Fourth, a 16-year-old Hacker, Arrested over TalkTalk Hack

Police have arrested a fourth person, a 16-year-old boy, from London in connection with the high-profile hack of British telecoms giant TalkTalk. The investigating officers from the Metropolitan Police Cyber Crime Unit MPCCU arrested the teenager at his home in Norwich on suspicion of Computer...

mannen.se XSS vulnerability

Vulnerable URL: https://www.mannen.se/customer.html/"';-- Details: Description| Value ---|--- Patched:| Yes, at 22.11.2015 Latest check for patch:| 22.11.2015 18:17 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 2 VIP...

TalkTalk Hack: Police Arrest Second Teenager in London

British Police have arrested a second teenage boy in relation to the major hack on the servers of UK-based telco 'TalkTalk' last week. On Monday, a 15-year-old boy first arrest from County Antrim, Northern Ireland, was arrested in connection with the TalkTalk Data Breach. On Thursday, The...

TalkTalk Hacked; 4 Million Credit Card Profiles may have been Stolen

TalkTalk, one of the biggest UK-based phone and Internet service provider with more than 4 Million customers, has been hacked again, the company announced late Thursday. TalkTalk is informing its 4 million customers that it has fallen victim to a "significant and sustained cyber attack" and it is...

FreeBSD : magento -- multiple vulnerabilities (ea1d2530-72ce-11e5-a2a1-002590263bf5)

Magento, Inc. reports : SUPEE-6482 - This patch addresses two issues related to APIs and two cross-site scripting risks. SUPEE-6285 - This patch provides protection against several types of security-related issues, including information leaks, request forgeries, and cross-site scripting. SUPEE-59...

Dow Jones & Company Latest Financial Firm to Report Breach

The financial information firm Dow Jones & Company announced late last week that it’s the latest in an exhaustive list of companies this year to report a data breach. The News Corp.-owned company informed customers Friday that hackers managed to infiltrate their system in an apparent attempt to...

phpyun 任意用户密码修改两处 (秒破/demo测试)

简要描述： 好久没看过php了。。。。 如题咯。 详细说明： 来看到找回密码的地方。 app/controller/forgetpwd/index.class.php function sendaction $username=yuniconv"utf-8","gbk",$POST'username'; if!$this-CheckRegUser$username&&!$this-CheckRegEmail$username $res'msg'=yuniconv"gbk","utf-8","用户名不符合规范！"; $res'type'='8'; echo...

ESA-2015-142: RSA Archer® GRC Platform Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-142: RSA Archer® GRC Platform Multiple Vulnerabilities EMC Identifier: ESA-2015-142 CVE Identifier: CVE-2015-4541, CVE-2015-4542, CVE-2015-4543 Severity Rating: CVSS v2 Base Score: View details below for individual CVSS v2 scores Affected...

Hackers Backdooring Cisco WebVPN To Steal Customers’ Passwords

Virtual Private Networks VPNs, which is widely used by many businesses and organisations to provide secure access to their workers, are being abused to pilfer corporate user credentials. Researchers from security firm Volexity discovered a new attack campaign that targets a widely used VPN produc...

Shopify: unauthorized access to all customers first and last name

This issue allowed any merchant to search for users by their ID. The search would retrieve the first name and last name of any registered customer that belonged to any shop in Shopify...

Experian Breach Spills Personal Info of 15 Million T-Mobile Customers

A massive data breach at the credit-reporting agency Experian could wind up having major implications for 15 million T-Mobile customers. The telecom uses the agency, one of the “big three” credit reporting bureaus, to check the credit ratings of its customers. News broke last night however that a...

Lenovo Caught (3rd Time) Pre-Installing Spyware on its Laptops

Lenovo has once again been caught installing spyware on its laptops and workstations without the user's permission or knowledge. One of the most popular computer manufacturers is being criticized for selling some refurbished laptop models pre-installed with invasive marketing software that sends...

Zendesk: CSV Excel Macro Injection Vulnerability in export customer tickets

Scenario: An attacker creates a name as =AND21 and creates a ticket. When a team member clicks export as csv and opens it instead of seeing =AND21 they see TRUE. This means that the cell is active. An attacker could basically attack makes a ticket, use -2+3+cmd|' /C calc'!E1 and could execute...

change fontset 'icons' to html entities to improve security compliance

It seems that the icons in Confluence are currently rendered using fontset. This can be an issue for organization especially banks that have strict security constraint fontset cannot be downloaded as a result this will not render on customer instance. I would recommend that we change the current...

change fontset 'icons' to html entities to improve security compliance

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-38988. panel It seems that the icons in Confluence are currently rendered using fontset. This can be an issue for organization...

Threat Outbreak Alert RuleID17564: Email Messages Distributing Malicious Software on August 25, 2015

Medium Alert ID: 40661 First Published: 2015 August 25 19:45 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17564 may contain the following files: Name |...

Uber to Quadruple Security Staff by 2016

Ride-sharing company Uber, which has already battled a database compromise and hackers selling stolen user accounts this year, announced over the weekend that it will bulk up its security division. Uber will quadruple the number of employees that currently oversee security at the San...

53KF设计缺陷可冒充客服随意发消息（以平安万里通为例）

简要描述： 53KF软件，可以随意冒充客服发送消息给访客。 详细说明： 首先，查看网络请求，发现访客给客服发消息的时候，请求的内容如下： 这时候，高潮来了，我们把sid和did倒一下，然后用curl发个请求过去，这个时候，居然，对话窗口，客服，活了，客服说话了！！！！太假了！！！ 别问我怎么发现的。 好不容易找下万里通客服。 发过去的消息都不回复。 本想用curl疯狂发消息。 然后不小心将sid和did调换了一下。 然后还需要然后吗？ 漏洞证明： 不用证明了吧。...

Moonpig Warns Customers of 'Security Issue'

Moonpig has warned customers that some of their email addresses, passwords, and account balances have been published after what it calls a “security issue”. The company, which sells custom greeting cards, said in a message to users that attackers were not able to get any credit card information, ...

CentOS 6 : python (CESA-2015:1330)

Updated python packages that fix multiple security issues, several bugs and add one enhancement are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...