Russian payment processor ChronoPay.com Hacked !

Criminals this week hijacked ChronoPay.com, the domain name for Russia's largest online payment processor, redirecting hundreds of unsuspecting visitors to a fake ChronoPay page that stole customer financial data. Reached via phone in Moscow, ChronoPay chief executive Pavel Vrublevsky said the...

Millions of customer's email addresses stolen from Honda !

American Honda says it has contacted millions of its customers after hackers stole a database containing names, email addresses, and VINs the Vehicle Identification Number, or unique 17 character ID for your motor vehicle. The obvious danger is that cybercriminals might use the list to send out...

Hamburgled: Third Party Breach Spills Customer Data From McDonald's, Others

UPDATE McDonald’s has served billions of hamburgers, but thousands of those customers may be regretting their patronage, after the fast food giant acknowledged that contact information for an unknown number of customers was stolen from a third party e-mail marketing firm it uses. McDonald’s said...

7) Reputation matters – check it!

When you walk into a doctor’s office, you like to see those frames hanging, right? The degrees from the prestigious medical school and certificates of completion from a reputable hospital residency program? The license from your state’s Board of Registration in Medicine, maybe? They don’t mean yo...

BSI Hotel Booking System Admin 1.42.0 - Authentication Bypass

BSI Hotel Booking System Admin 1.42.0 - Authentication Bypass ----------------------------------------------------------------------------------------- ECHOADV113$2010 BSI Hotel Booking System Admin Login Bypass Vulnerability...

THQ.com SQL Injection

This is pretty much because I want to embarrass these assholes. See: http://gamepolitics.com/2010/06/14/exec-thq-anti-used-game-initiative-could-make-everyone-happy SQLi 1: http://www.thq.com/us/mythq/register?contentType=GAMEALERT&alertGame='4896 This one is pretty obvious. It's an injection via...

Wyndham Hotels Hit Again By Hackers

Hackers broke into computer systems at Wyndham Hotels & Resorts recently, stealing sensitive customer data. The break-in occurred between late October 2009 and January 2010, when it was finally discovered. This is the third data breach reported by Wyndham in the past year. Read the full article...

Design/Logic Flaw

The process function in data/class/pages/admin/customer/LCPageAdminCustomerSearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information customer data via unknown vectors related to sessions...

CVE-2009-4236

The process function in data/class/pages/admin/customer/LCPageAdminCustomerSearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information customer data via unknown vectors related to sessions...

CVE-2009-4236

The process function in data/class/pages/admin/customer/LCPageAdminCustomerSearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information customer data via unknown vectors related to sessions...

HSBC Warns of Exposed Customer Info

HSBC Bank says a bug in its imaging software inadvertently exposed sensitive data about some of its customers going through bankruptcy proceedings. Read the full article. Computerworld...

EC-CUBE information disclosure vulnerability

Overview EC-CUBE from LOCKON CO.,LTD. contains an information disclosure vulnerability. EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability. Impact A remote attacker may be able to obtain customer data that...

JVN#79762947 EC-CUBE information disclosure vulnerability

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability. Impact A remote attacker may be able to obtain customer data that is saved by EC-CUBE. Solution Update the Software Apply the latest updates provided by...

Real World Security – Andy Weeks Interview

Andy Weeks, manager of risk and compliance for enterprise information security, at Humana Inc., one of the larger companies in the world, knows a thing or two about large-scale security implementations. And in a company whose customer data is one of its main assets, security is a corporate...

Radisson Hotels Report Significant Data Breach

Add the Radisson Hotels & Resorts chain to the growing list of businesses datalossdb.org reporting significant data breaches that exposed sensitive customer data. In an open letter radisson.com to guests, Radisson chief operating officer Fredrik Korallus said the hotel chain’s computer system was...

T-Mobile data on Full Disclosure is real

T-Mobile is now saying that the information that was posted to the Full Disclosure security mailing list this weekend is in fact the company’s data. But the company stopped short of confirming that the anonymous hackers have access to customer data and other sensitive information, as they have...

Employee stole data from Sprint

Sprint has sent letters to thousands of its customers informing them that a former employee compromised their personal account data over the course of two months in 2008 and 2009. Brian Krebs Security Fix says that the company mailed warnings to several thousand customers and that the breach coul...

Charon Cart v3(Review.asp) Remote SQL Injection Vulnerability

Vulnerability Report Title : Charon Cart v3Review.asp Remote SQL Injection Vulnerability Author : ajann Script Page : http://www.charon.co.uk Exploit; http://target/path/Review.asp?ProductID=SQL HERE Example:...

Gentle-killer－cross-site Script attacks-vulnerability warning-the black bar safety net

Gentle-killer－cross-site Script attack · Translation:Billi·transfer from CPCW The first part: cross-site SCRIPT attacks in several ways: Whenever we think of hackers, a hacker is often such a portrait: a lonely man, snuck into someone else's server, destroying or stealing someone else's secret...

Hardened-PHP Project Security Advisory 2005-23.105

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Multiple vulnerabilities in vTiger CRM Release Date: 2005/11/24 Last Modified: 2005/11/24 Author: Christopher Kunz Application: vTiger 4.2 and prior Severity: Cross-Site...