Regarding Two Security Holes in Scoop
607068
As per suggestions contained in the FAQ: Herein lies a report of two identified and as-of-yet uncorrected security flaws in Scoop. &nbsp;Enough detail will be provided to assist admins in investigating and correcting the flaws, but it is the author's hope that the details of the flaws will be sufficiently obscured to prevent abuse by the undesirables. Executive summary: Through the exploitation of various unchecked privileged operations, attackers may be able to perform admin-level actions leading to data loss. &nbsp;Additionally, well-intentioned security measures combined with XSS vulnerabilities can be exercised to simulate admin-level action, resulting in data loss.
735819
Single Packet Authorization fills the gaps in port knocking.
177244
Symantec issued an alert after exploit code was posted to the Securityfocus Web site. The alert raised the urgency and severity of an earlier warning about the security holes in ARCServe Backup versions 9.01 through 11.5 SP1, as well as CA's Business Protection Suite software.
304020
ProKras writes &quot;German magazine PC-Welt has discovered a major security flaw in Windows XP SP2 when installing over SP1. The article says that &#39;with a certain configuration, your file and printer sharing data
595002
SEEKONK -- With help from US Secret Service agents, Stop &amp; Shop Supermarket Cos. executives scrambled yesterday to determine how many consumers may have had their credit and debit card data stolen by high-tech thieves who apparently broke into checkout-line card readers and planted the equivalent of bugs to steal information.
543979
Disclosure survey &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
612424
With so much focus on security in the enterprise, it might have been inevitable. A Swiss security research lab is testing the market for zero-day vulnerabilities at an auction site called WSLabi. Security researchers stateside are skeptical.
16648
Opt-out button in spam used to run exploit
571914
Every IT initiative should have security reviews early and often, says Mathias Thurman. Waiting can result in applications with gaping security holes &mdash; costing money and causing delays.
539958
eBay users' details posted to anti-fraud forum &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
660657
For the first time, the general public is hearing almost daily reports of theft and exposure of sensitive nonpublic personal information.  What can we do to eliminate data insecurity?  Download this white paper to learn how emerging internal and external threats bypass traditional perimeter security measures to gain access to the crown jewels-enterprise data.
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
42081
Blog: Popular add-ons could have their update process hijacked by man-in-the-middle attacks.
173750
Rinbot, the on-again, off-again threat that exploits a pair of long-patched vulnerabilities, may be back. But security researchers differ over how serious a threat it actually is.
139416
NEWS IN BRIEF Code for two exploits in Yahoo Messenger first disclosed earlier this week by security firm eEye appeared on the Full Disclosure mailing list on Thursday.
218551
E-Gold charged with money laundering &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
529247
How to steer clear of "free checking" pitfalls.