 可以遍历所用用户的成绩和照片，貌似用这个教务的学校不少吧 详细说明： 还是水平权限控制的问题，记得以前几乎所有页面都没进行权限校验，后来修复了，但还是有遗漏 漏洞证明： 1.照片任意遍历 http://ip/jwmis/photo/student/完整学号.JPG 2.成绩任意遍历 http://ip/jwmis/XSCJ/StuMyScoreprintrpt.aspx?rpt=1&xh=完整学号...

Windows Gather Google Chrome User Data Enumeration

This module will collect user data from Google Chrome and attempt to decrypt sensitive information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Google Chrome User Data...

Invision Power Services Invision Gallery 1.0.1 Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications source: http://www.securityfocus.com/bid/9944/info It has been reported that Invision Gallery may be prone to multiple sql injection vulnerabilities, allowing an attacker to influence SQL query logic. The issues exist due to insufficient...

MyBB Bank Transactions 2.0 SQL Injection

Exploit Title: MyBB Bank Transactions Plugin SQL Injection Google Dork: inurl:bank.php?transactions= Date: 13.12.2012 Exploit Author: limb0 Vendor Homepage: http://mods.mybb.com/view/transactions Software Link: www.kingofpersia.ir Version: 2.0 Category:Web Security Tested on: Linux...