Pro PoS — This Stealthy Point-of-Sale Malware Could Steal Your Christmas

The point of Sale systems are the most tempting target for cyber crooks to steal your credit card information and with this Christmas, you need to be more careful while using your credit cards at retailers and grocery stores. Here's why… Cyber criminals are now selling a new powerful strain of...

libipa_hbac, libsss_idmap, libsss_nss_idmap, libsss_simpleifp, python, sssd security update

CentOS Errata and Security Advisory CESA-2015:2355 Updated sssd packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability...

This $10 Device Can Guess and Steal Your Next Credit Card Number before You've Received It

Imagine you have lost your credit card and applied for a fresh credit card from your bank. What if some criminal is using your new credit card before you have even received it? Yes, it's possible at least with this $10 device. Hardware hacker Samy Kamkar has built a $10 device that can predict an...

多款Huawei路由器信息泄露漏洞

Summary The CF cards on some Huawei switches and ARs contain some sensitive information in plaintext. Once an attacker gets such a CF card, it may result in the leak of sensitive information HWPSIRT-2015-07048. This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID:...

54 Starwood Hotels Hit By Point of Sale Malware

Travelers who stayed at either a Westin, Sheraton, or W hotel over the last year or so are going to want to check their bank statements sooner rather than later. Starwood Hotels and Resorts, a company that owns and operates approximately 1,200 hotels across North America, including the...

Multiple Huawei router information leakage vulnerability

Huawei S7700 is a product of Huawei, China.Huawei S7700, S9700, and S9300 are intelligent routing switches.Huawei AR200, AR1200, AR2200, and AR3200 are multi-service routers for enterprises. An information disclosure vulnerability exists in the CF card of multiple Huawei routers, which allows loc...

RedHat Update for sssd RHSA-2015:2355-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Low: Red Hat Security Advisory: sssd security, bug fix, and enhancement update

Updated sssd packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

qemu: Heap overflow vulnerability in ne2000_receive() function

A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance denial of service or potentially execute arbitrary code on the host...

[SECURITY] Fedora 22 Update: mingw-spice-protocol-0.12.10-1.fc22

Header files describing the spice protocol and the para-virtual graphics card QXL...

openSUSE Security Update : the Linux Kernel (openSUSE-2015-686)

The openSUSE 13.2 kernel was updated to receive various security and bugfixes. Following security bugs were fixed : - CVE-2015-3290: arch/x86/entry/entry64.S in the Linux kernel on the x8664 platform improperly relied on espfix64 during nested NMI processing, which allowed local users to gain...

Juniper Junos MX and T4000 Series Trinity uBFD Packet DoS (JSA10701)

According to its self-reported version number, the remote Juniper Junos device is potentially affected by a denial of service vulnerability due to improper handling of uBFD packets that are received directly by chassis that have the 'Trio Chipset' Trinity MPC. A remote attacker can exploit this...

X (Formerly Twitter): CSRF on cards API

Hi, I would like to report an CSRF issue on the cards API endpoint /i/cards/api/v1.json. Detail Currently the endpoint is responsible for poll cards maybe more to come. When a user votes, a request will be sent to this endpoint to record the user's selected choice. By default there's a CSRF...

TalkTalk Hacked; 4 Million Credit Card Profiles may have been Stolen

TalkTalk, one of the biggest UK-based phone and Internet service provider with more than 4 Million customers, has been hacked again, the company announced late Thursday. TalkTalk is informing its 4 million customers that it has fallen victim to a "significant and sustained cyber attack" and it is...

qemu: Heap overflow vulnerability in ne2000_receive() function

A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance denial of service or potentially execute arbitrary code on the host...

Threat Outbreak Alert RuleID18693: Email Messages Distributing Malicious Software on October 14, 2015

Medium Alert ID: 41514 First Published: 2015 October 14 18:54 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18693 may contain the following files: Name |...

金龙卡金融化一卡通校园卡查询系统任意文件上传漏洞

No description provided by source...

Report from the PCI SSC North American Community Meeting

The Payment Card Industry Security Standards Council held their 2015 North American Community Meeting this year in Vancouver, BC, from September 29 - October 1. Coalfire was well represented at the meeting, with Dan Fritsche, Managing Director, Application Security, making two presentations at th...

Shopify: The POS Firmware is leaking the root Password which can be used for unauthorized access to the device.

The Shopify Point of Sale application is compatible with a new EMV card reader from Miura. The researcher discovered that the firmware for this device contains a wifi password configured in wpasupplicant presumably used during factory tests. However, due to the absence of wifi interface on the...

Data Breach Day — Patreon (2.3M), T-Mobile (15M) and Scottrade (4.6M) — HACKED!

This week, three high-profile data breaches took place, compromising personal and sensitive details of millions of people. Telecommunication giant T-Mobile Crowdfunding website Patreon US brokerage firm Scottrade In T-Mobile's case, its credit application processor Experian was hacked, potentiall...