PCI DSS Compliance : Handling False Positives

Note that per PCI Security Standards Council PCI SSC standards, if the version of the remote software is known to contain flaws, a vulnerability scanner must report it as vulnerable. The scanner must still flag it as vulnerable, even in cases where a workaround or mitigating configuration option ...

CVE-2012-4026

The Johnson Controls Pegasys P2000 server with software before 3.11 allows remote attackers to trigger false alerts via crafted packets to TCP port 41013 aka the upload port, a different vulnerability than CVE-2012-2607...

Code injection

The Johnson Controls Pegasys P2000 server with software before 3.11 allows remote attackers to trigger false alerts via crafted packets to TCP port 41013 aka the upload port, a different vulnerability than CVE-2012-2607...

CVE-2012-4026

CVE-2012-4026 affects the Johnson Controls Pegasys P2000 server prior to version 3.11. The vulnerability allows remote attackers to trigger false alerts by sending crafted packets to TCP port 41013 (the upload port). The public description specifies the flaw as enabling false alerts via the uploa...

CVE-2012-4026

The Johnson Controls Pegasys P2000 server with software before 3.11 allows remote attackers to trigger false alerts via crafted packets to TCP port 41013 aka the upload port, a different vulnerability than CVE-2012-2607...

Johnson Controls CK721-A and P2000 remote command execution vulnerability

Overview Johnson Controls CK721-A and P2000 products contain a remote command execution vulnerability which may allow an unauthenticated remote attacker to perform various tasks against the devices. Description The "download" port tcp/41014 on the CK721-A device is vulnerable to remote command...

WordPress MoodThingy Widget v0.8.7 Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress MoodThingy Mood Rating Widget v0.8.7 Blind SQL Injection Date: 7/2/12 Exploit Author: Chris Kellum Vendor Homepage: http://www.moodthingy.com/ Software Link:...

WordPress Plugin MoodThingy Widget 0.8.7 - Blind SQL Injection

WordPress Plugin MoodThingy Widget 0.8.7 - Blind SQL Injection Exploit Title: WordPress MoodThingy Mood Rating Widget v0.8.7 Blind SQL Injection Date: 7/2/12 Exploit Author: Chris Kellum Vendor Homepage: http://www.moodthingy.com/ Software Link:...

It's The Stupidity, Stupid: How Absurd Pitches Help Online Scammers Find Their Marks

Do you find e-mail pleas for help from the widow of Democratic Republic of the Congo strongman Mobutu Sese Seko unconvincing or downright silly? That may be the point, according to Microsoft researcher Cormac Herley. The outlandish claims of Nigerian Letter – or “419” – scams serve a critical...

Scam Video Game Startup Yanked From Kickstarter After Raising Thousands

A project soliciting funds for a new video game to compete with the likes of World of Warcraft and Skyrim has been pulled from the crowd funding website Kickstarter after it became clear that the proposal was a sham. Mythic: The Story of Gods and Men raised $4,739 from 83 backers before it was...

Apple Safari 5.1.5 For Windows - 'window.open()' URI Spoofing

source: https://www.securityfocus.com/bid/52746/info Apple Safari for Windows is affected by a URI-spoofing vulnerability. An attacker may leverage this issue to spoof the source URI of a site presented to an unsuspecting user. This may lead to a false sense of trust because the user may be...

Dropbear SSH Server Channel Concurrency Use-after-free Remote Code Execution

According to its self-reported banner, the remote host is running a version of Dropbear SSH before 2012.55. As such, it reportedly contains a flaw that might allow an attacker to run arbitrary code on the remote host with root privileges if they are authenticated using a public key and command...

Mobile Mp3 Search Script 2.0 - dl.php HTTP Response Splitting

Mobile Mp3 Search Script 2.0 - dl.php HTTP Response Splitting source: https://www.securityfocus.com/bid/52136/info Mobile Mp3 Search Script is prone to an HTTP-response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data. Attackers can leverage this issue to...

EasyWebRealEstate Blind SQL Injection Vulnerabilitiy

Exploit for php platform in category web applications Exploit Title: EasyWebRealEstate Blind SQL Injection Vulnerabilitiy Google Dork: inurl:listings.php "Powered by EasyWebRealEstate" Date: 4/1/2012 Author: H4ckCity Security Team Discovered By: farbodmahini Home: WwW.H4ckCity.Org Software Link:...

Corporate fraud vs Anonymous Analytics Group

Corporate fraud vs Anonymous Analytics Group A new financial research group, Anonymous Analytics has released a report accusing Chinese firm Chaoda Modern Agriculture of "11 years of deceit and corporate fraud". The company is one of China's largest fruit and vegetable suppliers. A faction within...

Social network poisoning - They are Following you Everywhere !

Note : This Article is taken from Most Comprehensive and Informative IT Security Magazine by The Hacker News - December Edition Download Here "Be Social" is the imperative of the last years. We live alternative lives, weave dense networks of relationships; we feel the irrepressible urge to be par...

Advantech / BroadWin WebAccess webvrpcs.exe Service Remote Code Execution (uncredentialed check) (deprecated)

The Advantech / BroadWin WebAccess software installed on the remote Windows host includes an RPC service webvrpcs.exe that listens remotely on TCP port 4592. It is affected by two vulnerabilities : - An overflow condition exists due to improper validation of user-supplied input. An unauthenticate...

New Approach to automatically detecting bugs and vulnerabilities in Linux

New Approach to automatically detecting bugs and vulnerabilities in Linux Australian researcher Silvio Cesare, PhD student at Deakin University has released a tool capable of automatically detecting bugs and vulnerabilities in embedded Linux libraries. Developers may "embed" or "clone" code from...

Sky News Twitter account Hacked

Sky News Twitter account Hacked Hackers yesterday accessed the Twitter account for Sky News business desk and posted a tweet claiming that James Murdoch had been arrested by London police. It has also lately been used by hacker groups to simply raise their profile and make the public aware of the...

Thailand Prime Minister Twitter, Facebook accounts Hacked

Thailand Prime Minister Twitter, Facebook accounts Hacked Prime Minister Yingluck Shinawatra's personal Twitter account was hacked yesterday in what officials said was possibly part of a conspiracy to embarrass the government. The false tweets accused her of cronyism and various failures. The fin...