Beware of Christmas E-Cards: Tips to Avoid Holiday Scams

Your mailbox may be filling up with Christmas cards from friends and family, and so might your email inbox. But, as the song says, 'you better watch out,' because some of those merry emails could be from an internet Grinch looking to steal your peace of mind. Christmas cards are a great way to se...

Godaddy's Workspace 5.3 Cross Site Scripting

Godaddy´s Workspace 5.3 XSS Explanation: The javascript for special caracter filtering provided in email13.secureserver.net can be use to create a XSS attack, if we edit the content of an email and put this will be filtered and scramble, making the XSS impossible, BUT, if we write we will bypass...

Former UCM Students Charged with Hacking and Data Theft

Two former University of Central Missouri students have been charged with hacking university databases, stealing confidential information, and attempting to sell it for profit. Joseph Camp and Daniel Fowler were indicted by a federal grand jury. They allegedly created a computer virus and spread ...

Potential WikiLeaks Phishing Scams

In the past, US-CERT has received reports of phishing scams and malware campaigns related to topics that are of high-interest to the U.S. Government or news media, such as the WikiLeaks website. Users' systems have been compromised by receiving and accessing phishing emails with subject lines tha...

cPanel 11.x - Cross-Site Request Forgery (Edit E-mail)

cPanel 11.x - Cross-Site Request Forgery Edit E-mail Exploit Title: Cpanel 11.X Edit E-mail Cross Site Request Forgery exploit Date: 22 - 10 - 2010 Author: Mon7rF Mail : [email protected] Tested on: Windows 7 --------------------------------------------------------------------------------------...

Holiday Season Phishing Scams and Malware Campaigns

As the winter holidays are quickly approaching, US-CERT is republishing this entry to increase awareness. In the past, US-CERT has received reports of an increased number of phishing scams and malware campaigns that take advantage of the winter holiday and holiday shopping season. US-CERT reminds...

Botnet Crackdowns Staunch Spam…For a Month

The crackdowns on massive, spam-spewing botnets disrupted the global flow of spam e-mail…for about a month. That, according to a new report out from Kaspersky Lab. “Spam in the Third Quarter of 2010” is the latest, quarterly report from Kaspersky’s anti virus research labs. It finds that several...

Spammers 'Gearing Up' Botnets for Holiday Rush

Spammers are pushing out e-mail borne malware at unprecedented rates in an apparent attempt to build up botnets in advance of the busy holiday shopping season, according to a report by Google. Writing on the company’s enterprise blog, Adrian Soghoian and Adam Hollman of the Google Postini Service...

Spammers Using SHY Character to Hide Malicious URLs

Spammers have jumped on the little-used soft hyphen or SHY character to fool URL filtering devices. According to researchers at Symantec Corp., spammers are larding up URLs for sites they promote with the soft hyphen character, which many browsers ignore. Spammers aren’t shy about jumping humans...

Lotus Domino nrouter.exe iCalendar MAILTO buffer overflow

Added: 09/24/2010 CVE: CVE-2010-3407 BID: 43219 OSVDB: 68040 Background IBM Lotus Domino is a messaging and collaboration solution for multiple platforms. Problem A buffer overflow in the nrouter.exe service allows remote attackers to execute arbitrary commands by sending an iCalendar message...

CVE-2010-2728

CVE-2010-2728 is a heap-based buffer overflow in Microsoft Outlook 2002 SP3, 2003 SP3, and 2007 SP2 that occurs when Online Mode for an Exchange Server is enabled. A crafted e-mail message can lead to remote code execution. Public sources (MS10-064) confirm the vulnerability and provide the secur...

Malicious Email Campaign Circulating

US-CERT is aware of public reports of malware spreading via email. These reports indicate that the malicious email messages contain the subject line "Here you have" or "Just For You" and contain a link to a seemingly legitimate PDF file. If users click on this link, they will be redirected to a...

Secure your e-mail

This advice can be extended to general online activity, not just social networks, and most importantly, not just Twitter. You should care at least as much for the security of your e-mail account, especially if it was used to register your Twitter or Facebook accounts. Basically, a compromised ema...

How to Avoid Getting Your Twitter Account Hacked

“All upcoming Guns N’ Roses dates are officially canceled. Please contact your place of purchase for any refunds.” No Guns N’ Roses fan ever wants to see this text. And especially when it’s published on Axl Rose’s official Twitter account, it’s a guaranteed recipe for disaster. This is not the...

Saeculum 2009 Multiple SQL Injection Vulnerability

Exploit for php platform in category web applications ================================================== Saeculum 2009 Multiple SQL Injection Vulnerability ================================================== + Author: TeaM MosTa + Software Link:http://www.saeculum.tv/ + Tested on Win Xp Sp2/Sp3...

Yahoo! Mail Cross Site Scripting

Title: Yahoo mail Dom Based Cross Site Scripting Author: Pratul Agrawal Date: 13/06/2010 Indian Hacker Service: Webmail Vendor: Yahoo mail, and possibly others Vulnerability: Cross Site Scripting / Cookie-Theft / Relogin attacks Severity: High Tested on: Microsoft IE 7.0 Details: Yahoo mail filte...

Office 2010 Beta Email Is Windows Trojan

An e-mail with the subject “See Office 2010 Beta in action” uses an alleged Office 2010 Beta version used as bait. Read the full article. Help Net Security...

CVE-2010-1568

CVE-2010-1568 affects the Cisco IronPort Desktop Flag Plug-in for Outlook prior to version 6.5.0-006. The issue lies in the Send Secure functionality, which may mishandle simultaneously composed messages, potentially allowing an attacker to obtain cleartext contents of e-mail messages that were i...

CVE-2010-0525

CVE-2010-0525 affects Apple Mac OS X prior to 10.6.3. Mail may select an encryption key from a keychain with multiple recipient certificates without proper key-usage validation, enabling possible information disclosure via brute-force on a weakly encrypted e‑mail. Root cause: inadequate enforceme...

CVE-2010-1132

CVE-2010-1132 affects spamass-milter (SpamAssassin Milter Plugin) 0.3.1, where using the -x (expand) option allows remote attackers to craft RCPT TO data that executes arbitrary shell commands on the server. The root cause is unsanitized input during alias expansion via the milter, enabling comma...