Top 5 Social Networking Business Threats

Social networking sites are ideal havens for online criminal activities as they provide a combination of two key factors: a huge number of users and a high-level of trust among these users, cautioned a security specialist. ZDNet Asia spoke to industry experts who highlight the top five security...

The Uploader 2.0 - Arbitrary File Upload

The Uploader 2.0 - Arbitrary File Upload ======================================================================================================= Script Name : The Uploader 2.0 Language : php Author : Master Mind Home : www.vbspiders.com ============================================== Exploit :...

GAO Names Areas of Threat to U.S.

It’s not a very good day when a security report concludes: Disruptive cyber activities expected to become the norm in future political and military conflicts. But such was the case as the Government Accountability Office took yet another critical look at the US federal security systems and found...

Cross site scripting

Cross-site scripting XSS vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the action parameter to phprint.php. NOTE: the querystring vector is already covered by CVE-2008-3101.3...

Design/Logic Flaw

SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for 1 ecrire/exec/install.php and 2 ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009...

CVE-2009-3041

SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for 1 ecrire/exec/install.php and 2 ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009...

CVE-2009-3041

CVE-2009-3041 affects SPIP 1.9 prior to 1.9.2i and 2.0.x up to 2.0.8. The vulnerability is caused by improper access control in the files ecrire/exec/install.php and ecrire/index.php , allowing remote attackers to perform unauthorized actions related to installation and backups. The issue was exp...

CVE-2009-3041

SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for 1 ecrire/exec/install.php and 2 ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009...

CVE-2008-6993

Siemens Gigaset WLAN Camera 1.27 has an insecure default password, which allows remote attackers to conduct unauthorized activities. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Default credentials

Siemens Gigaset WLAN Camera 1.27 has an insecure default password, which allows remote attackers to conduct unauthorized activities. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-6993

Siemens Gigaset WLAN Camera 1.27 has an insecure default password, which allows remote attackers to conduct unauthorized activities. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-6993

CVE-2008-6993 affects Siemens Gigaset WLAN Camera 1.27 and is based on an insecure default password that enables remote unauthorized activity. The connected Red Hat advisory and NVD entry corroborate the same description. Affected component is the device firmware on version 1.27; root cause is de...

What's the Value of a Stolen Credit Card?

By Dmitry Bestuzhev The credit crunch means we’re all increasingly aware of bank charges, interest rates, and how we can save a few extra pennies. Financial advisors have written pages on how transferring an existing credit card balance to another card issuer could save you money, and most people...

Open redirect

Live Chat comlivechat component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string...

Design/Logic Flaw

Unspecified vulnerability in fseventsd in the FSEvents framework in Apple Mac OS X 10.5.6 allows local users to obtain sensitive information filesystem activities and directory names via unknown vectors related to "credential management."...

Cross site request forgery (csrf)

Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under modperl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery CSRF protectio...

CVE-2009-0482

Cross-site request forgery CSRF vulnerability in Bugzilla before 3.2 before 3.2.1, 3.3 before 3.3.2, and other versions before 3.2 allows remote attackers to perform bug updating activities as other users via a link or IMG tag to processbug.cgi...

siu guarani - Multiple Vulnerabilities

multiple remote vulnerabilities siu guarani general information ------------------- bug type : multiple remote vulnerabilities software name : SIU Guarani vendor : SIU www.siu.edu.ar authors : proudhon & Ubik date : the 341st day of the year 2008 contact : N/A description : SIU-Guarani is a web...

CVE-2008-4805

Multiple cross-site scripting XSS vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via 1 the community title, 2 API input, and vectors related to the 3 Homepage, 4 Blogs, 5 Profiles, 6 Dogear, 7 Activities, and 8 Global Search...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via 1 the community title, 2 API input, and vectors related to the 3 Homepage, 4 Blogs, 5 Profiles, 6 Dogear, 7 Activities, and 8 Global Search...