Researchers Crack Furtim, SFG Malware Connection

New research is challenging what security researchers know about Furtim, a new malware strain that has been compared to Stuxnet because of its believed targeting of industrial controls in energy companies. According to security experts at Damballa, Furtim and the recently discovered SFG malware a...

Seeking Alpha Mobile Financial App Forgoes Encryption

A popular mobile application that provides financial market research material operates without a measure of encryption, putting user information, including credentials and strategic financial interests at risk. The Seeking Alpha mobile app for Android and iOS also leaks everything from HTTP cooki...

WSO2 SOA Enablement Server Server Side Request Forgery

Title: WSO2 SOA Enablement Server - Server Side Request Forgery Authors: Pawel Gocyla Date: 10. June 2016 Affected Software: ================== WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 Probably other versions are also vulnerable. Vulnerability: Server Side Request Forge...

Datadog Forces Password Reset Following Breach

Datadog, a software-as-a service-based provider of IT infrastructure monitoring and analytics services, has forced a password reset on all of its user and admin accounts following a breach last Friday. “We have detected unauthorized activity associated with a handful of production infrastructure...

The vulnerability of the Serv-U File Server allows a remote attacker to obtain information about the system’s configuration and user authentication credentials.

The vulnerability of the Serv-U File Server software relates to errors that occur during the processing of application variables. Exploiting this vulnerability allows a malicious attacker to obtain system configuration information, including user authentication data...

Data Breaches Feed Password Reuse Crimes: No Simple Fixes

It was June 2012 when Dale Meredith was shopping online for a BBQ grill for Father’s Day and found one at Sears.com. The only snag, he had to create a username and password to buy it. That irked him. He was annoyed because it was literally the hundredth-plus service—including his local newspaper,...

500K Members of Hacking Forum Doxxed

An underground forum called Nulled.io that helped users share stolen credentials, software cracks, and leaked content was hacked earlier this month, spilling a glut of information, including users’ email addresses, encrypted passwords, and IP addresses, among other details. According to researche...

Second Bank hit by Malware attack similar to $81 Million Bangladesh Heist

SWIFT, the global Society for Worldwide Interbank Financial Telecommunications, warned on Thursday of a second malware attack similar to the Bangladesh central bank hack one that led to $81 million cyber heist. In February, $81 Million cyberheist at the Bangladesh central bank was carried out by...

Internet Bug Bounty: User credentials leak and arbitrary local file read/leak due to same-origin-policy violation

Vulnerability details ===================== A vulnerability exists in Flash Player that allows violating the same-origin-policy. An attacker can read sensitive local files and communicate with remote servers. As a result, this allows uploading the content of these local files to an...

Uber: User credentials are not strong on vault.uber.com

I was just trying to login vault.uber.com I entered email xx and password xx, I got loggedin to someones account. I entered email zz and password zz, I got loggedin to someones account. It means passowrd complexity and length of username/email is not enforced. This allowed my to access the someon...

CubeCart 6.0.10 - Multiple Vulnerabilities

Exploit for php platform in category web applications Product: CubeCart Vendor: CubeCart Limited Vulnerable Versions: 6.0.10 and probably prior Tested Version: 6.0.10 Advisory Publication: March 2, 2016 without technical details Vendor Notification: March 2, 2016 Vendor Patch: March 16, 2016 Publ...

Multiple Routers Rom-0 Scanning Attempt

A vulnerability scanning tool is designed to gather information from servers. Such scans might indicate an attempt to disclose sensitive information. Remote attackers can use the Rom-0 vulnerability to get user credentials and other sensitive information...

New Relic: Basic Authorization over HTTP

Hi New Relic Team, While reviewing your host http://newrelic.com/ it was discovered that you are basic authorization over http , which is not a good practice If an attacker can intercept traffic on the network, he/she might be able to steal the user's credentials. Request:- GET /styleguide-layout...

roundcubemail: remote code execution

High-Tech Bridge Security Research Lab discovered a path traversal vulnerability in Roundcube. Vulnerability can be exploited to gain access to sensitive information and under certain circumstances to execute arbitrary code and totally compromise the vulnerable server. The vulnerability exists du...

Samsung SRN-1670D Weak Custom Encryption Algorithm Vulnerability

Samsung SRN-1670D is a network video recorder product. The Samsung SRN-1670D uses a weakly customizable encryption algorithm based on simple different-or operations, which allows remote attackers to exploit the vulnerability to obtain arbitrary files and user credentials...

PT-2017-52: Information Disclosure in Rockwell Automation Micrologix 1100 and 1400 PLC

The specialists of the Positive Research center have detected an Information Disclosure vulnerability in Rockwell Automation Micrologix 1100 and 1400 PLC. Vulnerability in programmable-logic controllers, caused by sending user credentials to the web server using a HTTP GET method, allows attacker...

iOS core application design vulnerability that exposed the user's Apple ID credentials-vulnerability warning-the black bar safety net

! Check Point alert of the Apple iOS to the core application may be exposed to user credentials. Fortunately iOS 9 contains the relevant patch. Apple ID the ios operating system specifically for user provides convenience to users themselves through an Apple ID to manage the device. Now, iOS marke...

Schneider Electric StruxureWare Building Expert Security Patch

Industrial control manufacturer Schneider Electric has published new firmware for its StruxureWare Building Expert building automation system that patches a remotely exploitable vulnerability. Researcher Artyom Kurbatov discovered that the system transmits user credentials in plaintext between th...

phpMyAdmin -- reCaptcha bypass

The phpMyAdmin development team reports: This vulnerability allows to complete the reCaptcha test and subsequently perform a brute force attack to guess user credentials without having to complete further reCaptcha tests. We consider this vulnerability to be non critical since reCaptcha is an...

Vulnerability that allows bypassing the reCaptcha test

PMASA-2015-4 Announcement-ID: PMASA-2015-4 Date: 2015-09-08 Summary Vulnerability that allows bypassing the reCaptcha test Description This vulnerability allows to complete the reCaptcha test and subsequently perform a brute force attack to guess user credentials without having to complete furthe...