Cross Site Request Forgery - Deleting User's Dashboards

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that the application is succeptible to Cross-Site Request Forgery attacks within this URL:...

Blowback: Microsoft, OnStar Pump the Brakes on Location Tracking

Redmond, Washington software giant, Microsoft, and Detroit based GM subsidiary, OnStar backtracked on policies widely seen as egregious privacy violations following lawsuits and public outcry. Here’s the news: Windows Phone Update Requires User Consent For Tracking Microsoft released their “Mango...

FTC Aims to Overhaul Children's Privacy Rights

In hopes of revamping a law that was implemented over a decade ago, the Federal Trade Commission began to seek public comment this week on proposed revisions of rules that govern the privacy rights of children online. In effect since 2000, the Children’s Online Privacy Protection Act of 1998 COPP...

FBI Begins Purging Coreflood Infected PCs

The FBI has issued some 19,000 uninstall commands to the computers of 24 individuals infected by the Coreflood botnet, effectively purging their machines of that malware, and leaving behind no unintended consequences thus far according to a report from Brian Krebs. This move was made possible by...

Researcher Creates Database of 35 Million Identifiable Google Profiles

A Dutch researcher has discovered that he could convert most of the data within Google Profiles into a single SQL statement and expose, among other data, the usernames and Gmail addresses of some 35,000,000 people. The researcher, Matthijs R. Koot explained in a blogpost that there is an xml file...

Congress to Apple: You Got Some Splainin to do

In a letter to the chairman of the Federal Trade Commission, Jay Inslee D-Wash. expressed concerns regarding recent revelations that Apple products have been continuously tracking and recording user location information with questionable consent and without an easy way to opt out of such tracking...

Users File Suit Against Apple Over iPhone Tracking

A pair of Apple customers has filed a lawsuit against the company, alleging that Apple is invading their privacy by collecting location data about iPhone and iPad users without their knowledge. The suit follows the revelation last week by security researchers that Apple is collecting and storing...

Forget Epsilon, Fear the Angry Bird

No doubt you read about the huge email security breach Epsilon announced earlier this month. You may have received letters from companies that use Epsilon services about the possible loss of your email information. A lot of people are justifiably concerned that spear phishing and other nefarious...

Senators Propose Bill Of Rights To Protect Personal Information Online

Senators John Kerry D-Mass. and John McCain R-Ariz. don’t agree on much in the policy arena, except when it comes to protecting online privacy. The incongruous couple are political bedfellows on a piece of legislation introduced yesterday called The Commercial Privacy Bill of Rights Act of 2011...

FTC: Google Used Deceptive Practices In Buzz Social Network

Search giant Google has agreed to settle a case with the U.S. Federal Trade Commission on Wednesday over charges that it used deceptive tactics and violated its own privacy policy when it launched Google Buzz, a social network, in 2010. Google agreed to implement a comprehensive privacy program a...

Opinion: Google's DroidDream Patch Pushes The Envelope

Google announced plans yesterday to fortify the Android Market in response to the appearance of the DroidDream Trojan, but do the company’s plans cross the line from innovative to intrusive? In a blog post, Kaspersky Labs researcher Timothy Armstrong warns that the search giant’s plans to repair...

CVE-2010-3961

The Consent User Interface UI in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly handle an unspecified registry-key value, which allows local users with SeImpersonatePrivilege rights to gain privileges via a crafted application, aka...

Design/Logic Flaw

The Consent User Interface UI in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly handle an unspecified registry-key value, which allows local users with SeImpersonatePrivilege rights to gain privileges via a crafted application, aka...

CVE-2010-3961

The CVE-2010-3961 entry describes a local privilege-escalation in the Consent UI of Microsoft Windows (Vista SP1/SP2, Windows Server 2008 Gold SP2/R2, and Windows 7). The vulnerability stems from improper handling of an unspecified registry-key value by the Consent UI component, enabling a user w...

CVE-2010-3961

The Consent User Interface UI in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly handle an unspecified registry-key value, which allows local users with SeImpersonatePrivilege rights to gain privileges via a crafted application, aka...

Microsoft Windows multiple security vulnerabilities

OpenType Font parsing memory corruption, task scheduler privilege escalation, usafe DLL loading, multiple kernel vulnerabilities, Consent User Interface privilege escalation, Netlogon DoS...

MS10-100: Vulnerability in Consent User Interface Could Allow Elevation of Privilege (2442962)

The Consent User Interface UI component of the remote Windows host does not properly process a registry key that has been set to a specific value. An attacker who can log on locally to the affected system and has the 'Impersonate a client after authentication' user right SeImpersonatePrivilege ca...

Microsoft Windows Consent User Interface Registry Key Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in Consent User Interface. An attacker can exploit this issue to execute arbitrary code with 'LocalSystem' privileges. Successful exploits will result in the complete compromise of affected computers...

Hacker Poses as Graduate, Hacks Student Emails, Faces Legal Consequences

A hacker who posed as a university graduate to access the emails of hundreds of students has been given a suspended prison sentence and ordered to pay more than £20,000 in costs and compensation. Daniel Woo, a 23-year-old Bulgarian national, was sentenced for offenses under the Misuse of Computer...

Cisco IOS Software Authentication Proxy Vulnerability - Cisco Systems

Cisco IOS Software configured with Authentication Proxy for HTTPS, Web Authentication or the consent feature, contains a vulnerability that may allow an unauthenticated session to bypass the authentication proxy server or bypass the consent webpage. Cisco has released free software updates that...