EMC Documentum xCP Information Disclosure Vulnerability

EMC Documentum xCP is a development platform from EMC that uses automated information-intensive processes to help users make business decisions. The platform provides real-time visibility, content analytics and business insights. A security vulnerability exists in the members/xcpmember API in EMC...

Debian DSA-3502-1 : roundup - security update

Ralf Schlatterbeck discovered an information leak in roundup, a web-based issue tracking system. An authenticated attacker could use it to see sensitive details about other users, including their hashed password. After applying the update, which will fix the shipped templates, the site...

Drupal Update Fixes 10 Vulnerabilities, One Critical

Developers at Drupal addressed 10 vulnerabilities in the content management system this week, including a critical access bypass issue that could have let users access certain elements thought to be blocked, and another issue that could lead to remote code execution. Through the critical access...

SAP NetWeaver Information Disclosure Vulnerability (CNVD-2016-01148)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A security vulnerability exists in the Universal Worklist Configuration of SAP NetWeaver version 7.4. A remote...

Here's the Facebook Hacking Tool that Can Really Hack Accounts, But...

Yes, you heard me right. A newly discovered Facebook hacking tool actually has the capability to hack Facebook account, but YOURS, and not the one you desire to hack. How to Hack Facebook account? How to Hack my Girlfriends Facebook account? My boyfriend is cheating on me, How do I hack his...

Windows Privilege Escalation

The vulnerability of the Windows operating system in the XML Core Services component, related to the ability to access data during document type declarations, allows attackers to gain access to sensitive user data such as names, passwords, or files on the hard drive...

WordPress AzonPop 1.0.0 SQL Injection

Exploit Title : Wordpress AzonPop Plugin SQL Injection Exploit Author : Ashiyane Digital Security Team Vendor Homepage : azonpop.blogspot.com Google Dork : inurl:wp-content/plugins/azonpop Date: 8 Jan 2016 Tested On : Win 10 | CyberFox Browser Vulnerable PHP File = /AzonPop/files/view/showpopup.p...

Mail.ru: [cfire.mail.ru] Time Based SQL Injection

Добрый день. Уязвимо кукис с названием cfiresid. Рабочий PoC GET /account/userbar/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/47.0.2526.73 Safari/537.36 OPR/34.0.2036.25 Host: cfire.mail.ru Accept: text/html, application/xml;q=0.9,...

Security researchers find HIV Dating APP vulnerability, the reverse is the vendor with the AIDS threat-vulnerability warning-the black bar safety net

! Around the world websites and applications to encourage researchers noted that their system vulnerabilities, but one designed for HIV-positive users of online Dating app developer with HIV a threat to security researchers not to notify them of the program any security vulnerabilities. HIV...

13 Million MacKeeper Records Found in Public Database

A trove of MacKeeper user data—some 13 million records—has been locked down after a researcher found an exposed and accessible database using a simple Shodan query. Chris Vickery revealed his discovery on Monday on Reddit in more of an appeal to reach officials at Kromtech, the parent company tha...

Cisco Wireless Residential Gateway Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of the Cisco EPC3928 Wireless Residential Gateway could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to...

WordPress Plugin Polls Widget 1.0.7 - SQL Injection

Exploit Title : wordpress poll widget version 1.0.7 SQL Injection vulnerability Author : WICS Date : 7/12/2015 Software Link : https://wordpress.org/plugins/polls-widget/ Affected Version: 1.0.7 and below Overview: Poll widget is wordpress plugin which provide fancy user Polling layout to website...

WordPress Poll Widget 1.0.7 SQL Injection

Exploit Title : wordpress poll widget version 1.0.7 SQL Injection vulnerability Author : WICS Date : 7/12/2015 Software Link : https://wordpress.org/plugins/polls-widget/ Affected Version: 1.0.7 and below Overview: Poll widget is wordpress plugin which provide fancy user Polling layout to website...

One after another: the VTech user data leaked, and was broke two major vulnerability-vulnerability warning-the black bar safety net

Recently, the world's largest infant electronic learning product Maker Vtech（Vtech）is aeration 4 8 0 million parents and 6 4 0 million for children information disclosure. ! Due to this event, Vtech its share price fell to a year low. Followed, with security researchers in their innotab Max produ...

The largest infant electronic learning product Maker Vtech（Vtech）is aeration 4 8 0 million parents and children to information disclosure-vulnerability warning-the black bar safety net

Vtech Vtech, the company is located in Hong Kong, as the world's largest infant and preschool electronic learning products business, before being exposed user data leakage. From the current analysis point of view, leaked the data relates to the range has covered 4 of 8 0 million parents and more...

ownCloud Data Sensitive Access

The vulnerability of a web application for data synchronization with ownCloud is related to the lack of protection for service-related data. Exploiting this vulnerability may allow an attacker, operating remotely, to gain access to protected information such as user accounts and cookies by readin...

iBackDoor: the suspected back door, the impact of the iOS app a high risk of code-bug warning-the black bar safety net

! Recently, FireEye Mobile Security researchers discovered embedded into the iOS app in the suspected“back door”behavior mobiSage advertising in the library, and these applications are from the App Store. The researchers will be the potential of the back door called iBackDoor, allowing hackers...

iBackDoor: High-Risk Code Hits iOS Apps

Introduction FireEye mobile researchers recently discovered potentially “backdoored” versions of an ad library embedded in thousands of iOS apps originally published in the Apple App Store. The affected versions of this library embedded functionality in iOS apps that used the library to display...

CVE-2015-7320 - Multiple Reflective XSS in Appointment Booking Calendar 1.1.7 WordPress plugin

Vulnerability title: Multiple Reflective XSS in Appointment Booking Calendar 1.1.7 WordPress plugin CVE: CVE-2015-7320 Vendor: WordPress DWBooster Product: Appointment Booking Calendar Affected version: 1.1.7 Fixed version: 1.1.8 Reported by: Iberia Medeiros Vulnerability Details:...

Apple told Judge: It's Impossible to Access Data on Locked iPhones

US Federal Official: Unlock that iPhone for me? Apple: Sorry, Nobody can do this! Neither we, nor you. Yes, in a similar manner, Apple told a U.S. federal judge that it is "IMPOSSIBLE" to access data stored on a locked iPhone running iOS 8 or later iOS operating system. In short, Apple has remind...