CVE-2009-3581

Multiple cross-site scripting XSS vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via 1 the DCN Description field in the Accounts Receivables menu item for Add Transaction, 2 the Description field in the Accounts Payable menu item for A...

UBUNTU-CVE-2009-3581

Multiple cross-site scripting XSS vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via 1 the DCN Description field in the Accounts Receivables menu item for Add Transaction, 2 the Description field in the Accounts Payable menu item for A...

CVE-2009-3581

Multiple cross-site scripting XSS vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via 1 the DCN Description field in the Accounts Receivables menu item for Add Transaction, 2 the Description field in the Accounts Payable menu item for A...

Barracuda Web Firewall 660 Firmware 7.3.1.007 Input Validation

Pentest Information: ==================== GESEC Team remove discover a input validation vulnerability on Barracuda - Web Application Firewall 660 Appliance. A remote attacker is able to get sensitive customer sessions hijackor can implement script routines & malicious codesserver-side|persistent...

Barracuda Web Firewall 660 Firmware 7.3.1.007 - Multiple Vulnerabilities

Barracuda Web Firewall 660 Firmware 7.3.1.007 - Multiple Vulnerabilities Pentest Information: ==================== GESEC Team remove discover a input validation vulnerability on Barracuda - Web Application Firewall 660 Appliance. A remote attacker is able to get sensitive customer sessions hijack...

Barracuda Web Firewall 660 Firmware 7.3.1.007 - Multiple Vulnerabilities

Pentest Information: ==================== GESEC Team remove discover a input validation vulnerability on Barracuda - Web Application Firewall 660 Appliance. A remote attacker is able to get sensitive customer sessions hijackor can implement script routines & malicious codesserver-side|persistent...

Design/Logic Flaw

The process function in data/class/pages/admin/customer/LCPageAdminCustomerSearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information customer data via unknown vectors related to sessions...

CVE-2009-4236

The process function in data/class/pages/admin/customer/LCPageAdminCustomerSearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information customer data via unknown vectors related to sessions...

CVE-2009-4236

The process function in data/class/pages/admin/customer/LCPageAdminCustomerSearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information customer data via unknown vectors related to sessions...

CVE-2009-4236: Exposure of Sensitive Information to an Unauthorized Actor

The process function in data/class/pages/admin/customer/LCPageAdminCustomerSearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information customer data via unknown vectors related to sessions...

HSBC Warns of Exposed Customer Info

HSBC Bank says a bug in its imaging software inadvertently exposed sensitive data about some of its customers going through bankruptcy proceedings. Read the full article. Computerworld...

EC-CUBE information disclosure vulnerability

Overview EC-CUBE from LOCKON CO.,LTD. contains an information disclosure vulnerability. EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability. Impact A remote attacker may be able to obtain customer data that...

KB "Running JIRA over SSL or HTTPS" needs review for Windows Standalone scenario

There are three recommended updates to the KB Running JIRA over SSL or HTTPS|http://confluence.atlassian.com/display/JIRA/Running+JIRA+over+SSL+or+HTTPS based on customer feedback. 1. quote When asked to "What is your first and last name" make sure you enter in the DNS name that you will use to...

JVN#79762947 EC-CUBE information disclosure vulnerability

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability. Impact A remote attacker may be able to obtain customer data that is saved by EC-CUBE. Solution Update the Software Apply the latest updates provided by...

Hannaford Data Breach Damages Up to Court

Whether Hannaford Bros. customers may recover damages for the time and trouble it took them to straighten out their bank or credit card accounts after the Scarborough-based firm’s computer system was breached in late 2007 and early 2008 now is up to the Maine Supreme Judicial Court. Read the full...

PHP Live! Support v3.1 Multiple Remote File Include

No description provided by source. 籡 Author : Don Tukulesto [email protected] 籡 Date : November 23, 2009 籡 Homepage : http://www.indonesiancoder.com 籡 Method : Remote File Inclusion 籡 Location : INDONESIA 籡 Vendor : http://www.phplivesupport.com/ 籡 Describe : PHP Live! Support v3.1 c by OS...

New Mass Data Security Law Come March

Beginning in March, personal identifiable data of customers and employees in Massachusetts will be required to be encrypted on any mobile device such as laptops or portable USB drives. Read the full article. EnterpriseNews...

ZDI-09-079: Sun Java Runtime AWT setBytePixels Heap Overflow Vulnerability

ZDI-09-079: Sun Java Runtime AWT setBytePixels Heap Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-079 November 4, 2009 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Java Runtime -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

Time Warner Router Flaw Exposes Customers

There’s a rudimentary vulnerability in a cable modem/wireless router installed in tens of thousands of homes by Time Warner that could enable an attacker to get full access to the router quite easily. The vulnerability, which was discovered and disclosed recently by a blogger named David Chen, is...

Real World Security – Andy Weeks Interview

Andy Weeks, manager of risk and compliance for enterprise information security, at Humana Inc., one of the larger companies in the world, knows a thing or two about large-scale security implementations. And in a company whose customer data is one of its main assets, security is a corporate...