1944 matches found
JVN#52552792: EC-CUBE vulnerable to cross-site scripting
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in handling the output of parameters, which may result in cross-site scripting. Impact When a user accesses a specially crafted URL while there is an item in the shopping cart, a...
JVN#00985872: EC-CUBE vulnerable to session fixation
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability. Impact A remote unauthenticated attacker may impersonate a user. As a result, information may be disclosed or altered. Solution Apply the update or patch Apply...
USAID a Target of DoL Watering Hole Attackers
One of the nine sites serving malware tied to the recent watering hole attack on the U.S. Department of Labor was located in Cambodia and has ties to the United States Agency for International Development USAID. Speculation has it that the DoL attack was targeting downstream employees at the...
Syslog Watcher Pro 2.8.0.812 - Date Cross-Site Scripting
Syslog Watcher Pro 2.8.0.812 - Date Cross-Site Scripting Title: Syslog Watcher Pro 'Date' Parameter Cross Site Scripting Vulnerability Software : Syslog Watcher Pro Software Version : v2.8.0.812Jun 15, 2009 Vendor: http://www.snmpsoft.com/ Vulnerability Published : 2013-04-27 Vulnerability Update...
Syslog Watcher Pro 2.8.0.812 - 'Date' Cross-Site Scripting
Title: Syslog Watcher Pro 'Date' Parameter Cross Site Scripting Vulnerability Software : Syslog Watcher Pro Software Version : v2.8.0.812Jun 15, 2009 Vendor: http://www.snmpsoft.com/ Vulnerability Published : 2013-04-27 Vulnerability Update Time : Status : Impact : MediumCVSS2 Base : 6.4,...
Syslog Watcher Pro 2.8.0.812 Cross Site Scripting
Title: Syslog Watcher Pro 'Date' Parameter Cross Site Scripting Vulnerability Software : Syslog Watcher Pro Software Version : v2.8.0.812Jun 15, 2009 Vendor: http://www.snmpsoft.com/ Vulnerability Published : 2013-04-27 Vulnerability Update Time : Status : Impact : MediumCVSS2 Base : 6.4,...
JVN#01167429: OpenWnn for Android vulnerable to information disclosure
OpenWnn provided by OMRON SOFTWARE Co., Ltd. is a Japanese Input Method Editor IME. OpenWnn for Android contains an issue in the access permissions for certain files. Impact If a user of the affected product uses other malicious Android application, information managed by the affected product may...
Reuters Editor Indicted for Helping Hackers Break Into Tribune Co.
A Reuters social media editor on Thursday was charged with helping hackers break into the Tribune Co.’s network shortly after he was fired from a Sacramento television station in Fall 2010. A U.S. Eastern District grand jury in Sacramento handed down a three-count indictment against Matthew Keys,...
Reuters Editor Indicted for Allegedly Helping Hackers Break Into Tribune Co.
UPDATE — One of Matthew Keys’ lawyers told The Huffington Post on Friday that his client was working as an “undercover” journalist when he engaged members of Anonymous in an IRC channel offering login credentials for Tribune Co. servers. Keys, 26, of Secaucas, N.J., was suspended with pay from...
Atmel crypto co-processors information leakage
Keys may be leaked via JTAG interface...
Atmel "secure" crypto co-processor series microprocessors (AT91SAM7XC) leaking keys, plus bonus DESFire hack
The Atmel AT91SAM7XC series of microprocessors contain a crypto co-processor which is DES and AES capable. They include a write-only memory for key storage and multiple physical security measures to prevent decapping etc. However, due to poor memory management, in certain circumstances it is...
RIP Aaron Swartz, A legendary Internet Activist
Aaron Swartz has committed suicide on January 11, 2013 in New York City. I have long been fought if you write something about this extraordinary boy, but not dedicate a tribute would be a shame. Aaron Swartz has decided to leave a huge void in the IT scenario. For me, as the entire world he is a...
TomatoCart 1.x | Unrestricted File Creation
OVERVIEW TomatoCart 1.x versions are vulnerable to Unrestricted File Creation. 2. BACKGROUND TomatoCart is an innovative Open Source shopping cart solution developed by Wuxi Elootec Technology Co., Ltd. It is forked from osCommerce 3 as a separate project and is released under the GNU General...
TomatoCart 1.x | Cross Site Request Forgery Protection Bypass via JavaScript Hijacking
OVERVIEW TomatoCart 1.x versions are vulnerable to Cross Site Request Forgery Protection Bypass. 2. BACKGROUND TomatoCart is an innovative Open Source shopping cart solution developed by Wuxi Elootec Technology Co., Ltd. It is forked from osCommerce 3 as a separate project and is released under...
TomatoCart 1.x Unrestricted File Creation
TomatoCart 1.x versions are susceptible to an unrestricted file creation vulnerability. 1. OVERVIEW TomatoCart 1.x versions are vulnerable to Unrestricted File Creation. 2. BACKGROUND TomatoCart is an innovative Open Source shopping cart solution developed by Wuxi Elootec Technology Co., Ltd. It ...
TomatoCart 1.x Unrestricted File Creation
OVERVIEW TomatoCart 1.x versions are vulnerable to Unrestricted File Creation. 2. BACKGROUND TomatoCart is an innovative Open Source shopping cart solution developed by Wuxi Elootec Technology Co., Ltd. It is forked from osCommerce 3 as a separate project and is released under the GNU General...
CVE-2012-5530
The 1 pcmd and 2 pmlogger init scripts in Performance Co-Pilot PCP before 3.6.10 allow local users to overwrite arbitrary files via a symlink attack on a /var/tmp/ temporary file...
DEBIAN-CVE-2012-5530
The 1 pcmd and 2 pmlogger init scripts in Performance Co-Pilot PCP before 3.6.10 allow local users to overwrite arbitrary files via a symlink attack on a /var/tmp/ temporary file...
