bizidea Design CMS 2015Q3 – SQL Injection Vulnerability

Posted by Vulnerability Lab on Aug 12

Document Title:
===============
bizidea Design CMS 2015Q3 – SQL Injection Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1571

Release Date:
=============
2015-08-12

Vulnerability Laboratory ID (VL-ID):
====================================
1571

Common Vulnerability Scoring System:
====================================
8.7

Product & Service Introduction:…

Has the “Islamic State Hacking Division“ Stolen Information on U.S. Military Personnel?

And am I the only one who actually has to chuckle when reading the name “Islamic State Hacking Division” (even though I probably shouldn’t)?

The post Has the “Islamic State Hacking Division“ Stolen Information on U.S. Military Personnel? appeared first on Avira Blog.

10 careless errors that we keep making in IT security

computer frightened

You have read and reread numerous lists with tips on how to browse online safely, make online purchases, avoid your most intimate photos ending up online, stopping cybercriminals from ruining your vacation, or how to enjoy your favorite games without risking your privacy…

You’ve heard the same basic precautions time and again, but you keep ignoring almost all of them. It could be down to laziness or recklessness, or simply just forgetting them. This, however, could have dire consequences for your online security.

This is why we wanted to bring together, in a single list, the most basic security measures you should remember and stick to!

1. Opening any attachment that you receive by email

If you receive an email from a suspicious source or you don’t have a good feeling about it, don’t open the attachment. As we’ve said on numerous occasions, documents that look inoffensive (such as a Word document, for example) could be hiding malware and even a simple photo could prove to be dangerous.

2. Clicking on shortened links without thinking

If you use Twitter then you’ll know what we’re talking about – these links, which are becoming increasingly more common, are spread using sites such as bit.ly, the famous ow.ly from Hootsuite or goo.gl by Google. Usually, they lead you to nothing dangerous such as a blog or an online diary, but some links aren’t as inoffensive as they seem. If you want to assure yourself that the links are safe, take a look at these tips.

3. Using public Wi-Fi without taking precautions

There have been many articles written that warn us about the dangers of using public connections such as the ones that we find in cafes, hotels, airports or libraries. Even a 7-year old girl, without any technological know-how, is capable of spying on your online communications. To keep safe, don’t share confidential information (passwords, bank details, etc) and, if you can, use a virtual private network (VPN) and only access pages that use safety protocol (you’ll know it by the http in the address bar).

wifi

4. Ignoring security updates

If your operating system tells you that you need to install or update something, you should pay attention and do it. A lot of times it consists of measures to cover up weaknesses that have been recently detected that cybercriminals could use to their advantage. The same goes for your cellphone; always use the latest version of Android or iOS available and keep aware of what apps you have installed.

5. Using the same passwords on different accounts

Even though it’s the easiest way to remember them all, it’s a really bad idea, because if someone gets hold of your password then they have free rein on all of your accounts. Also, any attack on a company’s database (which is also becoming more common) can wind up with your credentials being sold on the black market. When a cybercriminal gets his hands on them, he’ll be able to access every protected account. To avoid this, activate the two-step verification tool such as the ones for Gmail or Facebook.

6. Thinking that an antivirus isn’t important

A good antivirus software is the best barrier you can put between your computer and cybercriminals. New vulnerabilities, different ways of compromising your private information, and ways to raid your bank account are discovered every day. Only security experts at specialized firms are aware of antivirus updates necessary for when a threat emerges. By the way, if you have a Mac, it’s also necessary to have an antivirus. The idea that Apple products don’t have viruses is a myth.

7. Thinking that backing up files is a waste of time

Making a backup of your files is much easier than it sounds, but if you get lazy just thinking about it then remember that you have many tools at your disposal that handle everything. The Panda security solutions, without going any further, allow you to program backups to save your files in the cloud and retrieve them quickly and easily.

Backup

8. Not paying attention to your browser when it says the connection isn’t secure

When we surf the net, we tend to act on autopilot and ignore any warnings that we come across. If Chrome says that a web is not safe, we ignore the warning. If Firefox asks for confirmation before downloading a file, we give our approval without thinking. Science says that we have become accustomed to these messages so that we no longer notice them. For you sake, pay attention! Neither Mozilla nor Google show these messages to annoy you.

9. Giving out information on social media

This is especially true for when we go on vacation and share all the details on Facebook or Twitter, but also when we reveal our location without thinking about who could use it for malicious purposes. Sometimes we forget, but all the information we publish on social networks is capable of ending up in the wrong hands.

10. Downloading applications from anywhere

The malware designed for mobile devices is booming and one of its main pathways are the dangerous downloads outside of Google Play and the Apple Store. The official stores have certain security measures to prevent spread malware and you can read reviews from other users before deciding to install an app, in case there was something suspicious. Conversely, if you download from an unofficial page and install it on your own, the likelihood of it containing malware is higher.

The post 10 careless errors that we keep making in IT security appeared first on MediaCenter Panda Security.

From Tesla to Baby Monitors: A Collaborative Approach to Security and Hackers

There was a “car hacking” area at Defcon 23 last week, where Tesla proudly displayed their brand and a new Model S. While there were a couple of other vehicles at the show (in various states of having their electronics torn down), the buzz was all about Tesla.

The Model S was hacked, and that was big news at the conference. After the hack, Tesla fixed the vulnerabilities and delivered patches to their vehicles using an Over The Air (OTA) update. With OTA, drivers didn’t need to bring their vehicles in for service or worry about managing software upgrades; updates happened automatically.

By being an active participant at Defcon, Tesla is showing how to build a positive, trusting and productive relationship with white hat hackers. When the hackers called Tesla with the vulnerabilities, Tesla quickly responded. As a result, they now have a more secure system and better separation between core car systems (engine, brakes, etc.) and the infotainment functions. The differences between Tesla’s approach and the Jeep approach are pretty stark.

Tesla

 

Manufacturers across industries should take note of Tesla’s engagement of the Defcon community as a model to follow. Companies need to engage and build trust with white hat hackers if they are to fully utilize the knowledge and expertise the community offers.

The Model S is just one example of a Thing connected to the Internet – an IoT device. A Tesla is a big-ticket item, with serious implications if it is compromised. From that perspective, Tesla’s investment in back-end infrastructure and OTA systems makes a lot of sense. Similar infrastructure should be in place for other IoT devices, but is often not.

Take IoT baby monitors, for example. None of the products tested at Defcon met even a minimal level of security, including several products that lack encrypted video and audio feeds. The problem is that a baby monitor is an inexpensive device (compared to a Tesla), and the economics make it harder to justify large investments in security and back end systems. This is a problem (and opportunity) the industry needs to address. Some security frameworks are emerging, but we don’t yet have a comprehensive approach. Until we do, we will see more IoT hacks. While they may not get the media attention the Tesla hack got, in many ways they are just as serious and are more difficult to fix.

We need to get to a place where more IoT vendors are proud to display their brands at Defcon (and other security conferences) because they understand the importance of security and are willing to engage positively with hackers. Perhaps next year, we will see many more companies alongside Tesla at Defcon, proudly displaying their brand.

Stored XSS in iframe allows less privileged users to do almost anything an admin can (WordPress plugin)

Posted by dxw Security on Aug 12

Details
================
Software: iframe
Version: 3.0
Homepage: http://wordpress.org/plugins/iframe/
Advisory report:
https://security.dxw.com/advisories/stored-xss-in-iframe-allows-less-privileged-users-to-do-almost-anything-an-admin-can/
CVE: Awaiting assignment
CVSS: 5.5 (Medium; AV:N/AC:L/Au:S/C:P/I:P/A:N)

Description
================
Stored XSS in iframe allows less privileged users to do almost anything an admin can

Vulnerability…

CodoForum 3.3.1 Multiple SQL Injections

Posted by Curesec Research Team on Aug 12

CodoForum 3.3.1: Multiple SQL Injection Vulnerabilities
Security Advisory – Curesec Research Team

http://blog.curesec.com/article/blog/CodoForum-331-Multiple-SQL-Injection-Vulnerabilities-42.html

1. Introduction

Affected Product: CodoForum 3.3.1
Fixed in: 3.4
Fixed Version Link:
https://bitbucket.org/evnix/codoforum_downloads/downloads/codoforum.v.3.4.build-19.zip

Vendor Contact: admin () codologic com…

Stored XSS in Google Analytics by Yoast Premium allows privileged users to attack other users (WordPress plugin)

Posted by dxw Security on Aug 12

Details
================
Software: Google Analytics by Yoast Premium
Version: 5.4.4
Homepage: https://yoast.com/wordpress/plugins/google-analytics/
Advisory report: https://security.dxw.com/advisories/xss-in-google-analytics-by-yoast-premium-by-privileged-users/
CVE: Awaiting assignment
CVSS: 5.5 (Medium; AV:N/AC:L/Au:S/C:P/I:P/A:N)

Description
================
Stored XSS in Google Analytics by Yoast Premium allows privileged users to attack…