USB Drives Remain Major Security Threat

The recent admission by a top Department of Defense official that a classified network was compromised in 2008 through an infected USB drive has brought the spotlight back onto the myriad threats that these portable devices pose to corporate networks. The security community has been wary of USB...

Mobile Website Flaws Cloak Click Fraud

It’s possible to craft a malicious website so that a user’s clicks are secretly redirected to a legitimate site in a way that steals a user’s passwords and other data. Many Web developers have added protections to block the tactic on standard websites, but Stanford University researchers warn tha...

XSS vulnerability in CMSimple

Vulnerability ID: HTB22559 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityincmsimple1.html Product: CMSimple Vendor: Peter Andreas Harteg http://www.cmsimple.org/ Vulnerable Version: 3.3 and Probably Prior Versions Vendor Notification: 02 August 2010 Vulnerability Type: XSS Cross Site...

XSS vulnerability in CMS Source

Vulnerability ID: HTB22548 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityincmssource.html Product: CMS Source Vendor: Proud Daddy Web Design http://www.prouddaddy.net/ Vulnerable Version: Current at 28.07.2010 and Probably Prior Versions Vendor Notification: 28 July 2010 Vulnerabilit...

XSS vulnerability in BXR

Vulnerability ID: HTB22507 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinbxr1.html Product: BXR Vendor: Hulihan Applications ;http://hulihanapplications.com/projects/bxr Vulnerable Version: 0.6.8 and Probably Prior Versions Vendor Notification: 22 July 2010 Vulnerability Type: XSS...

thunderbird security update

CentOS Errata and Security Advisory CESA-2010:0544 An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CV...

Hackers Increasingly Look For Configuration Errors

Hackers appear to be increasingly counting on configuration problems and programming errors rather than software vulnerabilities in order to steal information from computer systems, according to a new study based on U.S. Secret Service investigations. Read the full article. IDG News Service...

CGI Generic Open Redirection

By providing specially crafted parameters to CGIs, Nessus was able to redirect to a third-party website. As redirections are commonly used, it is possible that users will be unaware that something abnormal is happening. This kind of attack can be used to steal confidential data, typically...

Mozilla Foundation Security Advisory 2010-46

Mozilla Foundation Security Advisory 2010-46 Title: Cross-domain data theft using CSS Impact: Moderate Announced: July 20, 2010 Reporter: Chris Evans Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.7 Firefox 3.5.11 Thunderbird 3.1.1 Thunderbird 3.0.6 SeaMonkey 2.0.6 Description...

RedHat Update for seamonkey RHSA-2010:0546-01

Check for the Version of seamonkey OpenVAS Vulnerability Test RedHat Update for seamonkey RHSA-2010:0546-01 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

firefox, xulrunner security update

CentOS Errata and Security Advisory CESA-2010:0547 Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVS...

Firefox Hit by Drive-by Download Flaws

Mozilla has shipped a mega patch for Firefox to fix a total of 16 security flaws that expose Web surfers to drive-by download, data theft and local bar spoofing attacks. The latest Firefox 3.6.7 update includes fixes for nine “critical” issues that could be exploited to launch remote code executi...

Cross-domain data theft using CSS — Mozilla

Google security researcher Chris Evans reported that data can be read across domains by injecting bogus CSS selectors into a target site and then retrieving the data using JavaScript APIs. If an attacker can inject opening and closing portions of a CSS selector into points A and B of a target pag...

XSS vulnerability in Diem

Vulnerability ID: HTB22459 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityindiem1.html Product: Diem Vendor: Diem team Vulnerable Version: 5.1.2 and Probably Prior Versions Vendor Notification: 29 June 2010 Vulnerability Type: XSS Cross Site Scripting Status: Not Fixed, Vendor Alerted...

CANDID - '/image/view.php?image_id' SQL Injection

source: https://www.securityfocus.com/bid/41216/info CANDID is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based authentication...

OneCMS 2.6.1 - 'search' SQL Injection

source: https://www.securityfocus.com/bid/41194/info OneCMS is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how t...

ATM Skimming Technology Advances with SMS

Operating and planting an ATM skimmer can be a risky venture, because the crooks have to return to the scene of the crime to retrieve their skimmers along with the purloined data. Some criminals are now using ATM skimmers that eliminate much of that risk by relaying the information via text...

Top secret: three steps to teach you easily steal a VMware virtual machine and its data-vulnerability warning-the black bar safety net

Whether to remember a virtualized e-mail server or the payment system? If you have access to the virtualization environment administrator privileges, you can easily get into the virtualization environment, and steal all the data without leaving any traces. From the Data Center to steal a physical...

Data Thief: Call Center Employee Pleads Guilty

A Bank of America call center employee has pleaded guilty to charges that he stole sensitive client information and then tried to sell it for cash. Read the full article. IDG News Service...

Joomla! Component com_lead - SQL Injection

Joomla! Component comlead - SQL Injection TR Title: Joomla Component comlead SQL Injection TR Date: 03.06.2010 TR Author: ByEge TR Homepage: byege.blogspot.com TR Vendor: http://www.leadya.co.il/ TR ExploiT : TR index.php?option=comlead&task=display&archive=1&Itemid=65&leadstatus=1' TR column...