Weird Science: Verizon Finds Stunning Drop in Data Theft

If there’s one thing that scientists and statisticians both hate, its weird data. And that’s what the folks at Verizon were dealing with when they tallied the results of their 2011 Data Breach Report which found a stunning 97% drop in the number of lost records, even as the number of reported...

French Hacker Arrested After Bragging on TV !

A French hacker who boasted on TV about hacking into the network of an important defense contractor was arrested and charged with unauthorized access to a computer system, data theft and organized fraud. The hacker appeared on the France 2 television programme "Complément d'enquête" Further...

phpcollab 2.5 - Multiple Vulnerabilities

phpcollab 2.5 - Multiple Vulnerabilities Vulnerability ID: HTB22916 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpcollab.html Product: phpCollab Vendor: phpCollab Team http://www.php-collab.org/ Vulnerable Version: 2.5 and probably prior versions Vendor Notification: 24 March 2011...

Hackers steal Dell 1000's customer information !

Hackers steal Dell 1000's customer information ! The personal information of thousands of Australians has been stolen by hackers who raided a US-based database company, in what some experts are calling the biggest data theft in US history. Dell Australia says customer data was "exposed" by an...

HTB22911: XSS in Eleanor CMS

Vulnerability ID: HTB22911 Reference: http://www.htbridge.ch/advisory/xssineleanorcms.html Product: Eleanor CMS Vendor: Eleanor CMS http://eleanor-cms.ru/ Vulnerable Version: rc5 Vendor Notification: 22 March 2011 Vulnerability Type: XSS Cross Site Scripting Status: Fixed by Vendor Risk level:...

Inside Story : How RSA was got hacked !

Inside Story : How RSA was got hacked ! The hack last month at RSA Security has been shrouded in mystery. How did a hacker manage to infiltrate one of the world's top computer-security companies? And could the data that was stolen be used to impair its SecurID products, which are used by 40 milli...

InTerra Blog Machine 1.84 XSS Vulnerability

Exploit for php platform in category web applications Product: InTerra Blog Machine Vendor: InTerra Blog Machine Team http://code.google.com/p/interra/ Vulnerable Version: 1.84 and probably prior versions Vendor Notification: 31 March 2011 Vulnerability Type: Stored XSS Cross Site Scripting Risk...

Feng Office 1.7.3.3 - Cross-Site Request Forgery

Feng Office 1.7.3.3 - Cross-Site Request Forgery Vulnerability ID: HTB22910 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinfengoffice.html Product: Feng Office Vendor: Secure Data SRL http://www.fengoffice.com/ Vulnerable Version: 1.7.3.3 and probably prior versions Vendor Notification: 17...

Fake 'Walk and Text' App steals Android user data !

Android users who download a pirated copy of the Walk and Text app are strolling smack into trouble. The rogue app, called Android. Walkinwat, is a corrupted version of the legitimate Android Walk and Text app, the security firm Symantec reported. Walk and Text, which can be found in many...

Spitfire CMS 1.0.436 Cross Site Scripting

Vulnerability ID: HTB22903 Reference: http://www.htbridge.ch/advisory/xssinspitfirecms.html Product: Spitfire CMS Vendor: Spitfire http://spitfire.clausmuus.de/ Vulnerable Version: 1.0.436 Vendor Notification: 15 March 2011 Vulnerability Type: XSS Risk level: Medium Credit: High-Tech Bridge SA -...

LotusCMS 3.0.3 Multiple Vulnerabilities

Exploit for php platform in category web applications Product: LotusCMS Vendor: Arboroia Network http://www.lotuscms.org/ Vulnerable Version: 3.0.3 and probably prior versions Vendor Notification: 01 March 2011 Vulnerability Type: CSRF Cross-Site Request Forgery Risk level: Low Credit: High-Tech...

Inbox.com Cross Site Scripting (XSS) vulnerability !

Inbox.com Cross Site Scripting XSS vulnerability ! Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by anothe...

Malware-Infected Apps Yanked From Android Market

A large number of apps in the Android Market have been found to contain a piece of malware known as DroidDream, a Trojan that not only is able to harvest sensitive data from an infected device, but also can break out of the Android sandbox and download additional malicious code to the phone from...

Mobile Zeus Variants Target Windows Mobile, Symbian Phones

There are two new versions of the Zeus malware making the rounds right now, both of which target popular mobile phone platforms. One of the variants targets Windows Mobile devices, while the other is going after the Symbian platform, and both are intent on silently stealing data from infected...

CBC Reports Canadian Government Hacked By Chinese

The Canadian Broadcasting Corp. is reporting that key government agencies in Canada were the targets of a sophisticated cyber attack aimed at stealing sensitive government information. The attack was first detected in January, 2011, and prompted Canada’s Finance Department and Treasury Board off...

Anonymous hackers planning real-world attacks !

A computer security firm working to expose members of hacker group "Anonymous" pulled out of a premier industry conference here due to threats of real-world attacks on its employees. HBGary personnel have been peppered with threatening messages since Anonymous hackers looted data from its compute...

UMI.CMS 2.8.1.2 Cross Site Scripting

==================================== Vulnerability ID: HTB22813 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinumicms1.html Product: UMI.CMS Vendor: umisoft http://www.umi-cms.ru/ Vulnerable Version: 2.8.1.2 Vendor Notification: 25 January 2011 Vulnerability Type: Stored XSS Cross...

HTB22812: XSRF (CSRF) in UMI.CMS

Vulnerability ID: HTB22812 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinumicms.html Product: UMI.CMS Vendor: umisoft http://www.umi-cms.ru/ Vulnerable Version: 2.8.1.2 Vendor Notification: 25 January 2011 Vulnerability Type: CSRF Cross-Site Request Forgery Risk level: Low Credit: High-Tec...

Research Reveals Huge Cache of FTP, Email Credentials Stolen by Waledac

Researchers have discovered that the gang behind the once-and-future botnet Waledac has gathered nearly 500,000 stolen passwords for email accounts, along with close to 125,000 sets of pilfered credentials for FTP accounts. The discovery isn’t so surprising in its details, but rather in its scope...

Confusion, Recriminations Surround PlentyofFish Breach

Controversy has erupted around the free online dating site, PlentyofFish.com, after the Web site was found to contain a serious security vulnerability that could have potentially exposed the personal information of some 30 million users. In another chapter of the annals of “No Good Deed Goes...