Verizon DBIR Analysis: Insiders Often Complicit in Breaches of Intellectual Property

Verizon has further dissected breach data from its annual Data Breach Investigations Report DBIR and built a profile of intellectual property theft that points to a disturbing combination of factors leading to successful infiltrations by cybercriminals, competitors, hacktivists and nation-state...

Sony PlayStation 3 hacked with custom firmware

The PlayStation 3 has been hacked before, originally with the PSJailbreak dongle and fail0verflow, but Sony managed to fight back with Firmware 3.60 which managed to ingeniously re-secure the console. But Hackers have released a custom firmware which allows compromised consoles to log into PSN,...

THINKSNS某功能高危跨站|

简要描述： THINKSNS某功能高危跨站，可跨各种名人堂啊，风云榜选手 详细说明： 一个一个来 1·添加好友分组过滤不严格 看效果 2·第二个地方是发私信的功能，没有交代清楚，导致存储Xss，是个与人交互的地方，危害比较大，可跨各种名人，如果有管理员，应该也没问题 我的私信： 利用xsser.me尝试拖cookie 顺利到手，点击登录 跨你没商量 漏洞证明： img src="https://images.seebug.org/upload/201210/212158566793a5b9a527d93fb5c486e6...

Facebook Privacy Flaw exposed two College Gay Students Accidentally

Facebook is continually changing its privacy settings, trying to give users more control over what they want to share and with whom. Two gay college students were outed on Facebook because of a privacy flaw in Facebook Groups. Users can be added to Facebook Groups by friends without the user's...

Inactive users still receiving emails from "Send email" function

The JIRA documentation for deactivating users says, bq. Will not receive any email notifications from JIRA, even if they continue to remain the assignee, reporter, or watchers of issues. However, when users have been marked as inactive they are not excluded from emails sent to groups via the 'Sen...

Inactive users still receiving emails from "Send email" function

The JIRA documentation for deactivating users says, bq. Will not receive any email notifications from JIRA, even if they continue to remain the assignee, reporter, or watchers of issues. However, when users have been marked as inactive they are not excluded from emails sent to groups via the 'Sen...

Former LulzSec hacker pleads guilty to Sony case

After last year's big PlayStation Network hack a lot of hacking groups such as Anonymous and LulzSec were intensely publicized. Back in June, a massive hack was conducted on the Sony Pictures Website. The attack led to the theft of details on over 1 million accounts and was linked to the hacker...

Internet freedom : Anonymous Brings Philippines Government Sites Offline

Hacker groups that are against the controversial Cybercrime Prevention Law for its effect on the country's freedom of expression defaced 11 more government websites since 11 p.m. Monday A message which said, "Hacked by M4N1L4 PR1D3, PHILIPPINE CYBER ARMY AND -=TheFamilyPride=-," appeared on the...

SA-CONTRIB-2012-148 - OG - Access Bypass

OG Organic groups enables users to create and manage their own 'groups'. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves. A group membership can be given immediately upon subscribing, or be pending - waiting for a group administrat...

Debian: Security Advisory (DSA-2480-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Code injection

SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDITPERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups...

Debian: Security Advisory (DSA-2538-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Group Picker Should Not Listed All Groups

Confluence will display all groups registered on it when users access any group picker and put value as its search parameter. This is not a good implementation from security point of view as normal users would be able to see the whole groups. It would be better if group picker listed only the...

PYSEC-2012-10

security/init.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group...

Information disclosure in REST API

REST endpoints to search groups and to list issue resolutions allow anonymous/unauthenticated access. The former allows to enumerate all groups on a JIRA instance by sending multiple queries as results are limited by jira.ajax.autocomplete.limit. We've verified this on an instance without any...

Al Jazeera News network website hacked by Pro-Assad hackers

The official website of one of the biggest Arabic-language news network "Al Jazeera" got hacked just now by Pro-Assad hackers called "Al-Rashedon". If your miss the deface page, please have a look to mirror of it Here. Deface page designed with Dark color as shown in image and have some message i...

Fedora Update for drupal6-og FEDORA-2012-11479

Check for the Version of drupal6-og OpenVAS Vulnerability Test Fedora Update for drupal6-og FEDORA-2012-11479 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

CVE-2012-1644

The Organic Groups OG Vocabulary module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with certain administrator permissions to modify the vocabularies of other groups via unspecified vectors...

Design/Logic Flaw

The Organic Groups OG Vocabulary module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with certain administrator permissions to modify the vocabularies of other groups via unspecified vectors...

CVE-2012-1644

The CVE-2012-1644 entry concerns the Drupal Organic Groups (OG) Vocabulary module. Affected component: OG Vocab 6.x-1.x before 6.x-1.2. Root cause: the module does not sufficiently enforce access controls on vocabularies, allowing remote authenticated users with certain administrator permissions ...