Citadel Malware Authors Adopt Open-Source Development Model

Attackers and malware authors are well-known for their proclivity for taking whatever tactics and techniques work for others and making them their own. That adaptive ability has now extended to the idea of open-source projects, with one malware gang having set up its own community for improving a...

eFronts Community++ 3.6.10 Cross Site Scripting

Title: ====== eFronts Community++ v3.6.10 - Cross Site Vulnerability Date: ===== 2012-02-07 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=423 VL-ID: ===== 423 Introduction: ============= Tailored with larger organizations in mind, eFront Community ++ offers solutions...

eFront Community++ v3.6.10 - Cross Site Vulnerability

Document Title: =============== eFront Community++ v3.6.10 - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=423 Release Date: ============= 2012-02-07 Vulnerability Laboratory ID VL-ID: ==================================== 423...

eFront Community++ v3.6.10 - Cross Site Vulnerability

Document Title: =============== eFront Community++ v3.6.10 - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=423 Release Date: ============= 2012-02-07 Vulnerability Laboratory ID VL-ID: ==================================== 423...

Google Begins Security Review Process for Android Apps

After a couple of years of seeing headlines announcing a steady stream of pieces of malware and trojaned apps appearing the Android Market, Google finally has taken steps to find and remove malicious apps from the market automatically. The company has unveiled a service called Bouncer that scans...

Opera 11.60 Array Integer Overflow

CAL-2012-0004 opera array integer overflow 1 Affected Products ================= 11.60 and prior 2 Vulnerability Details ===================== Code Audit Labs http://www.vulnhunt.com has discovered a integer overflow vulnerability in array functions like Int32Array,Int16Array... . Opear vendor sa...

PlayStation Network Chief Leaves Sony After 17-Year Run

Susan Panico, the head of Sony’s PlayStation Network PSN, has left that company, according to a report from Venture Beat. Panico’s tenure as head of the PSN was reportedly marked by vast growth, but was marred in the last year by a series of missteps, including the May, 2011 data breach affecting...

Lead Capture Page System Cross Site Scripting

================================================================================= Web : ashiyane.org e-mail : HashoR DOT BlackHat AT Gmail.Com I'm HashoR , member from ashiyane.org -!We Love KurDestaN!- ================================================================================...

Syneto Unified Threat Management 1.3.31.4.2 - Multiple Cross-Site Scripting HTML Injection Vulnerabilities

Syneto Unified Threat Management 1.3.31.4.2 - Multiple Cross-Site Scripting HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/51597/info Syneto Unified Threat Management is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properl...

Gamers Seek Beta Versions, Download Malware Instead

Tracking the increasingly common use of PC games as an infection vector, researchers at the Microsoft Malware Protection Center MMPC discovered a couple of malicious programs making the rounds on torrent and file sharing sites. Social engineers are disguising their malware by labeling it as the...

Cyber Security Fraud in the Banking Industry: Lessons Learned in OCC Examiner Training

In late October 2011, Coalfire participated in a day of IT audit training with about 35 bank examiners. As you would expect, we covered a lot of previously hot topics. The conversation changed as we started talking about the amount of fraud being realized by community banks and credit unions...

2011: Wait, What?

The security industry can be a giant repetitive, follow-the-loser echo chamber of unoriginal thoughts, familiar flaws and copycat theories. But if ever there was a year in which folks could stand back and look at what’s gone on and say, what in the hell just happened, 2011 was it. So rather than...

French MP Valerie Boyer's website hacked by Turkish hackers

French MP Valerie Boyer's website hacked by Turkish hackers Hackers have attacked the website www.valerie boyer.fr of French parliamentarian Valerie Boyer, the author of the bill criminalizing genocide denial that was recently adopted by the French National Assembly. The hackers posted a Turkish...

Multiple XSS in KnowledgeTree Community Edition

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in KnowledgeTree Community Edition, which can be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in KnowledgeTree Community Edition: CVE-2012-0988 Input appended to the...

Video Community Portal - userID SQL Injection

Video Community Portal - userID SQL Injection source: https://www.securityfocus.com/bid/51108/info Video Community Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an...

Video Community Portal - 'userID' SQL Injection

source: https://www.securityfocus.com/bid/51108/info Video Community Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access ...

Social Network Community 2 - userID SQL Injection

Social Network Community 2 - userID SQL Injection source: https://www.securityfocus.com/bid/51107/info Social Network Community is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allo...

Social Network Community 2 - 'userID' SQL Injection

source: https://www.securityfocus.com/bid/51107/info Social Network Community is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, acces...

Data Breaches for All

Sony’s online gaming platform, The PlayStation Network PSN, disappeared for more than a month starting in April, and no amount of double X and O-ing or right joysticking could save it. The reason? A massive attack on PSN’s network knocked the gaming giant offline and exposed the data of more than...

CVE-2011-4808

SQL injection vulnerability in the HM Community comhmcommunity component before 1.01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a fndhome action to index.php...