Hackers Insert Rogue Content on Al Jazeera Arabic Website !

Al-Jazeera said that hackers have managed to bring the rogue content to some of its Arabic website for ads aimed at discrediting the objectivity of its coverage of Egyptian protests. "Hackers have managed to bring the portion of the advertising instead ajjazeera.net distort the network news...

Saudi ministry restores hacked website !

Saudi Arabia's Ministry of Education has restored its website, weeks after it was taken offline in the latest of a series of hacking attempts on some of the kingdom's most prominent sites. "The website was hacked a few weeks back, but has now been fully restored, and is safe and functional,"...

BlackSheep Plugin Bites Back: Detecting FireSheep Hijack Attempts

With more than 600,000 copies of the FireSheep browser plug-in downloaded in a matter of weeks, Web security firm zScaler have released a new Firefox plug-in, BlackSheep, in hopes of combating attempts by those using FireSheep to try to hijack their Web session. The plug-in doesn’t protect users...

PYSEC-2010-24

The ftpSTOU function in FTPServer.py in pyftpdlib before 0.2.0 does not limit the number of attempts to discover a unique filename, which might allow remote authenticated users to cause a denial of service via a STOU command...

CVE-2007-6737

FTPServer.py in pyftpdlib before 0.2.0 does not increment the attemptedlogins count for a USER command that specifies an invalid username, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2010-2968

The FTP daemon in Wind River VxWorks does not close the TCP connection after a number of failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2010-2231

Cross-site request forgery CSRF vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter...

CVE-2010-2231

Cross-site request forgery CSRF vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter...

CVE-2010-2231

Moodle vulnerability CVE-2010-2231 is a CSRF in the quiz module (report/overview/report.php). Affects Moodle versions before 1.8.13 and 1.9.x before 1.9.9. The flaw allows remote attackers to hijack the authentication of arbitrary users to issue requests that delete quiz attempts via the attempti...

moodle -- multiple vulnerabilities

The Moodle release notes report multiple vulnerabilities which could allow cross site scripting, XSS attacks, unauthorised deletion of attempts in some instances...

Require user to answer CAPTCHA after three failed attempts

Require user to answer CAPTCHA after three failed attempts. For SOAP and XMLRPC this means that the user will have to open a browser to answer the CAPTCHA, similar to how google does it. This issue has been rated MODERATE. Please refer to http://confluence.atlassian.com/x/ZILmD for details on oth...

brute force password attack protection by default

We have added an upgrade task to set jira.maximum.authentication.attempts.allowed=5 on all instances even if they previous had set it to something else. This is to ensure that systems are more safe by default...

Microsoft Windows SMB Memory Corruption Remote Denial of Service Vulnerability

Description Microsoft Windows is prone to a remote denial-of-service vulnerability that affects the Microsoft Server Message Block SMB protocol software. An attacker can exploit this issue to crash the application, denying service to legitimate users. This vulnerability affects SMB1 and SMB2...

Microsoft SMB NTLM Authentication Lack of Entropy (MS10-012; CVE-2010-0231)

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. An elevation of privilege vulnerability has been reported in the way that Microsoft Server Message Block SMB Protocol software handles authentication attempts. The vulnerability is due to a lack of...

Healthcare Hacks on the Rise

The last quarter of 2009 saw an average of 13,400 attempts to hack healthcare organizations, compared to an average of 6,500 in the first nine months, say researchers. Read the full article. Infosecurity...

Adobe Reader and Acrobat 'newplayer()' JavaScript Method Remote Code Execution Vulnerability

Description Adobe Reader and Acrobat are prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code. Failed exploit attempts will likely cause denial-of-service conditions. This issue affects Reader and Acrobat 9.2 and prior versions. Technologies...

Avast! AntiVirus 4.8.1356 - 'aswRdr.sys' Driver Privilege Escalation

// source: https://www.securityfocus.com/bid/37031/info Avast! Antivirus is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to execute arbitrary code with superuser privileges and completely compromise the affected computer. Failed exploit attempts will...

Microsoft Internet Explorer 'deflate' HTTP Content Encoding Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the computer. Failed attacks m...

Add a password lockout feature

Confluence does not prevent someone from making a script that tries every possible password combination for a Confluence account. There should be an option to set a max attempts and then lock out the user from the system. This is obviously a security problem as Confluence within most companies us...

CVE-2009-2335

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior...