QQ input state of vulnerability, let your friends die in the gentle greeting-vulnerability warning-the black bar safety net

Another year of spring, is the old man I haven't come to the BLOG inside. something. Remember last year's early fall back to the old place, a value of the taken place, to hold out something to the place. The discovery of this vulnerability after the really ruthless himself did not add a twist to...

Social Engineering Attacks Prove Failure of User Education

BOSTON — A prominent security consultant is urging a rethink of the way businesses handle user education and awareness, warning that the way attackers have latched on to social engineering techniques makes it difficult to cope with hacker attacks. During a presentation at the SOURCE conference...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle E-Business Suite 6.1.1.0 allows remote attackers to affect confidentiality via unknown vectors...

CVE-2010-0865

Technical details for CVE-2010-0865 are not provided in the supplied documents. Public references mention an unspecified vulnerability in Oracle Agile Engineering Data Management / Oracle E-Business Suite 6.1.1.0; monitor for updates.

The Importance of Patching Human Vulnerabilities

Today’s threat landscape is very complex. Cybercriminals use a wide range of threats to hijack people’s computers and to make money illegally. These threats include Trojans of many different kinds, worms, viruses and exploit code which is designed to enable malware to make use of vulnerabilities ...

CSRF Vulnerability in OSSIM 2.2.1

================== Summary ================== CSRF Vulnerability in OSSIM 2.2.1 Discovered by: CONIX Security www.conix.fr Public Release Date: 4/01/2010 Vendor: Alienvault www.alienvault.com ============= Technical Details ============= The page /ossim/controlpanel/alarmconsole.php is vulnerable...

Adobe, FoxIt Investigating Way to Mitigate PDF Hack

Security response teams at Adobe and FoxIt are investigating ways to mitigate a new PDF hack that allows the execution of an embedded executable without exploiting any security vulnerabilities. A demo of the PDF hack has been published to show how a hacker could employ social engineering techniqu...

OSSIM 2.2.1 Cross Site Scripting

================== Summary ================== Multiple XSS vulnerabilities in OSSIM 2.2.1 Discovered by: CONIX Security www.conix.fr Public Release Date: 3/31/2010 Vendor: Alienvault www.alienvault.com Fixed: Yes 3/30/2010 ============= Technical Details ============= 1. An attacker can redirect ...

Multiple XSS vulnerabilities in OSSIM 2.2.1

================== Summary ================== Multiple XSS vulnerabilities in OSSIM 2.2.1 Discovered by: CONIX Security www.conix.fr Public Release Date: 3/31/2010 Vendor: Alienvault www.alienvault.com Fixed: Yes 3/30/2010 ============= Technical Details ============= 1. An attacker can redirect ...

Hacker Finds a Way to Exploit PDF Files, Without Vulnerability

SEE: Updated report with response from Adobe and FoxIt Software A security researcher has managed to create a proof-of-concept PDF file that executes an embedded executable without exploiting any security vulnerabilities. The PDF hack, when combined with clever social engineering techniques, coul...

Copyright Infringement Lawsuit Email Scam

US-CERT is aware of public reports of an active email scam. These emails, which appear to come from seemingly legitimate law firms, indicate that someone has filed a copyright lawsuit against the message recipient. The messages may contain malicious attachments or web links. If a user opens the...

US Tax Season Phishing Scams and Malware Campaigns

In the past, US-CERT has received reports of an increased number of phishing scams and malware campaigns that take advantage of the United States tax season. Due to the upcoming tax deadline, US-CERT reminds users to remain cautious when receiving unsolicited email that could be part of a potenti...

U.S. Census Bureau 2010 Census Campaign Warning

US-CERT asks users to be vigilant during the U.S. Census Bureau's 2010 Census campaign and to watch for potential census scams. According to the U.S. Census 2010 website, they began delivery of the printed census forms to every resident in the United States on March 1, 2010. The only way to...

Internet Explorer 'winhlp32.exe' 'MsgBox()' Code Execution Vulnerability

Exploit for unknown platform in category remote exploits =============================================================================== Internet Explorer 'winhlp32.exe' 'MsgBox' Remote Code Execution Vulnerability ===============================================================================...

Microsoft Internet Explorer 678 - winhlp32.exe MsgBox() Remote Code Execution

Microsoft Internet Explorer 678 - winhlp32.exe MsgBox Remote Code Execution Microsoft Internet Explorer is prone to a remote code execution vulnerability. Source iSEC Security Research: http://isec.pl/vulnerabilities10.html Attackers can exploit this issue to execute arbitrary code in the context...

Microsoft Internet Explorer 6/7/8 - 'winhlp32.exe MsgBox()' Remote Code Execution

Microsoft Internet Explorer is prone to a remote code execution vulnerability. Source iSEC Security Research: http://isec.pl/vulnerabilities10.html Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise th...

[DSECRG-09-039] Symantec Antivirus 10.0 ActiveX - buffer Overflow.

Digital Security Research Group DSecRG Advisory DSECRG-09-039 Application: Symantec Antivirus Client Proxy Versions Affected: Version 10 Vendor URL: http://symantec.com Bugs: Buffer Overflow Exploits: POC Reported: 04.05.2009 Vendor response: 07.05.2009 Date of Public Advisory: 17.02.2010...

Debian DSA-1885-1 : xulrunner - several vulnerabilities

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3070 Jesse Ruderman discovered crashes in the layout...

Signed Applet Social Engineering Code Exec

$Id: javasignedapplet.rb 8328 2010-01-29 19:47:40Z natron $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Cisco Secure Desktop Remote Cross-Site Scripting Vulnerability

Cisco Secure Desktop contains a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to a lack of input sanitation in the Cisco Secure Desktop. An unauthenticated, remote attacker could exploit this vulnerability by...