This Retail Website Considers Password Security Optional

Most gaping security holes are terrible mistakes. But for one major Hong Kong-based online retailer called Strawberrynet, its security shortcomings are a feature. Like many ecommerce sites, registered users have an option for express checkout. What makes beauty-products website Strawberrynet uniq...

Barclays Bank customers targeted by phishers

Today we have a phish targeting customers of Barclays Bank, located at: bankdotbarclaydotcodotukdotolbdotauthdotloginlinkdotactiondotp1242557947640dotchofcgdotcom/bd/ The phish opens up with an initial lunge for personal details: The first page asks for a surname, then offers the potential victim...

Laravel Security Bypass Vulnerability

Laravel is a PHP development framework for developing web applications and provides syntax highlighting, documentation and extension packages. A security bypass vulnerability exists in Laravel version 5.4.x before 5.4.22. A remote attacker could exploit this vulnerability to conduct a phishing...

CVE-2016-4857

Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.11 and Splunk Light prior to 6.4.2 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2016-9099

Symantec Advanced Secure Gateway ASG 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6.7.2.1 are susceptible to an open redirection vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to redirect the...

CVE-2017-1156

CVE-2017-1156 affects IBM WebSphere Portal 8.5.0 < CF14 and 9.0.0

OAuth Worm II - The revenge

We all know about this massive Google Doc Phishing Attack that hit about 1 million accounts right? --- Image from https://arstechnica.com/security/2017/05/dont-trust-oauth-why-the-google-docs-worm-was-so-convincing/ Well this really "sophisticated attack" really?? was based on a really spread...

1 Million Gmail Users Impacted by Google Docs Phishing Attack

Google said that up to 1 million Gmail users were victimized by yesterday’s Google Docs phishing scam that spread quickly for a short period of time. In a statement, Google said that fewer than 0.1 percent of Gmail users were affected; as of last February, Google said it had one billion active...

Blackmoon Banking Trojan Using New Infection Technique

New clues have surfaced on how the Blackmoon banking Trojan is infecting its victims using a new framework to deliver the malware. “We noticed recent campaigns two weeks ago where Blackmoon had shifted its infection strategy and is now utilizing a unique and interesting technique,” said Hardik...

CVE-2015-9058

Open redirect vulnerability in Proxmox Mail Gateway (pre hotfix 4.0-8-097d26a9) allows a remote attacker to use the destination parameter to redirect users to arbitrary web sites, enabling phishing via trusted gateways. Affected product: Proxmox Mail Gateway. Root cause: improper handling of the ...

CVE-2016-10368

Opsview Monitor Pro is affected by an open redirect vulnerability (CVE-2016-10368) present in versions before 5.1.0.162300841, before 5.0.2.27475, before 4.6.4.162391051, and 4.5.x without a 2016 patch. The issue allows an attacker to redirect users to arbitrary websites by manipulating the back ...

Phishing Attack

github.com/grafana/grafana is vulnerable to phishing attacks. A malicious user can pass arbitrary URLencoded strings to the failedMsg function, allowing them to redirect users to a malicious link...

CVE-2016-0228

IBM Marketing Platform 10.0 could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in various scripts. An attacker could exploit this vulnerability to redirect a victim to arbitrary Web sites. IBM X-Force ID: 110236...

This Phishing Attack is Almost Impossible to Detect On Chrome, Firefox and Opera

A Chinese infosec researcher has reported about an "almost impossible to detect" phishing attack that can be used to trick even the most careful users on the Internet. He warned, hackers can use a known vulnerability in the Chrome, Firefox and Opera web browsers to display their fake domain names...

Cisco Registered Envelope Service Open Redirect Vulnerability

Cisco Registered Envelope Service is a Cisco Registered Envelope Service CRES to help companies protect their e-mail communications. Cisco Registered Envelope Service has an open redirection vulnerability because it does not properly filter user-supplied input. An attacker could exploit this...

Setting Expectations Between States on Cyberwar

A a panel of security experts at the RSA Conference on Wednesday said there is a lack of agreement on a definition of cyberwarfare and of the tools used to fight them. “Words matter and it’s important to have definitions. But one of the challenges is the pace of innovation gets in front of doctri...

Citrix License Server for Windows and License Server VPX Open Redirect Vulnerability

Citrix License Server for Windows and License Server VPX are both products of Citrix Systems. The former is a Windows-based authentication server and the latter is an authentication server appliance. An open redirection vulnerability exists in Citrix License Server for Windows and License Server...

CVE-2016-0214

IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file...

CVE-2016-0214

IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file...

Code injection

IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file...