Iranian Weblog Services v3.3 CMS – Multiple Web Vulnerabilities

Posted by Vulnerability Lab on Jun 28

Document Title:
===============
Iranian Weblog Services v3.3 CMS – Multiple Web Vulnerabilities

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1862

CWE-89
CWE-79
CWE-264

http://cwe.mitre.org/data/definitions/89
http://cwe.mitre.org/data/definitions/79
http://cwe.mitre.org/data/definitions/264

CWE-ID:
======
89

Release Date:
=============
2016-06-28

Vulnerability Laboratory ID (VL-ID):…

Alfine CMS v2.6 – (Login) Auth Bypass Vulnerability

Posted by Vulnerability Lab on Jun 28

Document Title:
===============
Alfine CMS v2.6 – (Login) Auth Bypass Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1863

Release Date:
=============
2016-06-27

Vulnerability Laboratory ID (VL-ID):
====================================
1863

Common Vulnerability Scoring System:
====================================
8.1

Product & Service Introduction:…

Mutualaid CMS v4.3.1 – SQL Injection Web Vulnerability

Posted by Vulnerability Lab on Jun 28

Document Title:
===============
Mutualaid CMS v4.3.1 – SQL Injection Web Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1858

Release Date:
=============
2016-06-21

Vulnerability Laboratory ID (VL-ID):
====================================
1858

Common Vulnerability Scoring System:
====================================
7.6

Product & Service Introduction:…

Think Your Fingerprint Sensor is Impervious to Criminals? Think Again.

pandasecurity-fingerprint-scannerTo swipe or to press? Your fingerprint is the new key that unlocks digital life. Fingerprint recognition is an increasingly popular security barrier that can be found in all sorts of high-end devices that are currently on the market. It’s fast and easy, and can be used as an alternative or a complement to those hard-to-remember passwords.

But can we depend on fingerprint recognition as a trustworthy protection mechanism? These little sensors, usually circular and flat, are very convenient.  With a swipe or press of your finger, and you’re in.  But the disadvantages of using fingerprint recognition are much higher. Yes, the main benefit to this kind of security barrier is that the biometrics used belong to a person and cannot be modified, except for in the case of surgery or accident, making them unique and impossible to recreate. Or can they be copied?

If you have seen police drama television shows, you have already passed criminology 101. Our fingerprints are left on everything we touch. Since the surface of the sensor itself is used to record the fingerprint, your smartphone could be easily compromised by anyone with access to the device and your fingerprints (which could remain on any of the many objects that pass through your fingers on a daily basis).

Fingerprints are left on everything we touch.

Unlike passwords which can only be saved on computers and devices that we use, fingerprints can be stored everywhere and on everything, making them public domain. It has been demonstrated how it is possible to make high quality copies of fingerprints using different techniques, which means that it is very much possible to create copies with the fingerprint in order to impersonate the user.

If this is true, why do we continue to use fingerprint recognition to protect the devices and services we use every day? In comparison to passwords, fingerprint scanners have many obvious benefits: a fingerprint is unique, you always have it with you, you can’t forget it, and it is easy to record it with a sensor, among other things.

Despite all of the foreseeable disadvantages, biometric recognition techniques like fingerprint sensors will continue to be the most widely used security method (and of course, they will be used hand-in-hand with classic passwords, or something similar). Clearly, double security barriers remain in our future.

The post Think Your Fingerprint Sensor is Impervious to Criminals? Think Again. appeared first on Panda Security Mediacenter.

Ladesk Agent #1 (Bug Bounty) – Session Reset Password Vulnerability

Posted by Vulnerability Lab on Jun 28

Document Title:
===============
Ladesk Agent #1 (Bug Bounty) – Session Reset Password Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1849

Release Date:
=============
2016-06-27

Vulnerability Laboratory ID (VL-ID):
====================================
1849

Common Vulnerability Scoring System:
====================================
8.7

Product & Service Introduction:…

Woman wins $10,000 after suing Microsoft over 'Forced' Windows 10 Upgrade

Since the launch of Windows 10 in July last year, Microsoft is constantly pestering users to upgrade their PCs running older versions of the operating system.

However, many users who are happy with Windows 7 or Windows 8.1 and don’t want upgrade to Windows 10 now or anytime soon are sick of this forceful unwanted upgrade.
<!– adsense –>
One of the victims to this unwanted Windows 10

SWIFT Hackers Steal $10 Million From Ukrainian Bank

A Ukrainian bank has become the latest victim of the widespread cyber attack on global banking and financial sector by hackers who target the backbone of the world financial system, SWIFT.

Hackers have reportedly stolen $10 Million from an unnamed bank in Ukraine by exploiting the SWIFT international banking system, according to an independent IT monitoring organization called the Information