UBUNTU-CVE-2013-1835

Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the loginas feature...

PT-2013-3420

Name of the Vulnerable Software and Affected Versions Moodle versions 2.0 through 2.1.10 Moodle versions 2.2.x through 2.2.7 Moodle versions 2.3.x through 2.3.4 Moodle versions 2.4.x through 2.4.1 Description The issue allows remote authenticated administrators to obtain sensitive information fro...

CVE-2013-1415

The pkinitcheckkdcpkid function in plugins/preauth/pkinit/pkinitcryptoopenssl.c in the PKINIT implementation in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 before 1.10.4 and 1.11.x before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate,...

PT-2013-1161

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions 1.10.3 through 1.10.4 and 1.11.x through 1.11.1 Description The issue is related to the PKINIT implementation in the Key Distribution Center KDC in MIT Kerberos 5. It does not properly handle errors during extraction of...

Microsoft Internet Explorer Shift JIS字符信息泄露漏洞(CVE-2013-0015) (ms13-009)

BUGTRAQ ID: 57822 CVECAN ID: CVE-2013-0015 Microsoft Internet Explorer是微软公司推出的一款网页浏览器。 Shift JIS是日本语的字符编码。Internet Explorer 6, 7, 8, 9没有正确执行Shift JIS编码的自动选择，通过构造触发跨域滚动事件的特制网站，远程攻击者可从不同的域或区域读取内容，造成信息泄露。 0 Microsoft Internet Explorer 6 - 9 临时解决方法： 如果您不能立刻安装补丁或者升级，建议您采取以下措施以降低威胁： 将互联网和局域网安全区域设置为“高”...

Windows Manage User Level Persistent Payload Installer

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...

Windows Manage User Level Persistent Payload Installer

Creates a scheduled task that will run using service-for-user S4U. This allows the scheduled task to run even as an unprivileged user that is not logged into the device. This will result in lower security context, allowing access to local resources only. The module requires 'Logon as a batch job'...

JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing

twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments...

Windows Service for User (S4U) Scheduled Task Persistence - Logon Trigger

Creates a scheduled task that will run using service-for-user S4U. This allows the scheduled task to run even as an unprivileged user that is not logged into the device. This will result in lower security context, allowing access to local resources only. The module requires 'Logon as a batch job'...

Windows Service for User (S4U) Scheduled Task Persistence - Schedule Trigger

Creates a scheduled task that will run using service-for-user S4U. This allows the scheduled task to run even as an unprivileged user that is not logged into the device. This will result in lower security context, allowing access to local resources only. The module requires 'Logon as a batch job'...

Win8 Remote Desktop vulnerabilities: the use of QQ Pinyin pure version achieve to mention the right-vulnerability warning-the black bar safety net

Foreword The discovery of this vulnerability, the author is the room class. Are looking to With 3 3 8 9 Remote Desktop to control the hostel computer all the time, because to redo the system to forget its own IP address, and therefore can readily scan a bit in the IP section of the opening 3 3 8 ...

[JBoss Autopwn] JSP Hacking Tool For JBoss AS Server

This JBoss script deploys a JSP shell on the target JBoss AS server. Once deployed, the script uses its upload and command execution capability to provide an interactive session. Features include: - Multiplatform support - tested on Windows, Linux and Mac targets - Support for bind and reverse...

Alliance Issues Guidance for Cloud-Based SIEM Services

The non-profit Cloud Security Alliance today released guidelines for the nascent Security as a Service SecaaS specialization within the broader realm of cloud computing. The goal, the group says, is to help companies and consumers gain a better handle on how best to evaluate, build and deploy...

Citadel Trojan Updates with Dynamic Config Mechanism that Streamlines Fraud Activity

The elusive authors of the Citadel Trojan have released a new version of their banking botnet malware and service. The latest version, the sixth since it debuted in January and dubbed Rain, includes a dynamic configuration mechanism that allows botmasters to inject malicious content to compromise...

BlackHole Exploit Kit 2.0 released with more latest Exploits

According to release announcement on Pastebin by unknown developers in a Russian-language BlackHole Exploit Kit 2.0 released with more latest Exploits. BlackHole is one of the most dominant exploit toolkits currently available in the underground market. It enables attackers to exploit security...

(bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes

Heap-based buffer overflow in the ecommunityecom2str function in bgpecommunity.c in bgpd in Quagga before 0.99.19 allows remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code by sending a crafted BGP UPDATE message over IPv4...

(bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes

Heap-based buffer overflow in the ecommunityecom2str function in bgpecommunity.c in bgpd in Quagga before 0.99.19 allows remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code by sending a crafted BGP UPDATE message over IPv4...

Mandriva Linux Security Advisory : krb5 (MDVSA-2012:120)

A vulnerability has been discovered and corrected in krb5 : The MIT krb5 KDC Key Distribution Center daemon can free an uninitialized pointer while processing an unusual AS-REQ, corrupting the process heap and possibly causing the daemon to abnormally terminate. An attacker could use this...

Fedora Update for php-ZendFramework FEDORA-2012-9979

Check for the Version of php-ZendFramework OpenVAS Vulnerability Test Fedora Update for php-ZendFramework FEDORA-2012-9979 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or...

ActFax 4.31 Local Privilege Escalation Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Title: ActFax 4.31 Local Privilege Escalation Exploit Author: Craig Freyman @cd1zz Discovered: July 10, 2012 Vendor Notified: June 12, 2012 Description: http://www.pwnag3.com/2012/08/actfax-local-privilege-escalation.html...