MGASA-2015-0344 Updated webmin packages fix CVE-2015-1990

Updated webmin package fixes security vulnerability: A malicious website could create links or Javascript referencing the xmlrpc.cgi script, triggered when a user logged into Webmin visits the attacking site CVE-2015-1990...

China Police Arrest 15,000 Suspects for Alleged Cyber Crimes

China Police has arrested nearly 15,000 people on suspicion of cyber crimes as part of an operation dubbed "Cleaning the Internet," according to reports. According to the Chinese Ministry of Public Security MPS, the suspects have been arrested for their involvement in cyber crimes that "jeopardiz...

[SECURITY] Fedora 21 Update: drupal7-7.39-1.fc21

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 22 Update: mediawiki-1.25.2-2.fc22

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

[SECURITY] Fedora 23 Update: mediawiki-1.25.2-2.fc23

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

Apple OS X History Search Vulnerability

Apple OS X is a BSD-based operating system distributed by Apple. Apple OS X Quicklook has a security vulnerability that allows local users to search for previously viewed visited WEB sites, launch a WEB browser, and render WEB sites...

The vulnerability of the Moodle learning management system allows attackers to carry out phishing attacks.

The vulnerability of the Moodle learning management system is due to problems with open redirection. Exploiting this vulnerability allows a malicious actor to conduct phishing attacks by redirecting users to arbitrary websites remotely...

Rig Exploit Kit 3.0 Claims 1 Million Malvertising Victims

LAS VEGAS – A rampant malvertising campaign fueled by a new version of the Rig Exploit Kit has claimed at least 950,000 victims worldwide and is doing so with an unprecedented success rate. Researchers at Trustwave said in advance of this week’s Black Hat conference that they have been watching...

Atlassian JIRA 4.3.x < 5.1.1 Multiple Open Redirect Vulnerabilities

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is 4.3.x prior to 5.1.1. It is, therefore, potentially affected by multiple open redirect vulnerabilities. A remote attacker, using a crafted URL, can exploit these vulnerabilities to...

JVN#97971874: Welcart vulnerable to cross-site scripting

Welcart provided by Collne Inc. is a WordPress plugin for creating shopping websites. Welcart contains a cross-site scripting CWE-79 vulnerability due to the processing of uscesreferer parameter in admin.php. Impact If a user views a malicious page while logged into WordPress with this plugin...

CVE-2015-4529

Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to redirect users to arbitrary w...

Ad Fraud Malware Updating Flash on Infected PCs

Ad fraud malware is one of the more profitable specialties in the cybercrime world, and the attackers who use it often have to adapt their tactics in order to keep the money rolling in. One of the tactics that they have adopted in recent months is that of updating the version of Flash that’s...

Pornhub: Publicly exposed SVN repository, ht.pornhub.com

After I found the subversion repository I visited the following location https://netreact.eu/hubtraffic I could see the usernames in the repo and the following weak credentials gave me access: stefan:123456 An attacker can commit code to this location which could be mirrored on the main site and...

FC2 / Rakuten Cross Site Scripting

FC2 & Rakuten Online Websites Multiple XSS Cross-site Scripting and Open Redirect Cyber Vulnerabilities FC2 and Rakuten are the first and second top ranking Japanese local online websites. This post introduces several XSS Cross-site Scripting and Open Redirect bugs of them. The Alexa rank of...

CVE-2015-1732

Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1742, CVE-2015-1747, CVE-2015-1750, and...

Federal Agencies to Move to HTTPS-Only Connections

Following the lead of many major Web services, the White House on Monday announced that it would move all of the federal government’s public sites and services to HTTPS-only. Tony Scott, the federal CIO, has issued a memorandum to all federal agencies and departments instructing them to move all ...

Synology Photo Station 6.2-2858 Cross Site Scripting

------------------------------------------------------------------------ Synology Photo Station multiple Cross-Site Scripting vulnerabilities ------------------------------------------------------------------------ Han Sahin, May 2015...

Win Free Air Miles for Finding Security Flaws in United Airlines

If you are a security researcher and fond of traveling from one conference to another, then United Airlines' bug bounty program would be of great interest for you. United Airlines has launched a new bug bounty program inviting security researchers and bug hunters to report vulnerabilities in its...

Reflected Cross-Site Scripting vulnerability in asdoc generated documentation

------------------------------------------------------------------------ Reflected Cross-Site Scripting vulnerability in asdoc generated documentation ------------------------------------------------------------------------ Radjnies Bhansingh, March 2014...

USN-2582-1 oxide-qt vulnerabilities

A use-after-free was discovered in the DOM implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render...