Zimplit 3.0 Local File Inclusion

Vulnerability ID: HTB22605 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinzimplit.html Product: Zimplit Vendor: Zimplit Ltd. http://www.zimplit.com/ Vulnerable Version: 3.0 and Probably Prior Versions Vendor Notification: 15 September 2010 Vulnerability Type: CSRF Cross-Site Request Forgery...

Pluck 4.6.3 Cross Site Scripting

Vulnerability ID: HTB22610 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinpluck.html Product: Pluck Vendor: Pluck Team http://www.pluck-cms.org Vulnerable Version: 4.6.3 and probably prior versions Vendor Notification: 15 September 2010 Vulnerability Type: XSS Cross Site Scripting...

LinkedIn Members Targeted by Botnet Malware

Members of LinkedIn who clicked on fake connection requests sent users to a Website that displayed “PLEASE WAITING…4 SECONDS” before redirecting them to Google. During those 4 seconds, the Website downloaded Zeus data-theft malware onto their PCs. Read the full article. eWEEK...

Details Emerge on IE 8 Data-Stealing Bug

Security researcher Chris Evans has released details of the data-stealing bug in Internet Explorer 8 that he publicized earlier this month, saying that the CSS flaw can be used to force victims to post messages on Twitter and that the bug appears to be no closer to being fixed. The bug, which has...

XSS vulnerability in Pluck

Vulnerability ID: HTB22610 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinpluck.html Product: Pluck Vendor: Pluck Team http://www.pluck-cms.org Vulnerable Version: 4.6.3 and probably prior versions Vendor Notification: 15 September 2010 Vulnerability Type: XSS Cross Site Scripting...

Worm: VBMania

Malware is a software designed to infiltrate or damage a computer system without the owner's informed consent. It is a general name for a variety of forms of hostile, intrusive, or annoying programs like Viruses, worms, Adware, Trojans, and spyware that exploit unprotected clients, using network...

USB Drives Remain Major Security Threat

The recent admission by a top Department of Defense official that a classified network was compromised in 2008 through an infected USB drive has brought the spotlight back onto the myriad threats that these portable devices pose to corporate networks. The security community has been wary of USB...

Mobile Website Flaws Cloak Click Fraud

It’s possible to craft a malicious website so that a user’s clicks are secretly redirected to a legitimate site in a way that steals a user’s passwords and other data. Many Web developers have added protections to block the tactic on standard websites, but Stanford University researchers warn tha...

XSS vulnerability in CMSimple

Vulnerability ID: HTB22559 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityincmsimple1.html Product: CMSimple Vendor: Peter Andreas Harteg http://www.cmsimple.org/ Vulnerable Version: 3.3 and Probably Prior Versions Vendor Notification: 02 August 2010 Vulnerability Type: XSS Cross Site...

XSS vulnerability in CMS Source

Vulnerability ID: HTB22548 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityincmssource.html Product: CMS Source Vendor: Proud Daddy Web Design http://www.prouddaddy.net/ Vulnerable Version: Current at 28.07.2010 and Probably Prior Versions Vendor Notification: 28 July 2010 Vulnerabilit...

XSS vulnerability in BXR

Vulnerability ID: HTB22507 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinbxr1.html Product: BXR Vendor: Hulihan Applications ;http://hulihanapplications.com/projects/bxr Vulnerable Version: 0.6.8 and Probably Prior Versions Vendor Notification: 22 July 2010 Vulnerability Type: XSS...

thunderbird security update

CentOS Errata and Security Advisory CESA-2010:0544 An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CV...

Hackers Increasingly Look For Configuration Errors

Hackers appear to be increasingly counting on configuration problems and programming errors rather than software vulnerabilities in order to steal information from computer systems, according to a new study based on U.S. Secret Service investigations. Read the full article. IDG News Service...

CGI Generic Open Redirection

By providing specially crafted parameters to CGIs, Nessus was able to redirect to a third-party website. As redirections are commonly used, it is possible that users will be unaware that something abnormal is happening. This kind of attack can be used to steal confidential data, typically...

Mozilla Foundation Security Advisory 2010-46

Mozilla Foundation Security Advisory 2010-46 Title: Cross-domain data theft using CSS Impact: Moderate Announced: July 20, 2010 Reporter: Chris Evans Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.7 Firefox 3.5.11 Thunderbird 3.1.1 Thunderbird 3.0.6 SeaMonkey 2.0.6 Description...

RedHat Update for seamonkey RHSA-2010:0546-01

Check for the Version of seamonkey OpenVAS Vulnerability Test RedHat Update for seamonkey RHSA-2010:0546-01 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

firefox, xulrunner security update

CentOS Errata and Security Advisory CESA-2010:0547 Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVS...

Firefox Hit by Drive-by Download Flaws

Mozilla has shipped a mega patch for Firefox to fix a total of 16 security flaws that expose Web surfers to drive-by download, data theft and local bar spoofing attacks. The latest Firefox 3.6.7 update includes fixes for nine “critical” issues that could be exploited to launch remote code executi...

Cross-domain data theft using CSS — Mozilla

Google security researcher Chris Evans reported that data can be read across domains by injecting bogus CSS selectors into a target site and then retrieving the data using JavaScript APIs. If an attacker can inject opening and closing portions of a CSS selector into points A and B of a target pag...

XSS vulnerability in Diem

Vulnerability ID: HTB22459 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityindiem1.html Product: Diem Vendor: Diem team Vulnerable Version: 5.1.2 and Probably Prior Versions Vendor Notification: 29 June 2010 Vulnerability Type: XSS Cross Site Scripting Status: Not Fixed, Vendor Alerted...