GHSA-MC9X-V9XG-25PM coffescript is malware

The coffescript package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation If you have found coffescript installed in your...

RedDawn Espionage Campaign Shows Mobile APTs on the Rise

A sophisticated and targeted mobile espionage campaign has been found targeting North Korean defectors. Mounted by a relatively new APT actor known as Sun Team, the offensive used Google Play and Facebook as attack vectors; and overall, it shows how quickly the mobile threat landscape is evolving...

Cross site scripting

A reflected cross site scripting XSS vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device...

Scourge of Android Overlay Malware on Rise

The black market for malicious Android software is heating up thanks to a rise in popularity of overlay malware, which can siphon credentials off Android devices and give crooks a tool to defeat two-factor identification schemes, according to security researchers at IBM’s X-Force. Overlay malware...

HackerOne: HTML injection can lead to data theft

Hey, This is more like an in-depth security thing with a reasonable attack scenario. In some occasions, it seems to be possible to leak sensitive data to an external server, not affected by the CSP. This can happen in the following situation: 1. There's a HTML injection vulnerability 2. The...

Information disclosure

The WD My Cloud aka com.wdc.wd2go application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

SpyEye 1.3.45 Download - Loader source code

SpyEye 1.3.45 Download - Loader source code A new fresh and sophisticated web-based bot named SpyEye is around in the markets and looks like to be the possible successor of the famous Zeus Trojan due to its very interesting features, with the main objective to steal bank accounts, credit cards, f...

Italian Intelligence agency CNAIPIC steals sensitive data from Indian Embassy

Italian Intelligence Agency CNAIPIC steals sensitive data from Indian Embassy Sensitive defence information appears to have been stolen from the Indian embassy here by an Italian intelligence agency during the past two years. If the documents released by Anonymous Hackers are to be believed, the...

77 Law Enforcement websites hit in mass attack by #Antisec Anonymous

77 Law Enforcement websites hit in mass attack by Antisec Anonymous Because of FBI's actions against Anonymous and Lulzsec including several arrests, Now AntiSec supporters have targeted 77 law enforcement domains and walked away with everything on them. 77 domains were hosted on the same server...

Security breach affects 15,487 Honolulu students

More than 15,000 students at Kapiolani Community College in Honolulu face an identity theft risk because of an Internet security breach, school officials said. School officials found a computer on April 15 with the personal information of 15, 487 students who applied for financial aid between...

Survey: 1/3 of employees would steal sensitive data

From PC Advisor Carrie-Ann Skinner More than one third of employees would steal sensitive company information if they thought they could earn a decent price from the theft, says Infosecurity Europe. Research by the security event organiser revealed that of those willing to steal sensitive data, 6...

Ubuntu Update for firefox vulnerabilities USN-428-1

Ubuntu Update for Linux kernel vulnerabilities USN-428-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN4281.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for firefox vulnerabilities USN-428-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

CVE-2007-0096

CarbonCommunities stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for DataBase/Carbon2.4d.mdb...

Cross-site scripting vulnerability details-vulnerability warning-the black bar safety net

【Preface】 This paper mainly introduces cross-site scripting vulnerability in the Genesis, form, hazard, use patterns, hidden tips, solutions and frequently asked questions （FAQ）, due to the current introduction to cross-site scripting vulnerability information is not a lot, and also generally not...

CVE-2005-1329

owOfflineCC.asp in OneWorldStore allows remote attackers to obtain sensitive information by modifying the idOrder parameter...

Iatek IntranetApp 2.3 - 'ad_click.asp?banner_id' SQL Injection

source: https://www.securityfocus.com/bid/12936/info Multiple input-validation vulnerabilities reportedly affect PortalApp. These issues occur due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions. The first set of issues...

PhotoPost Pro 5.1 - 'showgallery.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/12920/info Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions. The first set of issues ar...

PhotoPost Pro 5.1 - Slideshow.php?photo Cross-Site Scripting

PhotoPost Pro 5.1 - Slideshow.php?photo Cross-Site Scripting source: https://www.securityfocus.com/bid/12920/info Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using...

PhotoPost Pro 5.1 - 'showphoto.php?photo' SQL Injection

source: https://www.securityfocus.com/bid/12920/info Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions. The first set of issues ar...

CVE-2005-0109

Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic key...