Inside Story : How RSA was got hacked !

Inside Story : How RSA was got hacked ! The hack last month at RSA Security has been shrouded in mystery. How did a hacker manage to infiltrate one of the world's top computer-security companies? And could the data that was stolen be used to impair its SecurID products, which are used by 40 milli...

InTerra Blog Machine 1.84 XSS Vulnerability

Exploit for php platform in category web applications Product: InTerra Blog Machine Vendor: InTerra Blog Machine Team http://code.google.com/p/interra/ Vulnerable Version: 1.84 and probably prior versions Vendor Notification: 31 March 2011 Vulnerability Type: Stored XSS Cross Site Scripting Risk...

Feng Office 1.7.3.3 - Cross-Site Request Forgery

Feng Office 1.7.3.3 - Cross-Site Request Forgery Vulnerability ID: HTB22910 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinfengoffice.html Product: Feng Office Vendor: Secure Data SRL http://www.fengoffice.com/ Vulnerable Version: 1.7.3.3 and probably prior versions Vendor Notification: 17...

Fake 'Walk and Text' App steals Android user data !

Android users who download a pirated copy of the Walk and Text app are strolling smack into trouble. The rogue app, called Android. Walkinwat, is a corrupted version of the legitimate Android Walk and Text app, the security firm Symantec reported. Walk and Text, which can be found in many...

Spitfire CMS 1.0.436 Cross Site Scripting

Vulnerability ID: HTB22903 Reference: http://www.htbridge.ch/advisory/xssinspitfirecms.html Product: Spitfire CMS Vendor: Spitfire http://spitfire.clausmuus.de/ Vulnerable Version: 1.0.436 Vendor Notification: 15 March 2011 Vulnerability Type: XSS Risk level: Medium Credit: High-Tech Bridge SA -...

LotusCMS 3.0.3 Multiple Vulnerabilities

Exploit for php platform in category web applications Product: LotusCMS Vendor: Arboroia Network http://www.lotuscms.org/ Vulnerable Version: 3.0.3 and probably prior versions Vendor Notification: 01 March 2011 Vulnerability Type: CSRF Cross-Site Request Forgery Risk level: Low Credit: High-Tech...

Inbox.com Cross Site Scripting (XSS) vulnerability !

Inbox.com Cross Site Scripting XSS vulnerability ! Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by anothe...

Malware-Infected Apps Yanked From Android Market

A large number of apps in the Android Market have been found to contain a piece of malware known as DroidDream, a Trojan that not only is able to harvest sensitive data from an infected device, but also can break out of the Android sandbox and download additional malicious code to the phone from...

Mobile Zeus Variants Target Windows Mobile, Symbian Phones

There are two new versions of the Zeus malware making the rounds right now, both of which target popular mobile phone platforms. One of the variants targets Windows Mobile devices, while the other is going after the Symbian platform, and both are intent on silently stealing data from infected...

CBC Reports Canadian Government Hacked By Chinese

The Canadian Broadcasting Corp. is reporting that key government agencies in Canada were the targets of a sophisticated cyber attack aimed at stealing sensitive government information. The attack was first detected in January, 2011, and prompted Canada’s Finance Department and Treasury Board off...

Anonymous hackers planning real-world attacks !

A computer security firm working to expose members of hacker group "Anonymous" pulled out of a premier industry conference here due to threats of real-world attacks on its employees. HBGary personnel have been peppered with threatening messages since Anonymous hackers looted data from its compute...

UMI.CMS 2.8.1.2 Cross Site Scripting

==================================== Vulnerability ID: HTB22813 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinumicms1.html Product: UMI.CMS Vendor: umisoft http://www.umi-cms.ru/ Vulnerable Version: 2.8.1.2 Vendor Notification: 25 January 2011 Vulnerability Type: Stored XSS Cross...

HTB22812: XSRF (CSRF) in UMI.CMS

Vulnerability ID: HTB22812 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinumicms.html Product: UMI.CMS Vendor: umisoft http://www.umi-cms.ru/ Vulnerable Version: 2.8.1.2 Vendor Notification: 25 January 2011 Vulnerability Type: CSRF Cross-Site Request Forgery Risk level: Low Credit: High-Tec...

Research Reveals Huge Cache of FTP, Email Credentials Stolen by Waledac

Researchers have discovered that the gang behind the once-and-future botnet Waledac has gathered nearly 500,000 stolen passwords for email accounts, along with close to 125,000 sets of pilfered credentials for FTP accounts. The discovery isn’t so surprising in its details, but rather in its scope...

Confusion, Recriminations Surround PlentyofFish Breach

Controversy has erupted around the free online dating site, PlentyofFish.com, after the Web site was found to contain a serious security vulnerability that could have potentially exposed the personal information of some 30 million users. In another chapter of the annals of “No Good Deed Goes...

USN-1048-1: Tomcat vulnerability

It was discovered that Tomcat did not properly escape certain parameters in the Manager application which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server...

Week in Security: Stuxnet Revelations and Black Hat Happenings

Stuxnet chat saturated the news this week after the New York Times got the cyber security echo chamber going with a story delving into the mysterious worm. But Stuxnet was hardly the only news this week, which also saw new research from the Black Hat Briefings conference in Washington D.C. and...

How Attackers Steal Your Data

ARLINGTON, VA–Pulling valuable data out of corporate networks is the end goal of many, if not most, attacks these days and the tactics that attackers use to get into their targets are fairly well understood and publicized. But it’s not often that you get a look at the way that the data is actuall...

1000s of users data stolen in Fine Gael site hack !

The Data Protection Commissioner is investigating the attack on the Fine Gael website yesterday, after an Evening Herald journalist claimed he was sent data of 2,000 users of the site after the hack occurred. The Data Protection Commissioner said Fine Gael contacted him after their site was...

Report : Attacks on social media to rise in 2011 !

ESET, a security solution provider for viruses and malicious software, has released its cyber-threat report for 2011, predicting that attacks on Facebook and other social networks will increase over the coming year. The report prepared by specialists and searchers in the business also says the...