aoop CMS 0.3.6 - Multiple Vulnerabilities

aoop CMS 0.3.6 - Multiple Vulnerabilities Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: Aoop CMS Vendor URL: www.annonyme.de Type: Cross-site Scripting CWE-79, SQL-Injection CWE-89 Date found: 2012-04-07 Date published: 2012-08-24 CVSSv2...

Gauss, Flame Highlight Problem of Defeating High-End Malware

If the last couple of years of life on the Internet have taught us anything it should be that there’s a lot we don’t know about what’s happening out there. Sure, we know that there are a lot of attacks going on, metric tons of money being stolen and untold terabytes of data being siphoned off, an...

Dorifel Malware Encrypts Files, Steals Financial Data, May Be Related to Zeus or Citadel

While much of the world was focused yesterday on the Gauss malware saga, there was another interesting infection happening, mainly in the Netherlands, that researchers think may be related to the Zeus and Citadel attacks, though the motivation behind the attack is somewhat of a mystery. The new...

New Gauss Malware, Descended From Flame and Stuxnet, Found On Thousands of PCs in Middle East

A new piece of malware dubbed Gauss, that experts say is a direct descendant of Flame and also related to Stuxnet and Duqu, has been found on thousands of PCs in the Middle East, mostly in Lebanon. Gauss contains some of the same code as Flame, but is markedly different in a number of respects,...

Scientific Linux Security Update : thunderbird on SL4.x i386/x86_64

Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2010-0174, CVE-2010-1200, CVE-2010-1211,...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. CVE-2010-1211, CVE-2010-2753, CVE-2010-1214 A memory corruption fl...

Scientific Linux Security Update : firefox on SL5.x, SL4.x, SL3.x i386/x86_64

Several flaws were found in the way in which Firefox processed certain malformed web content. A web page containing malicious content could cause Firefox to crash or potentially execute arbitrary code as the user running Firefox. CVE-2007-5338, CVE-2007-5339, CVE-2007-5340 Several flaws were foun...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

A flaw was found in the way Firefox handles form history. A malicious web page could steal saved form data by synthesizing input events, causing the browser to auto-fill form fields which could then be read by an attacker. CVE-2009-3370 A flaw was found in the way Firefox creates temporary file...

meetOne Insecure Transport / Information Disclosure

Exploit for php platform in category web applications SUMMARY meetOne, currently in Germany in the Top 50 social apps of the iTunes Store, has multiple vulnerabilities and has been found guilty of stealing Apple iPhone address books and abusing the e-mail addresses there for spam. Apple Inc. is...

meetOne Insecure Transport / Information Disclosure

SUMMARY meetOne, currently in Germany in the Top 50 social apps of the iTunes Store, has multiple vulnerabilities and has been found guilty of stealing Apple iPhone address books and abusing the e-mail addresses there for spam. Apple Inc. is ignoring the data theft and it seems even supressing...

KLA10075 Multiple vulnerabilities in Apple Safari

Multiple critical vulnerabilities have been found in Apple Safari. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, inject code, bypass security restrictions, spoof user interfaces or read local files. Below is a complete list of...

New OpFake Android Malware Entices Users With Opera Mini Browser

There is a new variant of the OpFake mobile malware making the rounds, and this version comes bundled with a version of the legitimate Opera Mini mobile browser. The malware targets Android phones and steals money from victims by sending SMS messages without the user’s knowledge to premium-rate...

Android Forums hacked, User Credentials Stolen

Phandroid's Android Forums Web site is hacked and user account details stolen, according to a notice posted online. The data includes the user names, e-mail addresses, hashed passwords, and registration IP addresses of the forums' more than 1 million users. If you are one of them, you should chan...

Android Clickjacking Rootkit Demonstrated

Android Clickjacking Rootkit Demonstrated Mobile security researchers have identified an aspect of Android 4.0.4 Ice Cream Sandwich and earlier models that clickjacking rootkits could exploit. Researchers at NC State in the US have developed a proof-of-concept prototype rootkit that attacks the...

Texas Cancer Center Alerts Patients to Personal Data Theft — Almost Two Months Later

A University of Texas cancer center today began notifying almost 30,000 patients that their personal data was stolen after someone swiped an unencypted laptop from a physician’s home almost two months ago. The University of Texas MD Anderson Cancer Center issued a news release saying it waited to...

Cotonti 0.6.23 SQL Injection

================================================================== Vulnerable Software: cotonti-0.6.23 Official Site: http://www.cotonti.com/ Tested version: http://cotonti.googlecode.com/files/cotonti-0.6.23.7z ================================================================== About Software:...

Snapdeal.com Cross Site Scripting / Redirection

Site: http://www.snapdeal.com Threat/Vulnerability: Cross site scripting a.k.a XSS, URL Redirection Severity : Moderate Author: Karthik R a.k.a 3psil0nlambda I have informed the owner CEO but got no response, acknowledgement of receipt of the mail. About the Site: India's fastest growing shopping...

#Flame Malware - 21st Century Massive cyber attack on Iran

Flame Malware - 21st Century Massive cyber attack on Iran A massive, highly sophisticated piece of malware has been newly found infecting systems in Iran and elsewhere and is believed to be part of a well-coordinated, ongoing, state-run cyber-espionage operation. The Flame computer virus not only...

DHS Warns of Potential Scams and Attack in Run-up to London Olympics

Hacktivists, malware, scams, data theft and DDoS attacks are among the Department of Homeland Security’s concerns regarding this summer’s Olympic Games set to take place in London, according to the DHS Cybersecurity and Communications Integration Center’s Strategic Outlook. The document focuses...

phAlbum PHP Gallery Script Cross Site Scripting

Exploit Title: phAlbum php Gallery Script Reflected XSS Vulnerability Date: 2012 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr Issue: Reflected XSS Risk level: High Malicious users may inject JavaScript, VBScript, ActiveX, HTML or...