PayPal Revises Privacy Policy, User Agreement Policy

PayPal announced that it is changing both its privacy and user agreement policies, adding tweaks to its customer identification program and the way it collects and stores its customers’ personal information. The changes will take effect on April 1. Under the new policy, Paypal may collect...

Kayako SupportSuite Detection

The remote web server is running Kayako SupportSuite, a customer support application written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid57975; scriptversion"1.7"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...

Online Dating Sites Getting Around With Customers Data

Just in time for Valentine’s Day, the privacy watchdogs over at the Electronic Frontier Foundation have put together a guide for those tempted to dance the algorithm electric. Their findings: online dating services may be getting around with your personal data. Leading online dating sites hold on...

Low: Red Hat Security Advisory: jbosscache security update

An update for JBoss Enterprise Application Platform 5.1.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

RSS feed over entire site gives information on restricted pages the user should not see

A customer has reported this issue via a comment on the documentation: http://confluence.atlassian.com/display/DOC/Working+with+RSS+Feeds?focusedCommentId=276627497comment-276627497 quote When someone has an RSS feed covering the whole Confluence instance, he is informed about changes in restrict...

Electronic Arts - Cross Site Scripting Vulnerability

Document Title: =============== Electronic Arts - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=367 Release Date: ============= 2012-02-05 Vulnerability Laboratory ID VL-ID: ==================================== 367...

Important: Red Hat Security Advisory: JBoss Communications Platform 5.1.3 update

JBoss Communications Platform 5.1.3, which fixes multiple security issues and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which...

Hawaii Bill Would Require Internet Data Retention For Two Years

A Hawaiian legislator has introduced a broadly worded data-retention bill that require ISPs and other service providers to retain their customers’ Internet activity records for at least two years. The bill, introduced by state Rep. John Mizuno, does not have any provisions for exclusions or priva...

DreamHost Warns of Attack, Forces Customer Password Changes

Attackers were able to compromise a database at DreamHost, a large hosting provider, late last week and the company is forcing all of its customers to change their passwords for their FTP and shell accounts as a precautionary measure. DreamHost did not provide many details about what happened in...

Parallels H Sphere 3.3 P1 Cross Site Scripting

Title: ====== Parallels H Sphere v3.3 P1 - Multiple Persistent Vulnerabilities Date: ===== 2012-01-22 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=392 VL-ID: ===== 392 Introduction: ============= Parallels H-Sphere delivers a multi-server hosting automation solution...

Strato NumberFormatException - Validation Vulnerability

Document Title: =============== Strato NumberFormatException - Validation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=395 Release Date: ============= 2012-01-20 Vulnerability Laboratory ID VL-ID: ==================================== 395...

Zappos a division of Amazon got Hacked

Zappos a division of Amazon got Hacked A notification mail from Zappos is circulating in Customers that a division of Amazon "Zappos.com" got Hacked by Unknown Hackers. Notification mail indicated that names, email addresses, mailing addresses, and the last four digits of customer's social securi...

MegaSWF Cross Site Scripting

Title: ====== MegaSWF - Persistant Cross Site Scripting Vulnerability Date: ===== 2012-01-12 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=368 VL-ID: ===== 368 Introduction: ============= Do you create Flash games, Flash animations, or any other type of content saved ...

Specialforces.com Says Hack Of Customer Data Is Six Months Old

Just days after a successful attack on the security think tank Stratfor, Anonymous, the anarchic hacking collective, is getting headlines again for an attack on Specialforces.com, a Web site used by members of the armed forces law enforcement officers and gun enthusiasts. However, an employee...

Design/Logic Flaw

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving...

CVE-2011-4855: Undefined Security Weakness

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving...

PT-2011-5146

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.4.4 build20111103.18 Description The issue is related to the Control Panel in Parallels Plesk Panel, where the Content-Type header's charset parameter is omitted for certain resources. This could potentially...

Moderate: Red Hat Security Advisory: JBoss Enterprise Portal Platform 5.2.0 update

JBoss Enterprise Portal Platform 5.2.0, which fixes multiple security issues, various bugs, and adds enhancements is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVS...

GlobalSign Says No Evidence of CA Compromise Found

GlobalSign, the certificate authority that the attacker who compromised Comodo and DigitNotar claimed he had infiltrated as well, said it has completed its months-long security review and found no evidence that its CA infrastructure was compromised or that any rogue certificates had been issued...

Data Breaches for All

Sony’s online gaming platform, The PlayStation Network PSN, disappeared for more than a month starting in April, and no amount of double X and O-ing or right joysticking could save it. The reason? A massive attack on PSN’s network knocked the gaming giant offline and exposed the data of more than...