PT-2011-38: URL redirector abuse in Citrix XenServer Virtual Switch Controller

Positive Research Center has discovered an URL redirector abuse in Citrix XenServer Virtual Switch Controller. URL redirector GET parameter lastpage of the login page allows forwarding to an arbitrary location. It allows an attacker to conduct a phishing attack. How to fix Update your software up...

Sitecore CMS 6.4 Open Redirect

Product Name: Sitecore CMS 6.4 Vendor: http://www.sitecore.net Date: 28 July, 2011 Author: [email protected] Original URL: http://www.tomneaves.com/SitecoreCMSOpenURLRedirect.txt Discovered: 30 June, 2011 Disclosed: 28 July, 2011 I. DESCRIPTION Sitecore is a CMS system used widely throughout the...

IBM WebSphere Application Server 6.1 < 6.1.0.39 Multiple Vulnerabilities

IBM WebSphere Application Server 6.1 before Fix Pack 39 appears to be running on the remote host. As such, it is potentially affected by the following vulnerabilities : - Use of an insecure XML encryption algorithm could allow for decryption of JAX-RPC or JAX-WS Web Services requests. PM34841 - A...

13 Years Jail for Phishing Attack

13 Years Jail for Phishing Attack A 27 year old man "Kenneth Joseph Lucas II " from Los Angeles has been sentenced to 13 years in prison for allegedly playing an active role in a phishing attack, aimed at stealing money from consumer bank accounts during the operation "Phish Phry" in 2009. The tw...

Massive Phishing Attack in Progress on Tumblr

There is an ongoing phishing attack playing out right now on the Tumblr network and it already has succeeded in stealing the login credentials of several thousand users, according to researchers who have been following the activity. The attack relies on a fake login page and some promises of free...

ADAG Group Chairman Anil Ambani's email under phishing attack

ADAG Group Chairman Anil Ambani's email under phishing attack Some Unknown hackers attempted a phishing attack in May on Anil Dhirubhai Ambani Group ADAG Chairman Anil Ambani's email ID. The hacking case is now being investigated by the cyber crime cell of Mumbai police after ADAG officials...

ADAG Group Chairman Anil Ambani's email under phishing attack

ADAG Group ChairmanAnil Ambani 's email under phishing attack Some Unknown hackers attempted a phishing attack in May on Anil Dhirubhai Ambani Group ADAG Chairman Anil Ambani's email ID. The hacking case is now being investigated by the cyber crime cell of Mumbai police after ADAG officials...

Gmail Phishing Attack

US-CERT is aware of public reports of a phishing attack that specifically targets US government and military officials' Gmail accounts. The attack arrives via an email sent from a spoofed address of an individual or agency known to the targeted user. The email contains a "view download" link that...

Honda hacked - 283,000 car owners personal data Leaked !

While Tokyo-based Sony Corp. battles massive data security breaches, Japanese carmaker Honda is confronting its own online challenge — the theft of personal information from 283,000 Honda and Acura customers in Canada. Jerry Chenkin, executive vice-president and chief compliance officer at Honda...

URL redirection to untrusted site.

PMASA-2011-4 Announcement-ID: PMASA-2011-4 Date: 2011-05-22 Summary URL redirection to untrusted site. Description It was possible to redirect to an arbitrary, untrusted site, leading to a possible phishing attack. Severity We consider this vulnerability to be serious. Affected Versions The 3.4.0...

New Facebook Scam : WTF I can't believe you're in this video !

New Facebook Scam : WTF I can't believe you're in this video ! If you happen to get a new wall post from your friend saying "WTF I can't believe you're in this vid" or "ROFL i cant believe youre tagged in this video" Its a new scam spreading on Facebook. Don't open or click on this link else it...

Oak Ridge National Laboratory Cuts Off Internet, E-mail After Attack

The Oak Ridge National Laboratory, a science and technology complex that houses one of the world’s fastest computers, was forced to suspend Internet access and e-mail capabilities for employees on Friday in response to what has been described as a targeted phishing attack, according to...

Ongoing Phishing Attack

US-CERT is aware of public reports of an ongoing phishing attack. At this time, this attack appears to be targeting PayPal, Bank of America, Lloyds, and TSB users. The attack arrives via an unsolicited email message containing an HTML attachment. This attack is unlike common phishing attacks...

Ubuntu Update for Firefox and Xulrunner vulnerabilities USN-1019-1

Ubuntu Update for Linux kernel vulnerabilities USN-1019-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN10191.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for Firefox and Xulrunner vulnerabilities USN-1019-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...

Squid-Imposter: A Squid Based Sidejacking Proxy !

That tool was meant specifically for Windows operating systems and also contains a module that uses HTML5 offline cache to store the payload permanently in all supporting browsers. Squid-Imposter just add the HTML5 offline cache storage functionality to the application and has been ported to Linu...

Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : firefox, firefox-{3.0,3.5}, xulrunner-1.9.{1,2} vulnerabilities (USN-1019-1)

Jesse Ruderman, Andreas Gal, Nils, Brian Hackett, and Igor Bukanov discovered several memory issues in the browser engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. CVE-2010-3776, CVE-2010-3777, CVE-2010-3778 It was...

USN-1019-1: Firefox and Xulrunner vulnerabilities

Jesse Ruderman, Andreas Gal, Nils, Brian Hackett, and Igor Bukanov discovered several memory issues in the browser engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. CVE-2010-3776, CVE-2010-3777, CVE-2010-3778 It was...

Open redirect

Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action...

Paypal.com Cross Site Scripting

https://www.paypal.com | HTTP Header Injection | Cross Site Scripting XSS | CAPEC-34 | CWE-79 Hoyt LLC - October 28, 2010 http://cloudscan.blogspot.com | http://cloudscan.me https://www.paypal.com | HTTP Header Injection | Cross Site Scripting XSS Tested on IE8, Chrome, Firefox. The affected URL'...

Code injection

The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a random number generator that is seeded only once per document object, which makes it easier for remote attackers to track a user, or trick a user into acti...