IP Board 3.x CSRF - Token hjiacking Vulnerability

Usage Info Latest and propabbly previous IPB verions suffers on vulnerability, which allows attacker to steal CSRF token of specific user. Function, which allows users to share forum links, does not properly sanitize user input. Mentioned token is attached in request as GET parameter, so it's abl...

CVE-2013-2597

Stack-based buffer overflow in the acdbioctl function in audioacdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that...

[SECURITY] Fedora 20 Update: ifuse-1.1.3-3.fc20

A fuse filesystem for mounting iPhone and iPod touch devices...

[SECURITY] Fedora 20 Update: gtk3-3.10.9-2.fc20

GTK+ is a multi-platform toolkit for creating graphical user interfaces. Offering a complete set of widgets, GTK+ is suitable for projects ranging from small one-off tools to complete application suites. This package contains version 3 of GTK+...

USN-2327-1: Squid 3 vulnerability

Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service...

Ubuntu 14.04 LTS : Squid 3 vulnerability (USN-2327-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2327-1 advisory. Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a...

DSA-3013-1 s3ql - security update

Bulletin has no description...

Fedora 19 : wordpress-3.9.2-3.fc19 (2014-9270)

Upstream announcement: http://wordpress.org/news/2014/08/wordpress-3-9-2/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Cross site scripting

Cross-site scripting XSS vulnerability in the Host Aggregates interface in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name...

Fedora 20 : wordpress-3.9.2-3.fc20 (2014-9264)

Upstream announcement: http://wordpress.org/news/2014/08/wordpress-3-9-2/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

MyBB 1.8 Beta 3 Cross Site Scripting / SQL Injection

Title: MyBB 1.8 Beta 3 - Cross Site Scripting & SQL Injection Google Dork: intext:"Powered By MyBB" Date: 15.08.2014 Author: DemoLisH Vendor Homepage: http://www.mybb.com/ Software Link: http://www.mybb.com/downloads Version: 1.8 - Beta 3 Contact: [email protected] a Cross Site Scripting in...

AIX 7.1 TL 3 : malloc (IV62808)

It has been identified that the runtime linker allows privilege escalation via arbitrary file writes with elevated privileges programs. When MALLOCOPTIONS and MALLOCBUCKETS environment variables are set with bucket statistics options and by executing certain setuid programs, a non-privileged user...

PT-2014-5410

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard Horizon versions prior to 2013.2.4 OpenStack Dashboard Horizon versions 2014.1 prior to 2014.1.2 OpenStack Dashboard Horizon Juno versions prior to Juno-3 Description A cross-site scripting XSS issue exists in the Host...

CVE-2014-5252

The V3 API in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issuedat value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification 1 GET or 2 HEAD request to v3/auth/tokens/...

CVE-2014-5253

OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain...

Microsoft OneNote Remote Code Execution Vulnerability (2977201)

This host is missing an important security update according to Microsoft Bulletin MS14-048 SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE ...

Worldview-3 — Satellite That Could Allow Google and U.S Government to See Your Face from Space

Majority of my articles are related to government spying, privacy and security issues of your online stuffs and also measures that you can adopt in protecting yourself from being spied on. But, your all efforts will soon be of no use - someone is about to secretly track your every footstep. Googl...

CVE-2014-3086

CVE-2014-3086 is an IBM Java VM privilege-escalation issue impacting IBM Java SDK/JRE used in IBM WebSphere Real Time and related IBM products. The vulnerability allows untrusted code running under a security manager to escalate privileges, enabling remote code execution under the context of the ...

HoneyDrive 3 - The Premier Honeypot Linux Distro

HoneyDrive is the premier honeypot Linux distro. It is a virtual appliance OVA with Xubuntu Desktop 12.04.4 LTS edition installed. It contains over 10 pre-installed and pre-configured honeypot software packages such as Kippo SSH honeypot, Dionaea and Amun malware honeypots, Honeyd low-interaction...

MGASA-2014-0307 Updated file packages fix security vulnerability

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service CPU consumption via a crafted file that triggers backtracking during processing of an awk rule, due to an incomplete fix for CVE-2013-7345...