Nebraska's Worker Comp Database Hacked

A hacker has broken into the Nebraska Worker’s Compensation database, prompting an FBI investigation and an effort to contact those who may be affected. Several thousand people could be affected by the breach, which was discovered last week when the state’s chief information officer noticed an...

Federal Wiretaps Busted by Researchers

Researchers at the University of Pennsylvania say they’ve discovered a way to circumvent the networking technology used by law enforcement to tap phone lines in the U.S.The flaws they’ve found “represent a serious threat to the accuracy and completeness of wiretap records used for both criminal...

U.S. Takes Down $9 Million RBS WorldPay Hacking Ring

U.S. and international prosecutors have taken down a criminal ring that they allege was responsible for an ATM scam last year that stole about $9 million from RBS WorldPay. The criminals were able to evade the company’s encryption system used on payroll debit cards and withdraw money from ATMs in...

Congress Calls for Internal Security Review

After a former Congressional staffer exposed some sensitive data on a file-sharing network recently, some lawmakers are calling for the Congress to start an internal review of its own data security policies immediately. The situation, which is linked to an ethics investigation in the House of...

Operation Phish Phry Nets 100 Cyber Criminals

The largest number of defendants ever charged in a cyber-crime case have been indicted in a multinational investigation conducted in the United States and Egypt that uncovered a sophisticated “phishing” operation that fraudulently collected personal information from thousands of victims that was...

Re: [Full-disclosure] Oops! About xscreensaver 5.01

Hmmm, sorry for flooding the list but it seems it doesnt even affect xscreensaver 5.01. I will investigate when the vuln when I have time and keep you informed. There has to be some strange conf on my Opensolaris : Best Regards, kcope 2009/7/6 Kingcope [email protected]: Hello list, Just to...

Sourcefire 3D Sensor & Defense Center 4.8.x Privilege Escalation Vuln

No description provided by source. Affected product ---------------- Sourcefire 3D Sensor and Defense Center 4.8.x Tested on 4.8.0.3 and 4.8.0.4, 3D Sensor 2500 & DC 1000 All 4.8.x releases, up to and including 4.8.1, confirmed vulnerable by sourcefire. Vulnerability details ---------------------...

Mozilla Firefox 3.0.10 (KEYGEN) Remote Denial of Service Exploit

Exploit for multiple platform in category dos / poc ================================================================ Mozilla Firefox 3.0.10 KEYGEN Remote Denial of Service Exploit ================================================================ ===8=================== Original Nachrichtentext...

Unfixed XSS vulnerability at www.havkom.se

Security researcher DellNull, has submitted on 15/05/2009 a cross-site-scripting XSS vulnerability affecting www.havkom.se, which at the time of submission ranked 7162581 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/06/2009. It is current...

Criminals pay top money for hackable Nokia phone

From IDG News Jeremy Kirk Criminals are willing to pay thousands of euros for a discontinued Nokia mobile phone with a software problem that can be exploited to hack into online bank accounts cio.com, according to a fraud investigator in the Netherlands. About 10 days ago, investigators observed...

Five ways to survive a data breach investigation

From CSO Bill Brenner When the digital forensics crew comes in to investigate a possible data breach, company executives often make matters worse by not being prepared. To help companies deal with this issue, CSOonline talks to the experts csoonline.com and offers these five steps that can be tak...

DFLabs PTK 1.0 - Local Command Execution

==================================================== Security Research Advisory Vulnerability name: DFLabs PTK Local Command Execution Vulnerability Advisory number: LC-2008-07 Advisory URL: http://www.ikkisoft.com ==================================================== 1 Affected Software DFLabs PT...

DFLabs PTK 1.0 - Local Command Execution

DFLabs PTK 1.0 - Local Command Execution ==================================================== Security Research Advisory Vulnerability name: DFLabs PTK Local Command Execution Vulnerability Advisory number: LC-2008-07 Advisory URL: http://www.ikkisoft.com...

Logging event information is not HTML encoded in 500 error page

The Confluence 500 error page lists logging events generated during the request the produced the 500 error page. The strings rendered from this event are not HTML encoded, leaving open a chance for an attacker to exploit this via XSS. I haven't yet investigated to see whether this is actually...

Logging event information is not HTML encoded in 500 error page

The Confluence 500 error page lists logging events generated during the request the produced the 500 error page. The strings rendered from this event are not HTML encoded, leaving open a chance for an attacker to exploit this via XSS. I haven't yet investigated to see whether this is actually...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its requester. Further investigation showed that it was not a new security issue. Notes: none...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its requester. Further investigation showed that it was not a new security issue. Notes: none...

Nortel UNIStim IP Softphone Buffer-Overflow

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: IP Softphone Vendor: Nortel Subject: UNIStim IP Softphone Buffer-Overflow Risk: High Effect: Currently not exploitable Author: Cyrill Brunschwiler cyrill.brunschwiler at csnc dot ch Date: October, 18th 2007 Introduction: ------------- Floodin...

Deleting a custom field which has an issue security scheme or permission scheme on it does not update the index and issue navigator is out of date

emphasized textSimilar to JRA-12410 - deleting a custom field does not adequately clean up after itself. Specifically, affected issues are not reindexed so the updated security and permission aspects are not reflected in search results which is a security hole. Note that a naive fix may produce...

googleHack Lite-vulnerability warning-the black bar safety net

Look at the basic situation: infxx.com return some basic information site:xx.com returns all the information about the url link:xx.com returns all the station made the connection of the station site:xx.com filetype:txt find TXT file the other in turn within the push Find the background site:xx.co...