ManageEngine Support Center Plus 7916 - Directory Traversal

----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower ------------------------- Affected vendors: ------------------------- ManageEngine http://www.manageengine.com/ -------------------------...

ManageEngine Support Center Plus 7916 - Directory Traversal

ManageEngine Support Center Plus 7916 - Directory Traversal ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower ------------------------- Affected vendors: -------------------------...

ManageEngine Support Center Plus 7916 - Directory Traversal

ManageEngine Support Center Plus versions 7916 and below suffer from a directory traversal vulnerability. ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower -------------------------...

otrs -- multiple vulnerabilities

The OTRS Project reports: SQL injection issue An attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks...

Starbucks Patches Vulnerable iOS App

Starbucks has patched a vulnerability in its iOS app that was found last week spilling user data, including usernames and passwords, by adding what it’s called an “additional safeguard measure” to protect its customers. While it’s a relatively quick turnaround for the company – it only took about...

Starbucks Mobile App Vulnerability Puts Data At Risk

A vulnerability in Starbucks’ mobile app could be putting coffee drinkers’ information–including their usernames, email addresses and passwords–at risk. The problem stems from the way session.clslog, the Crashlytics log file, handles those credentials in the event of a crash. Within the file ther...

Threat Outbreak Alert: Fake Shipping Order Notification Email Messages on January 14, 2014.

Medium Alert ID: 32431 First Published: 2014 January 15 13:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain shipping order details for the recipient. The text in the email message attempts to convince the recipient to...

US retailer Neiman Marcus confirmed data breach after TARGET

The TARGET Hack was not the only massive Data breach that happened during the last Black Friday, but also other three major US Retailers were also hacked. Recently, Neiman Marcus also confirmed a data breach that involves Credit card theft from its customers during the holiday shopping season,...

CREDO Mobile Publishes Industry's First Transparency Report

Credo Mobile, the small San Francisco mobile provider that is reportedly the unnamed plaintiff in a suit that challenged the legality of national security letters, yesterday published its first transparency report, the first such report published by a mobile provider. Credo, which has raised tens...

vTiger CRM AddEmailAttachment arbitrary file upload

Added: 01/10/2014 CVE: CVE-2013-3214 BID: 61558 OSVDB: 95902 Background vTiger CRM is a customer relationship management application written in PHP. Problem An arbitrary file upload vulnerability when handling SOAP AddEmailAttachment requests allows remote attackers to execute arbitrary commands ...

XSS in the view parameter of several actions

The following XSS issues were detected by a customer. /changelog?max=30&view=cru%22;alert4015891;//%22&@asv=cru /project/CR?max=30&projectKey=CR&view=all";alert3166631;//"&@asv=all /user/c30626?max=30&name=c30626&view=all";alert1287220;//"&@asv=all...

Tajikistan Domain Registrar hacked; Google, Yahoo, Twitter, Amazon also defaced

Google’s primary search domain for Tajikistan had seemingly been hacked yesterday, along with other high profile domains including Yahoo, Twitter, Amazon -- redirected to a defaced page. Actually neither Google, nor Twitter servers have been hacked, rather website of Tajikistan's Domain registrar...

DNS Registrar Fixes Hijack Vulnerability

UPDATE: The domain registrar and Web-hosting company Namecheap has fixed a cross-site request forgery vulnerability in its DNS setup page. According to security researcher Henry Hoggard, the bug could have given an attacker the ability to hijack domain name system servers and redirect incoming...

Threat Outbreak Alert: Fake Service Complaint Email Messages on December 22, 2013

Medium Alert ID: 32267 First Published: 2013 December 23 15:13 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a customer complaint notification for the recipient. The text in the email message attempts to convince the...

Important: Red Hat Security Advisory: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update

Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P1 Patch 1 on Rollup Patch 1, which contains several bug fixes and addresses several security issues, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common...

vBulletin remote admin injection exploit

!/usr/bin/perl Title: vBulletin remote admin injection exploit Author: Simo Ben youssef Contact: SimoatMorxploitcom Coded: 17 September 2013 Published: 24 October 2013 MorXploit Research http://www.MorXploit.com Vendor: vBulletin www.vbulletin.com Version: 4.1.x / 5.x.x Vulnerability: Remote admi...

ZippyYum 3.4 Insecure Data Storage

Title: CVE-2013-6986 Insecure Data Storage in Subway Ordering for California ZippyYum 3.4 iOS mobile application Published: DATE Reported to Vendor: May 2013 CVE Reference: CVE-2013-6986 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6986 CVSS v2 Base Score: 4.9 CVSS v2 Vector...

Microsoft Expands Encryption Use in Cloud Services to Thwart Surveillance

In response to the growing set of revelations about the NSA’s surveillance methods and alleged compromise of some large technology vendors’ services, Microsoft is taking a number of steps to try and reassure customers about the integrity of the company’s offerings and to greatly expand the use of...

Low: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.0 update

An update for Red Hat JBoss Enterprise Application Platform 6.2.0, which fixes two security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having low security impact. Common...

November 2013 Adobe Flash, ColdFusion security patches

Adobe patched two vulnerabilities in its ColdFusion web application server today, and also released a Flash Player update that patched a remote code execution bug in the software. A company spokesperson said none of the vulnerabilities are being exploited, nor are they related to the recent theft...