German software developer Ashampoo Hit by Data Breach !

German software developer Ashampoo Hit by Data Breach ! German software developer Ashampoo has notified its customers about a data breach incident that resulted in the exposure of their names and email addresses. According to an announcement posted on the company's website, unidentified hackers...

Stolen data may be sold on cyber black market !

Hackers behind what computer security experts believe could be the biggest data theft in US history may be planning to sell the information to cyber criminals for targeted scams. And while the tens of millions of names and email addresses swiped from online marketing firm Epsilon do not appear to...

Epsilon Data Breach Expands to Include Capital One, Disney, Others

The compromise of a system at online marketing company Epsilon Data Management that came to light last week and involves the email addresses and names of customers at companies such as Citibank, Kroger and Disney expanded over the weekend to include a slew of other companies. The attack does not...

Kroger Customer Database Hacked !

Kroger Customer Database Hacked ! The company announced in an e-mail to customers their system has been hacked by someone outside the company. This means the hacker had access to customer names and e-mail addresses contained in the Kroger database. Kroger stresses only the names and e-mail...

Epsilon's (Marketing services firm) Customer Lists of Major Brands Compromised !

Epsilon's Marketing services firm Customer Lists of Major Brands Compromised ! Due to the growing list of brands disclosing that they have been compromised as a result of this breach, I'm going to go ahead and tag this as a massive breach. And I only expect it to get bigger as more announcements...

Keyloggers in Samsung Laptops, Officials says - Samsung laptops are in fact secure !

Keyloggers in Samsung Laptops, Officials says - Samsung laptops are in fact secure ! We'll start by saying that we've reached out to Samsung for a response here, but as of now, no reply has been given -- neither a confirmation nor a refusal of truth. Why bother mentioning that? If this here story...

TripAdvisor Warns Customers of Data Breach

TripAdvisor, the popular travel-planning site, is warning customers that some portion of the company’s customer email database was stolen recently by attackers. The company is not saying how many customers are affected or how the breach occurred. TripAdvisor posted a message on its site warning...

Profile picture thumbnail generation can consume unlimited amount of memory

Discovered a Studio customer, you can upload a very large profile picture to expose the same problem as CONF-21480, just in a different area of the application. We should limit the size of images we're willing to load into memory to avoid this problem with user pictures...

Play.com compromised and security breach Admitted !

Play.com compromised and Security breach Admitted ! Play.com, one of the largest online retailers of consumer goods, has suffered a security breach. In a warning to customers, Play.com has said that customer names and email addresses may have been compromised. Play.com is washing its hands of...

CVE-2010-4761

The customer-interface ticket-print dialog in Open Ticket Request System OTRS before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the 1 responsible, 2 owner, 3 accounted time, 4 pending until...

DEBIAN-CVE-2008-7275

Multiple cross-site scripting XSS vulnerabilities in Open Ticket Request System OTRS before 2.3.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 AgentTicketMailbox or 2 CustomerTicketOverView...

DEBIAN-CVE-2008-7283

Open Ticket Request System OTRS before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions...

CVE-2008-7283

Open Ticket Request System OTRS before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions...

CVE-2010-4761

The customer-interface ticket-print dialog in Open Ticket Request System OTRS before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the 1 responsible, 2 owner, 3 accounted time, 4 pending until...

CVE-2010-4762

Cross-site scripting XSS vulnerability in the rich-text-editor component in Open Ticket Request System OTRS before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface...

DEBIAN-CVE-2009-5055

Open Ticket Request System OTRS before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the...

DEBIAN-CVE-2011-1433

The 1 AgentInterface and 2 CustomerInterface components in Open Ticket Request System OTRS before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the UserLogin and UserPW fiel...

Design/Logic Flaw

The customer-interface ticket-print dialog in Open Ticket Request System OTRS before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the 1 responsible, 2 owner, 3 accounted time, 4 pending until...

CVE-2010-4763

The ACL-customer-status Ticket Type setting in Open Ticket Request System OTRS before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the 1 Status, 2 Service, and 3 Queue via selections...

Cross site scripting

Cross-site scripting XSS vulnerability in the rich-text-editor component in Open Ticket Request System OTRS before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface...