WordPress Cookie Flaw Lets Hackers Hijack Your Account

Do you own a blog on WordPress.com website? If Yes, then you should take some extra cautious while signing into your Wordpress account from the next time when connected to public Wi-Fi, because it can be hacked without your knowledge, even if you have enabled two-factor authentication. Yan Zhu, a...

Flowplayer Cross Site Scripting

Flowplayer js & swf XSS Vulnerability Date: 15/5/14 Vulnerablity Risk : High Vulnerable Sofware: http://flowplayer.org/ Dork : inurl:flowplayer/flowplayer.swf Author: Muhammad Adeel aka Innoxent Stoker Founder | Urdusecurity.blogspot.com Vulnerability xss is Cross Site Scripting vuln Which actual...

ReddAPI: Session Fixation Found

Hello reddapi, iam saikiran a security researecher found a bug in your website... Authot- Sai Kiran bug-session fixation Severity: Medium Summary: The application does not set a new Session ID in the cookie after what appears to be an authentication attempt by the user. If this was a successful...

Popular Remote access Trojan njRAT fuels Middle East Cyber Crime

Again the sophisticated piece of malware, "njRAT" has come to picture targeting the government agencies and organizations in the Middle East, according to the research carried out by Symantec security researchers. The researchers analyzed 721 samples of malicious code ‘njRAT’ and revealed that a...

HackerOne: javascript: and mailto: links are allowed on users' profiles

For user's Profile settings, you accept website URLs like mailto:[email protected] and even javascript:alert1. The Content Security Policy directive in Chrome catches the JavaScript one, but older browsers will almost certainly execute the code, allowing for session stealing or XSS code execution...

Phabricator: OAuth Stealing Attack (New)

Hi Evan, I found a new and more dangerous way to steal phabricator facebooks oauth tokens,codes, In this case, I exploited the behavior of Phabricator OAuth Dialog, If you provide a differnet scope in phabricator OAuth Dialog...

Cutwail-Like Wigon.PH_44 Trojan Sends Spam, Steals Data

A new spambot has been discovered that generates copious amounts of HTTP POST and GET requests in an attempt to disguise what it’s really up to and throw off the scent of detection capabilities. “In this case, it seems like it’s trying to hide impactful communication where there are actual payloa...

Mobile Android banking Trojan Svpeng Adds Phishing Know-How

An Android banking Trojan known as Svpeng has added phishing capabilities to its arsenal, and researchers have spotted it attacking Russian banking clients in what is perceived to be a dry run before it is adapted for other countries. “Typically, however, cybercriminals first test-run a technolog...

Dutch Police arrested TorRAT Malware Gang for stealing over Million Dollar

None...

Zikula CMS v1.3.5 - Multiple Web Vulnerabilities

Document Title: =============== Zikula CMS v1.3.5 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1114 Release Date: ============= 2013-10-16 Vulnerability Laboratory ID VL-ID: ==================================== 1114 Comm...

OpenJDK: KeyboardFocusManager focus stealing (AWT, 7110683)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.235 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality an...

SilverStripe CMS - Multiple HTML Injection Vulnerabilities

SilverStripe CMS - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/62782/info SilverStripe is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in th...

Cisco Prime Network Control System (NCS) and Wireless Control System (WCS) vulnerable to cross-site scripting (XSS)

Overview Cisco Prime NCS and WCS Health Monitor Login pages contain a reflected cross-site scripting XSS vulnerability CWE-79. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Cisco Prime Network Control System NCS and Wireless Control System...

Android Malware Found Exploiting Google Cloud Messaging Service

Researchers have discovered a number of malicious Android apps are using Google’s Cloud Messaging service and leveraging it as a command and control server to carry out attacks. A post on Securelist today by Kaspersky Lab’s Roman Unuchek, breaks down five Trojans that have been spotted checking i...

Atlassian Confluence 5.3 Cross Site Scripting

Atlassian Confluence, the Enterprise Wiki Reflected XSS Details ============================================================================== Product: Atlassian Confluence 3.5.6 till 5.3latest version, the Enterprise Wiki Security-Risk: Critical Remote-Exploit: yes Vendor-URL:...

Jahia xCM - '/engines/manager.jsp?site' Cross-Site Scripting

source: https://www.securityfocus.com/bid/61571/info Jahia xCM is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data. An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of th...

njRAT Attacks Spike Against Middle East High-Value Targets

Government agencies, telecom and energy organizations in the Middle East are being targeted by espionage malware known as njRAT. The remote access Trojan is thorough in its data-stealing capabilities. Beyond dropping a keylogger, variants are capable of accessing a computer’s camera, stealing...

Android based hacking tool to steal passwords from connected computers

A recently discovered new form of Android malware called USB Cleaver can not only infect your smartphone, but also targets your PC to steal sensitive information from it. A hacking tool discovered by analysts at F-Secure, which is capable of stealing information from a connected Windows machine...

Android based hacking tool to steal passwords from connected computers

A recently discovered new form of Android malware called USB Cleaver can not only infect your smartphone, but also targets your PC to steal sensitive information from it. A hacking tool discovered by analysts at F-Secure, which is capable of stealing information from a connected Windows machine...

New Reveton Ransomware Variant Steals Passwords

The developers of Reveton have expanded that ransomware’s repertoire with a password stealing functionality, according to new research. Ransomware, sometimes called scareware, is a type of malware that locks down infected machines, offering to unlock them only after a fee has been paid. Oftentime...