White House Creates Cyber Governance Unit Within OMB

With the framework explained for a number of government cybersecurity-related initiatives, now it’s time to talk money. The White House anted up strong in 2015 with proposals for a new data breach notification standard, as well as plans to facilitate information-sharing between the public and...

Symantec Encryption Management Server < 3.2.0 MP6 - Remote Command Injection Exploit

Symantec Encryption Management Server versions prior to 3.2.0 MP6 suffers from a remote command injection vulnerability. Title: Symantec Encryption Management Server - Remote Command Injection Vendor: Symantec Affected Product: Symantec Encryption Gateway Affected Versions: 3.2.0 MP6 Product...

Symantec Encryption Management Server 3.2.0 MP6 - Remote Command Injection

Symantec Encryption Management Server 3.2.0 MP6 - Remote Command Injection Vantage Point Security Advisory 2014-007 ======================================== Title: Symantec Encryption Management Server - Remote Command Injection ID: VP-2014-007 Vendor: Symantec Affected Product: Symantec Encrypti...

Symantec Encryption Management Server < 3.2.0 MP6 - Remote Command Injection

Vantage Point Security Advisory 2014-007 ======================================== Title: Symantec Encryption Management Server - Remote Command Injection ID: VP-2014-007 Vendor: Symantec Affected Product: Symantec Encryption Gateway Affected Versions: 3.2.0 MP6 Product Website:...

House Takes First Steps on Federal Data Breach Law

The House Subcommittee on Commerce, Manufacturing and Trade today held its first hearing of the 114th Congress in order to begin work on developing federal data breach legislation. Pre-hearing memos suggested that any data breach notification law would be primarily concerned with protecting...

20 Million Credentials Stolen From Russian Dating Site 'Topface'

A database containing details of more than 20 Million users of a Russian-based online dating website has been allegedly stolen by a hacker and made publicly available for sale through an online forum. A hacker using the online alias "Mastermind" on an online forum used by cybercriminals claims th...

X (Formerly Twitter): Insecure Data Storage in Vine Android App

Hi Twitter, - Vulnerability Class:OWASP M2 : Insecure Data Storage Every application needs to store something secret, like a website username,password, cookies etc. , internal storage is the place to do it, android sandbox prevents other applications from accessing this data but,In vine android a...

用友NC-IUFO系统通用SQL注入(三)

简要描述： ... 详细说明： 该系统“忘记密码”模块存在sql注入漏洞 链接地址为：/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234 说明：输入用户名和邮箱后提交，程序会提交给 /epp/core（可从抓取的数据包中看到）， 漏洞参数：userid 数据库系统：oracle 注入类型：AND/OR time-based blind 这里直接给出证明案例（列出数据库实例名称即可、不深入）： 0x01; http://nc.xhlbdc.com/epp/ POST /epp/core HTTP/1.1 Host: nc.xhlbdc.co...

President Proposes National Breach Notification Standard

Lacking precious detail, President Obama today proposed a national data breach notification standard, legislation that would mandate breached companies notify affected consumers inside of 30 days. The national law would supersede the current collection of state laws that govern notification...

PHPYun v3.2 /model/ajax.class.php SQL注入漏洞

/model/index.class.phpfunction exchangesaction $GET'page'=$POST'page'; $where=$POST'jobwhere'." ORDER BY lastupdate DESC"; $urlarr'page'="page"; $pageurl=$this-url"index","index",$urlarr; $rows=$this-getpage"companyjob",$where,$pageurl,6,"id,name,uid,salary,edu,lastupdate"; if$rows&&isarray$rows...

Zappos Settles with Nine States Following Data Breach

Online retailer Zappos this week settled with attorneys general in nine states, agreeing to pay out $106,000 stemming from a data breach in 2012 that exposed 24 million customers’ information. Massachusetts Attorney General Martha Coakley filed the settlement in Suffolk Superior Court on Wednesda...

Phone to grab votes APP“train up”to the presence of high-risk vulnerabilities in the user's personal information and other data leaks-bug warning-the black bar safety net

Data 3 6 0 patch-day vulnerability response platform shows that the domestic popular mobile phone to grab votes APP“train up”to the presence of high-risk vulnerabilities, including millions of tickets, ticket orders user ID number, username, plaintext password, detailed ticket information and oth...

NAFCU Dismisses Data Encryption Rule Idea

Even after suffering a data breach, the organization in charge of overseeing the needs of credit unions has cast off the idea of implementing a rule mandating the use of encryption for data transfers. Despite the breach, the National Association of Federal Credit Unions, or NAFCU, is insisting th...

phpmps某处漏洞导致官网沦陷

简要描述： phpmps某处漏洞导致官网沦陷 详细说明： phpmps某处漏洞导致官网沦陷 漏洞证明： phpmps某处漏洞导致官网沦陷 该处泄露了官网密码 WooYun: phpmps通用SQL注入（demo测试成功） admin/gxy123123 进入后台-首页flash处任意上传 shell地址：http://www.phpmps.com/demo/data\com\thumb/20150104iaoydj.php 密码：cai...

Moonpig API Vulnerability Exposes Payment Card Data

Moonpig, a U.K.-based company that sells personalized greeting cards, mugs, t-shirts and other novelties, has been taken to the woodshed for poor security practices by a researcher who claims it’s simple to pilfer user and payment card data through a wonky mobile app API. The company this morning...

Payment Cards Exposed in Possible Chik-fil-A Data Breach

It’s been the year of the data breach, so it only makes sense that reports alleging a data breach at the popular fast food chain, Chik-fil-A, would emerge in the final days of 2014. Late yesterday security journalist Brian Krebs reported that an anonymous source at an unnamed financial institutio...

某通用型大学生管理系统非授权访问

简要描述： 1操作手册泄漏测试用户及密码 2非授权访问，可直接获取系统内所有用户关键信息 3一枚任意文件上传漏洞 详细说明： 注意与其不同 WooYun: 某通用型创新管理系统普通帐号可越权查看及修改任意用户（影响多所高等院校） 官网：http://www.changedu.com/ 由南京先极科技有限公司开发的大学生创新创业训练项目智能管理系统 关键字：大学生创新创业项目智能管理系统 影响案例： http://desktop.nju.edu.cn/cx/ 南京大学大学生创新创业训练智能管理系统 http://dxscx.forestpolice.net/...

Hackers leak 13,000 Passwords Of Amazon, Walmart and Brazzers Users

Hackers claiming affiliation with the hacktivist group "Anonymous" have allegedly leaked more than 13,000 username and password combinations for some of the worlds most popular websites, including Amazon, Xbox Live and Playstation Network. The stolen personal information was released in a massive...

Missing Two-Factor Authentication Led to JPMorgan Breach

The biggest U.S. banking breach of all time came down to the smallest of details. The New York Times, citing sources close to the ongoing investigation of the JPMorgan data breach, said hackers found a server unprotected by two-factor authentication to break in using a stolen user name and passwo...

1.2 Million Credit Cards Lost in Staples Data Breach

Retailer Staples has confirmed that point-of-sale malware had been used at 115 of its retail locations in the United States and criminals were able to access 1.16 million payment card numbers during a six-month-long intrusion. Staples said it removed the malware in September from the affected...