[The ManageOwnage Series, part XI]: Remote code execution in ServiceDesk, Asset Explorer, Support Center and IT360

Hi, This is part 11 of the ManageOwnage series. For previous parts, see 1. This time we have two remote code execution via file upload and directory traversal on several ManageEngine products - Service Desk Plus, Asset Explorer, Support Center and IT360. The first vulnerability can only be...

Parking Services Confirm Payment Card Breaches

Two services that allow users to reserve over the Internet offsite parking spots at airports confirmed week that they recently suffered data breaches and customer data may be at risk. Park ‘N Fly, headquartered in Atlanta, and OneStopParking, which is based in Florence, Ky, allow travelers to...

Moderate: Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.0.0 security update

Red Hat JBoss Data Virtualization 6.0.0 roll up patch 4, which fixes three security issues and various bugs, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

Zappos Settles with Nine States Following Data Breach

Online retailer Zappos this week settled with attorneys general in nine states, agreeing to pay out $106,000 stemming from a data breach in 2012 that exposed 24 million customers’ information. Massachusetts Attorney General Martha Coakley filed the settlement in Suffolk Superior Court on Wednesda...

Multiple Cross-Site Scripting Vulnerabilities in Zurmo CRM

Zurmo CRM is the United States Zurmo company's set of open source PHP-based customer relationship management system CRM. Multiple cross-site scripting vulnerabilities exist in Zurmo CRM because it fails to properly filter user-supplied input. An attacker could potentially exploit these...

FTC Urges IoT Privacy, Security at Consumer Electronics Show

In her keynote address yesterday at the Consumer Electronics Show in Las Vegas, Federal Trade Commission Chairwoman Edith Ramirez imagined the dystopic convergence of big data conglomerates and a ceaseless information gathering machine fueled by the constant connectivity ushered in by the so-call...

Zurmo CRM 2.8.5 Cross Site Scripting

Zurmo CRM 2.8.5 Multiple Reflected Cross-Site Scripting Vulnerabilities Vendor: Zurmo Inc. Product web page: http://www.zurmo.org Affected version: 2.8.5 Summary: Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. Desc: Zurmo CRM suffers...

Moonpig API Vulnerability Exposes Payment Card Data

Moonpig, a U.K.-based company that sells personalized greeting cards, mugs, t-shirts and other novelties, has been taken to the woodshed for poor security practices by a researcher who claims it’s simple to pilfer user and payment card data through a wonky mobile app API. The company this morning...

Potential Security Concerns in Comcast Hotspot Class-Action

Cable and Internet service conglomerate Comcast is facing a class-action lawsuit stemming from its use of customer routers as personal home Wi-Fi networks as well as public-facing wireless hotspots available for other Comcast-Xfinity customers. Toyer Grear and Jocelyn Harris, themselves and on...

CVE-2014-9212

CVE-2014-9212 affects Altitude uAgent/uCI 7.5 with multiple XSS vulnerabilities. An attacker can inject arbitrary script via (1) an email hyperlink or (2) the style parameter in the image attribute section. Affected product: Altitude uAgent Web within Altitude uCI 7.5. CVSS v2 base score 4.3 (Med...

CVE-2014-9212

Multiple cross-site scripting XSS vulnerabilities in Altitude uAgent in Altitude uCI Unified Customer Interaction 7.5 allow remote attackers to inject arbitrary web script or HTML via 1 an email hyperlink or the 2 style parameter in the image attribute section...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 openssl security update

An update for the openssl component for Red Hat JBoss Web Server 2.1.0 that provides a patch to mitigate the CVE-2014-3566 issue is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Red Hat JBoss Web Server is a ful...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.3 update

Red Hat JBoss BPM Suite 6.0.3 roll up patch 1, which fixes two security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System...

Apple Pay and PCI Compliance

A year ago, many retail cybersecurity discussions began and ended with PCI compliance. Today, after a gut-wrenching 10 months of data breaches stretching from mom-and-pop shops to category-leading brands, the discussions are broader, the risks are better understood and every link in the customer...

漫游用友集团各大系统

简要描述： 漫游用友集团各大系统 详细说明： 在一个月黑风高的夜晚，用友某员工的集团办公平台账号，悄悄地泄露了。 // Send message Transport transport=session.getTransport; transport.connect"192.168.210.160" , 25, "ch2","1r"; transport.sendMessagemessage,new Addressnew InternetAddress"[email protected]" ; transport.close;...

USPS Breach Hits Customers, Employees

The United States Postal Service is continuing its investigation around a cyber attack at the agency that managed to compromise the information of both employees and customers earlier this year. The USPS announced in a statement on Monday that it recently fell victim to a “cyber intrusion inciden...

Threat Outbreak Alert RuleID12297: Email Messages Distributing Malicious Software on November 6, 2014

Medium Alert ID: 36349 First Published: 2014 November 6 18:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID12297 may contain the following files: Name |...

Hacking Team Defends Spyware, Attacks Researchers' Methods

Privacy advocates and anti-surveillance activists have been taking a close look at the way that some vendors of so-called lawful intercept and surveillance software and hardware systems conduct their business and which customers and governments they sell their wares to. Now, some of those...

ESA-2014-096: EMC Avamar Sensitive Information Disclosure Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-096: EMC Avamar Sensitive Information Disclosure Vulnerability EMC Identifier: ESA-2014-096 CVE Identifier: CVE-2014-4624 Severity Rating: 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C Affected products: • EMC Avamar Data Store ADS and Avamar Virtual Editio...

Staples Investigating Payment Data Card Breach

The office supply chain Staples Inc. is reportedly looking into a payment card breach, potentially making it the latest in a long line of retail establishments to suffer a compromise over the last year. “Staples is in the process of investigating a potential issue involving credit card data and h...