Zendesk: CSV Excel Macro Injection Vulnerability in export customer tickets

Scenario: An attacker creates a name as =AND21 and creates a ticket. When a team member clicks export as csv and opens it instead of seeing =AND21 they see TRUE. This means that the cell is active. An attacker could basically attack makes a ticket, use -2+3+cmd|' /C calc'!E1 and could execute...

change fontset 'icons' to html entities to improve security compliance

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-38988. panel It seems that the icons in Confluence are currently rendered using fontset. This can be an issue for organization...

change fontset 'icons' to html entities to improve security compliance

It seems that the icons in Confluence are currently rendered using fontset. This can be an issue for organization especially banks that have strict security constraint fontset cannot be downloaded as a result this will not render on customer instance. I would recommend that we change the current...

Threat Outbreak Alert RuleID17564: Email Messages Distributing Malicious Software on August 25, 2015

Medium Alert ID: 40661 First Published: 2015 August 25 19:45 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17564 may contain the following files: Name |...

Uber to Quadruple Security Staff by 2016

Ride-sharing company Uber, which has already battled a database compromise and hackers selling stolen user accounts this year, announced over the weekend that it will bulk up its security division. Uber will quadruple the number of employees that currently oversee security at the San...

53KF设计缺陷可冒充客服随意发消息（以平安万里通为例）

简要描述： 53KF软件，可以随意冒充客服发送消息给访客。 详细说明： 首先，查看网络请求，发现访客给客服发消息的时候，请求的内容如下： 这时候，高潮来了，我们把sid和did倒一下，然后用curl发个请求过去，这个时候，居然，对话窗口，客服，活了，客服说话了！！！！太假了！！！ 别问我怎么发现的。 好不容易找下万里通客服。 发过去的消息都不回复。 本想用curl疯狂发消息。 然后不小心将sid和did调换了一下。 然后还需要然后吗？ 漏洞证明： 不用证明了吧。...

Moonpig Warns Customers of 'Security Issue'

Moonpig has warned customers that some of their email addresses, passwords, and account balances have been published after what it calls a “security issue”. The company, which sells custom greeting cards, said in a message to users that attackers were not able to get any credit card information, ...

CentOS 6 : python (CESA-2015:1330)

Updated python packages that fix multiple security issues, several bugs and add one enhancement are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

Threat Outbreak Alert RuleID16854: Email Messages Distributing Malicious Software on July 22, 2015

Medium Alert ID: 40091 First Published: 2015 July 23 19:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID16854 and RuleID16854KVR may contain the followin...

White hat hackers: part of the banks risk enterprise network platform to determine the memory vulnerability-vulnerability warning-the black bar safety net

The insurance company through the website and other online sales channels to sell insurance really“insurance”? Recently, a large listed life insurance companies were again exposed a“provincial system loopholes, leaks millions of customer information.” In fact, the securities daily on zqrbbaoxian...

CVE-2015-4247

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none...

CVE-2015-4246

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none...

CVE-2015-4245

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none...

CVE-2015-4249

CVE-2015-4249 entry is rejected; not an active vulnerability entry and not used in security assessments.

Threat Outbreak Alert RuleID16561: Email Messages Distributing Malicious Software on July 9, 2015

Medium Alert ID: 39843 First Published: 2015 July 10 13:38 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID16561 may contain the following files: Name | Siz...

Adobe to Patch Hacking Team Flash Zero Day

Adobe tomorrow is expected to release an updated version of Flash Player that will patch a zero-day vulnerability uncovered among the 400 GB of data stolen from Hacking Team. The controversial Italian intrusion and surveillance software vendor was breached and on Sunday, private documents,...

Shopify: Reflected XSS in chat

https://livechat.shopify.com/customer/chats/new?chat%5Bemail%5D=mymail%40mail.com&chat%5Bname%5D=My+Name&utmsource=partner&chat%5Btags%5D=123%27%5D%29;alert%281%29;//&chat%5Bmetadata%5D%5Bshopid%5D=90909090%22 Vulnerable param is chattags. If fill it with 123';alert1;// the XSS fill fire after...

IBM Leads Limit Bypass Vulnerability

IBM Leads is a solution from IBM USA for improving the customer management process. The program provides functions such as finding prospects, assigning customers and sending notifications of new customer information. A security vulnerability exists in IBM Leads. A remote attacker could exploit th...

CVE-2015-0115

Cross-site request forgery CSRF vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to hijack the authentication of customer accounts...

CVE-2015-0115

Cross-site request forgery CSRF vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to hijack the authentication of customer accounts...