EFF Who Has Your Back Privacy Report Hails Apple, Yahoo

Technology companies have responded to the challenge to privacy and civil liberties unearthed by the Snowden leaks with a determined effort to increase transparency around government requests for user data. Some have done a better job than others. Large ISPs such as AT&T, Verizon and Comcast...

Legal Guidelines Say Apple Can Extract Data From Locked iOS Devices

If law enforcement gets hold of your locked iPhone and has some interest in its contents, Apple can pull all kinds of content from the device, including texts, contacts, photos and videos, call history and audio recordings. The company said in a new document that provides guidance for law...

Facebook Enhances Privacy Settings with Anonymous Login

Anonymous is the new black for Facebook. The social network announced a number of changes to how users interact with third-party apps via Facebook logins, the most interesting being a service called Anonymous Login. Facebook chief executive officer Mark Zuckerberg told developers at the company’s...

ORACLE Subdomain Page Defaced by Indian Hacker

A group of Indian Hackers dubbed as I-HOS TEAM has successfully defaced a page on the sub domain of Oracle Corporation, biggest provider of enterprise software, computer hardware and Services. The users visiting the domain are being greeted with a custom webpage with black background and the them...

Easytalk垂直权限问题（逻辑漏洞可提权getshell）

简要描述： Easytalk处理用户数据的时候未足够过滤，导致可以进行权限提升 详细说明： 晚上习惯性的打开代码分析分析函数，看到了这样一处 漏洞文件: /Easytalk/Home/Lib/Action/GuideAction.class.php //保存设置,注册用户时候，向导保存设置 public function doset $user=M'Users'; $userdata=$POST"user";//获取用户提交的所有数据 // ok，此处的用户userdata数据是来自post的，而并未过滤一些敏感字段 $userdata"nickname"=...

IRCCloud: HTML Form without CSRF protection

Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Attack details Form name: Form action:...

New Zeus Variant Comes Complete With a Signed Certificate

Yet another variant of the Zeus banking Trojan has surfaced; this one comes disguised as an Internet Explorer document and uses an authentic digital certificate to download a rootkit onto infected machines. According to researchers at the SSL firm Comodo, more than 200 examples of the Trojan have...

shopnc最新版存储型xss漏洞

简要描述： shopnc存储型xss漏洞 详细说明： shopnc版本测试http://www.shopnctest.com/c2c/2013/demo/ shopnc用户个人主页处存在存储型XSS，可以获取用户敏感cookie信息。 在买家首页，分享心情处 测试代码为:"alertdocument.cookie// cookie收信平台 "alertdocument.cookie/ 如图 漏洞证明： 如上描述...

D-Link DIR-600L跨站请求伪造漏洞

D-Link DIR-600L是款无线路由器产品。 D-Link DIR-600L修订版A1固件版本1.0、修订版B1固件版本2.0，没有正确检查某些请求的合法性，这可使某些用户通过HTTP请求执行未授权操作。 0 D-Link DIR-600L 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.dlink.com/ Exploit Title: Dlink DIR-600L Hardware Version AX Firmware Version 1.00 CSRF Vulnerability Google Dork:...

Time Warner Cable Publishes First Transparency Report

Time Warner Cable has joined a half-dozen telecommunications and technology companies that, in the past six months, have published their first transparency report on government and law enforcement requests for user data and content. Since the Edward Snowden leaks began last June, transparency...

Microsoft charges FBI for your Information; Syrian Electronic Army leaks Invoices

Till now we all were aware about the truth that tech companies gave legal access to user data on the government's request, but we were unaware that well known tech companies also charge the government for providing data. Syrian Electronic Army SEA, the pro-hacker group, who had compromised...

Savsoft Quiz跨站请求伪造漏洞

Savsoft Quiz是基于PHP的在线测验web应用程序。 应用程序允许用户通过未经验证检查的HTTP请求执行某些操作，攻击者可以利用漏洞在欺骗管理员用户登录特制网页时已管理权限创建用户。 0 Savsoft Quiz 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://savsoftquiz.com/web/ form method="POST" name="form0" action="http://savsoftquiz.com/quizdemo/index.php/userdata/insertuser" input...

Pinterest Issues First Transparency Report

Pinterest, the social image-sharing site known predominately for wedding planning and recipe dissemination, released its first transparency report on Friday. While the government – unsurprisingly – makes few requests of this most bubbly of social networks, the report seems to carry a broader...

Privacy Groups Seek to Halt Facebook Acquisition of WhatsApp

The appeal of WhatsApp, the cross-platform mobile messaging app recently acquired by Facebook for a stunning $19 billion price tag, was that it kept to its promise of not collecting user information that would be converted to ad revenue. The acquisition by Facebook, however, likely changes that...

After a Turbulent Year, Still Some Optimism in the Security World

SAN FRANCISCO–Despite all of the revelations and accusations and recriminations in the security industry in the last year, Microsoft’s Scott Charney said he is still optimistic about the industry’s ability to defend users. However, that optimism is tempered by concern about the threats those user...

D-LINK DIR-615 Cross Site Request Forgery

Exploit Title: Dlink DIR-615 Hardware Version E4 Firmware Verion 5.10 CSRF Vulnerability Google Dork: N/A Date: 19/02/2014 Exploit Author: Dhruv Shah Vendor Homepage: http://www.dlink.com/us/en/home-solutions/connect/routers/dir-615-wireless-n-300-router Software Link: N/A Hardware Version:E4...

Concrete5 CMS 5.6.2.1 - 'index.php?cID' SQL Injection

Exploit Title: Concrete5 sql injection Date: 18/02/2014 Exploit Author: [email protected] Vendor Homepage: https://www.concrete5.org/ Software Link: http://www.concrete5.org/downloadfile/-/view/58379/8497/ Version: 5.6.2.1 stable Tested on: Virtualbox debian URL as a poc:...

Trendchip HG520 ADSL2+ Wireless Modem CSRF Vulnerability

Exploit for hardware platform in category web applications Cross Site Request Forgery This Modem's Web Application , suffers from Cross-site request forgery through which attacker can manipulate user data via sending him malicious craft url. The Modems's Application not using any security token t...

Trendchip HG520 ADSL2+ Wireless Modem - Cross-Site Request Forgery

Trendchip HG520 ADSL2+ Wireless Modem - Cross-Site Request Forgery Exploit Title: Trendchip HG520 ADSL2+ Wireless Modem CSRF Vulnerability Google Dork: N/A Date: 15/02/2014 Exploit Author: Dhruv Shah Vendor Homepage: N/A Software Link : N/A Version: Firmware Version:2.11.38.0RE0.C2B3.9.9.5 Tested...

Kickstarter Compromised, User Data Stolen

Attackers broke into the network of Kickstarter, the crowdfunding platform, and stole a variety of user data, including usernames, addresses, email addresses and encrypted passwords. Company officials didn’t specify exactly how many users were affected and said that “no credit card data of any ki...