IBM Report: Mobile Attacks, Phishing Attacks Mount in 2011

Spam volume is down, there are fewer unpatched software holes and oftware application developers did a better job of writing secure code over the last year. But IBM’s X-Force Trend and Risk Report still found plenty to worry about in 2011, according to a copy of the report released this week...

USN-1377-1: Ruby vulnerabilities

Drew Yao discovered that the WEBrick HTTP server was vulnerable to cross-site scripting attacks when displaying error pages. A remote attacker could use this flaw to run arbitrary web script. CVE-2010-0541 Drew Yao discovered that Ruby's BigDecimal module did not properly allocate memory on 64-bi...

Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : ruby1.8 vulnerabilities (USN-1377-1)

Drew Yao discovered that the WEBrick HTTP server was vulnerable to cross-site scripting attacks when displaying error pages. A remote attacker could use this flaw to run arbitrary web script. CVE-2010-0541 Drew Yao discovered that Ruby's BigDecimal module did not properly allocate memory on 64-bi...

Blackhole Exploit Kit's Dominance On Infected Hosts Could Push Rivals To the Cloud

The Blackhole exploit kit has a near monopoly on infected Web pages, according to Web security firm M86’s latest Security Labs Report, issued today. PDF The bi-annual report, which covers the last half of 2011, July to December, describe Blackhole as the source of a whopping 95 percent of all the...

Microsoft Says Rustock Botnet Cut in Half

In March, Microsoft announced that its Digital Crimes Unit had scored a major victory in the war against hackers with the takedown of the Rustock botnet. Since then, the company has continued to monitor the activity of the network and the machines infected with the Rustock-related malware and fou...

Security Threats Increasing in Sophistication and Precision

IBM’s X-Force 2010 Trend and Risk report showed that as vulnerability disclosures hit their highest level ever in 2010, security threats continued to increase in sophistication and precision. Like the term or not, 2010 may well have been the year of the APT, the term has become familiar to nearly...

Rustock Botnet: Dead Or Just Reloading?

Reports indicate that the massive drop in spam levels are linked to the sudden disappearance of the Rustock botnet. However, recent history suggests the interruption may only be temporary. Spamhaus’s Composite Spam Blocklist CBL claims that dozens of Rustock’s internet servers, which for years ha...

Microsoft botnet take down will not stop spam !

A prominent security researcher said he doubts Microsoft's take down of the Waledac botnet would have any impact on spam levels, as the company claimed. "Waledac just is not a hugely prolific spammer," said Joe Stewart, director of malware analysis at SecureWorks and a noted botnet researcher. "S...

DMXReady Members Area Manager Persistent XSS Vulnerability

Exploit for asp platform in category web applications ========================================================== DMXReady Members Area Manager Persistent XSS Vulnerability ==========================================================...

Статические анализаторы php. Мини-обзор

С течение времени мы все чаще и чаще можем видеть появление новых систем управления контентом CMS: форумов, блогов, шопов, социальных сетей, и т.д. и т.п. Многие из них, в силу некомпетентности или недостаточного уровня профессионализма их разработчиков, имеют в коде уязвимые места, позволяющие...

PenPals - Authentication Bypass

PenPals - Authentication Bypass Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title: PenPals Authentication Bypass Vendor url:http://www.anblik.com Version:1.0 Price:1200$ Published: 2010-06-17 Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to all ICW members...

VU Case Manager - Authentication Bypass

VU Case Manager - Authentication Bypass 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site :...

VU Case Manager - Authentication Bypass

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : Inj3ct0r.com 0 1 + Support e-mail :...

SchoolMation Version 2.3 SQLi and XSS Vulnerability

Exploit for php platform in category web applications =================================================== SchoolMation Version 2.3 SQLi and XSS Vulnerability =================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'...

Haciendo amigos

Cuando haga amigos, considere ubicarlos en grupos. Puede organizarlos en grados de privacidad aquéllos que sepan de mi familia y aquéllos que no o personas que se conocen entre ellas. La gente puede pertenecer a más de un grupo si usted así lo desea. Piense en qué tipo de amigos son. ¿Familia?...

[SECURITY] Fedora 13 Update: alienarena-7.33-2.fc13

Alien Arena 2009 is an online deathmatch game with over 30 levels, seven mo des of play, loads of mutators, built-in bots, multiple player characters and w eapons with alt-fire modes...

Joomla! Component JInventory 1.23.02 - Local File Inclusion

--------------------------------------------------------------------------------- Joomla Component JInventory Local File Inclusion --------------------------------------------------------------------------------- Author : Chip D3 Bi0s Group : LatinHackTeam Email & msn : [email protected] Date ...

Joomla! Component JInventory 1.23.02 - Local File Inclusion

Joomla! Component JInventory 1.23.02 - Local File Inclusion --------------------------------------------------------------------------------- Joomla Component JInventory Local File Inclusion --------------------------------------------------------------------------------- Author : Chip D3 Bi0s...

JQL breaks issue security levels based on custom fields

The MultiSelectCustomFieldIndexer does 2 things: index but don't store a case-folded version in the field "customfield10017:retail" store a "raw" version in a new field with the raw added to the end "customfield10017raw:Retail" The problem is that com.atlassian.jira.security.type.GroupCF looks fo...

WD-CMS 3.0 XSS / File Disclosure

Exploit Title: WD-CMS 3.0 Multiple Vulnerabilities Date: December 31st, 2009 Author: Sora Software Link: http://www.webdiamond.net/cms.html Version: 3.0 Tested on: Windows Vista and Linux Backtrack 3 --------------------------------------------------------------- WD-CMS 3.0 Multiple Vulnerabiliti...