Data Breaches Feed Password Reuse Crimes: No Simple Fixes

It was June 2012 when Dale Meredith was shopping online for a BBQ grill for Father’s Day and found one at Sears.com. The only snag, he had to create a username and password to buy it. That irked him. He was annoyed because it was literally the hundredth-plus service—including his local newspaper,...

jenkins: Malicious users with multiple user accounts can prevent other users from logging in (SECURITY-243)

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service unable to login by editing the "full name."...

Facebook CEO Zuckerberg's Twitter, Pinterest accounts Hacked! And the Password was...

The man who runs the biggest social network and continuously implements new security measures to boost its billion users security, himself failed to follow basics of Internet security for his own online accounts. Yes, I’m talking about Facebook CEO Mark Zuckerberg, who had his Twitter and Pintere...

TeamViewer Denies Hack, Blames Password Reuse for Compromises

Remote support software company TeamViewer continues to contest claims this week it was hacked and instead claims that password reuse and careless user actions may have led to some of its customers’ machines being compromised. The German company has been vigilant with its stance since posting a...

427 Million Myspace Passwords leaked in major Security Breach

MySpace has suffered a major data breach in which hundreds of Millions of users have had their account details compromised. You may have forgotten Myspace and have not thought of it in years after Facebook acquired the market, but Myspace was once-popular social media website. On Tuesday, Myspace...

Millions of Stolen MySpace, Tumblr Credentials Being Sold Online

Hackers are peddling roughly 427 million passwords belonging to users of MySpace, a social network that in its heyday was one of the most visited sites on the internet. The same service that claimed to have information on 164 million LinkedIn users earlier this month is now boasting to have...

Cisco WebEx Meeting Center Improved Logging Capabilities

Cisco WebEx Meeting Center user accounts are subject to enumeration via Personal Meeting Rooms PMRs. This advisory documents that an administrative update has been made to improve the logging of connections to the PMRs. This advisory is available at the following link:...

PHP CRUD 1.4 Backdoor Accounts

======================================================================== | Title : PHP CRUD V1.4 Backdoor Account Vulnerability | Author : indoushka | email : [email protected] | Tested on: windows 8.1 Français V.Pro | Vendor : http://demo.code-abc.com/scrudv1.4/...

CVE-2016-3722

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service unable to login by editing the "full name."...

Automattic: WordPress core stored XSS via attachment file name

I think there's a problem with missing HTML encoding of attachment file names. A user with the capability to create attachments could compromise other accounts including administrator by injecting HTML tags in the file name. Creating attachment with arbitrary filenames is possible at least via th...

File Replication Pro Information Disclosure Vulnerability

File Replication Pro is a file management solution for backing up, copying files from different network nodes. An information disclosure vulnerability exists in File Replication Pro version 7.2.0 and earlier. As File Replication Pro allows a malicious user to access arbitrary files on a remote...

CloudBees Jenkins CI and Jenkins LTS Unauthorized Modification Vulnerability (CNVD-2016-03157)

CloudBees Jenkins CI formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor ongoing software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins CI is a...

[SECURITY] [DLA 468-1] libuser security update

Package : libuser Version : 1:0.56.9.dfsg.1-1.2+deb7u1 CVE ID : CVE-2015-3245 CVE-2015-3246 Debian Bug : 793465 Two security vulnerabilities were discovered in libuser, a library that implements a standardized interface for manipulating and administering user and group accounts, that could lead t...

CVE-2016-3722

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service unable to login by editing the "full name."...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory: Description SECURITY-170 / CVE-2016-3721 Arbitrary build parameters are passed to build scripts as environment variables SECURITY-243 / CVE-2016-3722 Malicious users with multiple user accounts can prevent other users from logging in SECURITY-250 / CVE-2016-3723...

Microsoft Graphics Component Multiple Vulnerabilities (3156754)

This host is missing a critical security update according to Microsoft Bulletin MS16-055. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Win32k Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or...

Top 4 Data Breaches reported in last 24 Hours

There is no doubt that data breaches are on the rise. Hardly a day goes without headlines about any significant data breach. According to the latest ‘Cyber Security Breaches Survey 2016’ report published by UK government, two-thirds of the biggest firm in the UK have experienced at least a cyber...

FreedomPop Account Hijacking Flaws Remain Unpatched

It took close to two months, but free wireless and mobile provider FreedomPop has acknowledged reports of a serious vulnerability in its service. U.K.-based researcher Paul Moore told Threatpost that FreedomPop, which has been operating in the U.K. since last September, finally responded to a bug...

Office 365 Vulnerability Exposed Any Federated Account

A severe vulnerability in the way Microsoft Office 365 handles federated identities via SAML put an attacker in position to have access to any account and data, including email messages and files stored in the cloud-based service. Microsoft pushed through a mitigation to the service on Jan. 5,...