IBM WebSphere Portal Cross-Site Scripting Vulnerability (CNVD-2015-08136)

IBM WebSphere Portal is a suite of enterprise portal software from IBM in the United States. A cross-site scripting vulnerability exists in IBM WebSphere Portal, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensiti...

Spy Banker Banking Malware Hosted on Google Cloud Server

A new run of Spy Banker banking malware infections has been targeting Portuguese-speaking victims in Brazil. While Spy Banker is an old threat, dating back to 2009 according to some security companies, the latest wrinkle attackers are taking is a new one. The campaign, spotted by researchers at...

Microsoft Internet Explorer XSS Filter CVE-2015-6138 Security Bypass Vulnerability

Description Microsoft Internet Explorer is prone to a security-bypass vulnerability that affects the XSS Filter. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. They can then execute arbitrary script code in the context of th...

ALERT: This New Ransomware Steals Passwords Before Encrypting Files

You should be very careful while visiting websites on the Internet because you could be hit by a new upgrade to the World's worst Exploit Kit – Angler, which lets hackers develop and conduct their own drive-by attacks on visitors' computers with relative ease. Many poorly-secured websites are...

54 Starwood Hotels Hit By Point of Sale Malware

Travelers who stayed at either a Westin, Sheraton, or W hotel over the last year or so are going to want to check their bank statements sooner rather than later. Starwood Hotels and Resorts, a company that owns and operates approximately 1,200 hotels across North America, including the...

Moodle cross-site scripting vulnerability (CNVD-2015-07727)

Moodle is a free, open source e-learning software platform. Moodle suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...

zTree Cross-Site Scripting Vulnerability

zTree is a free and open source relies on jQuery to achieve a multi-functional "tree plugin" , it supports JSON data , static and Ajax asynchronous loading of node data as well as a page within the simultaneous generation of multiple instances of Tree . zTree has a cross-site scripting...

Data-Stealing Android App Impersonates Word Doc

A new strain of Android malware has taken a decidedly old-school approach to infecting mobile devices. Researchers at security company Zscaler said they spotted several hundred new infections since Oct. 10, primarily targeting Android users in China. The malware arrives impersonating a Microsoft...

TalkTalk Hackers Demand Ransom of CEO Dido Harding

Update The U.K.’s Metropolitan Police Cyber Crime Unit this afternoon arrested a 15-year-old Northern Ireland boy in connection with the TalkTalk hack. The teen is alleged to have violated the Computer Misuse Act, a police statement said. He is being questioned at the County Antrim police station...

Beauty operators 4G network vulnerabilities, affecting all Android users-vulnerability warning-the black bar safety net

CERT has released a vulnerability description, major U.S. wireless operators Verizon Wireless and AT&T network vulnerability, it will access the network in all Android versions including Android 6.0, aka marshmallow user security and privacy caused the damage. May cause tens of thousands of Andro...

Western data WD from the encrypted hard drive was traced to the presence of vulnerability-vulnerability warning-the black bar safety net

Researchers said, there are several versions of the encrypted Western Digital hard drive there are many vulnerabilities, the hack once you get to the physical contact of the opportunity, you can easily get inside the data, during which time you can disregard the hard disk password. Western Digita...

More than 250 iOS Apps Caught Using Private APIs to Collect Users' Private Data

Apple is cleaning up its iTunes App Store again – for the third time in two months – following another flood of iOS apps that secretly collect users’ personal information. Researchers discovered more than 250 iOS apps that were violating Apple's App Store privacy policy, gathering personal...

Kemoge: Latest Android Malware that Can Root Your Smartphone

Google Android has been a primary concern of the attackers. Counting from a simple text message that could hack an Android phone remotely to the Stagefright bug making Billion users vulnerable. Now, the latest is the 'Kemoge Malware' that has made its debut as an Adware on the Android mobile...

Outlook Web Access Targeted Attack

Attackers aiming for lateral movement inside an enterprise network have done well in the past to target domain controller credentials. Researchers at Cybereason, however, have uncovered a targeted attack in which hackers were able to burrow onto the corporate network and steal thousands of...

Personal Info Stolen? Seven Response Steps

Yesterday on Bloomberg West, host Emily Chang reported on a breach that affected her personally identifiable information PII. She asked what she should do now that she is a victim of data theft. This is my answer. First, I recommend changing passwords for any accounts associated with the breached...

EMC RSA Archer GRC Cross-Site Scripting Vulnerability

EMC RSA Archer GRC is an enterprise IT governance and compliance governance product. EMC RSA Archer GRC suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitiv...

Web Reference Database Cross-Site Scripting Vulnerability

Web Reference Database is a web-based multi-user interface product that provides search tools and automatic indexing for managing scientific literature. Multiple scripts in Web Reference Database fail to adequately filter multiple parameters, allowing remote attackers to exploit vulnerabilities t...

WordPress Private Only plugin has multiple vulnerabilities

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers.Private Only is one of the private content plugin. The WordPress Private Only plugin suffers from a cross-site scripting a...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution. A cross-site scripting vulnerability exists in IBM Maximo Asset Management, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to...

Winmail Server 'badlogin.php' Cross-Site Scripting Vulnerability

Winmail Server is a set of mail server software. A cross-site scripting vulnerability exists in Winmail Server badlogin.php, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user...