Miranda IM silent TLS failure

Summary: Under certain conditions, Miranda ignores the "Use TLS" setting in Jabber accounts and uses an unencrypted connection. Affected: Miranda IM instant messenger, at least versions 0.8.16, 0.9.0 alpha build 6 Unicode and SVN rev. 11383 Description: If the following conditions are met: - "Use...

SEC: BroCo Investments Hijacked Accounts

A U.S. federal judge has agreed to freeze the assets of a company being accused of manipulating the stocks of 38 companies listed on the Nasdaq and New York Stock Exchange via compromised trading accounts. Read the full article. CNet...

Hacktics Advisory Feb10: Persistent XSS in Microsoft SharePoint Portal

Hacktics Research Group Security Advisory http://www.hacktics.com/view=Resources7CAdvisory By Irene Abezgauz, Hacktics. 22-Feb-2010 =========== I. Overview =========== During a penetration test performed by Hacktics' experts, a persistent cross-site scripting vulnerability was identified in the...

Debian DSA-1973-1 : glibc, eglibc - information disclosure

Christoph Pleger has discovered that the GNU C Library aka glibc and its derivatives add information from the passwd.adjunct.byname map to entries in the passwd map, which allows local users to obtain the encrypted passwords of NIS accounts by calling the getpwnam function. %NASLMINLEVEL 70300 C...

IT Consultancy Defrauded of $100K

A New Hampshire-based IT consultancy lost nearly $100,000 this month after thieves broke into the company’s bank accounts with the help of 10 co-conspirators across the United States. Read the full article. KrebsonSecruity...

SharePoint server cross site scripting vulnerability

Exploit for unknown platform in category web applications ==================================================== SharePoint server cross site scripting vulnerability ==================================================== =========== I. Overview =========== During a penetration test performed by...

Twitter Hit By Phishing Attack

Twitter users were hit by potent phishing attacks over the weekend that have already led to spam runs from compromised accounts. Read the full article. The Register...

UBUNTU-CVE-2010-0286

Unspecified vulnerability in the OpenID Identity Authentication extension in TYPO3 4.3.0 allows remote attackers to bypass authentication and gain access to a backend user account via unknown attack vectors in which both the attacker and victim have an OpenID provider that discards identities...

snmp-win32-users NSE Script

Attempts to enumerate Windows user accounts through SNMP Script Arguments creds.service, creds.global See the documentation for the creds library. snmp.version See the documentation for the snmp library. Example Usage nmap -sU -p 161 --script=snmp-win32-users Script Output | snmp-win32-users: |...

IT-Grundschutz M4.016: Zugangsbeschränkungen für Accounts und oder Terminals

IT-Grundschutz M4.016: Zugangsbeschränkungen für Accounts und oder Terminals. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94183 Diese Prüfung bezieht sich auf die 1...

IT-Grundschutz M4.016: Zugangsbeschränkungen für Accounts und oder Terminals

IT-Grundschutz M4.016: Zugangsbeschränkungen für Accounts und oder Terminals. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94183 Diese Prüfung bezieht sich auf die 1...

IT-Grundschutz M4.016: Zugangsbeschränkungen für Accounts und oder Terminals

IT-Grundschutz M4.016: Zugangsbeschränkungen für Accounts und oder Terminals. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94183 Diese Prüfung bezieht sich auf die 1...

IT-Grundschutz M4.016: Zugangsbeschränkungen für Accounts und oder Terminals

IT-Grundschutz M4.016: Zugangsbeschränkungen für Accounts und oder Terminals. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94183 Diese Prüfung bezieht sich auf die 1...

Samba Symlink Directory Traversal Vulnerability (Feb 2010)

Samba is prone to a directory traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

$4 Mil Stolen in Carbon Emission Credits Hack

Credit card numbers are so passe. Today’s hackers know the real powerhouse data to steal is emission certificates. That’s exactly what hackers went after last week when they obtained unauthorized access to online accounts where companies maintain their carbon credits. Read the full article. Wired...

27K Employee Records Hacked at Ceridian

A hacker attack at payroll processing firm Ceridian Corp. has potentially revealed the names, Social Security numbers, and, in some cases, the birth dates and bank accounts of 27,000 employees working at 1,900 companies nationwide. Read the full article. StarTribune...

Samba 3.4.5 - Symlink Directory Traversal (Metasploit)

Samba 3.4.5 - Symlink Directory Traversal Metasploit source: https://www.securityfocus.com/bid/38111/info Samba is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploits would allow an attacker to access files outside of t...

Samba 3.4.5 - Symlink Directory Traversal (Metasploit)

source: https://www.securityfocus.com/bid/38111/info Samba is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploits would allow an attacker to access files outside of the Samba user's root directory to obtain sensitive...

Debian: Security Advisory (DSA-1973-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

Multiple unspecified vulnerabilities in the web server in Cisco Unified MeetingPlace 7 before 7.02.3 hotfix 5F, 6 before 6.0.639.3, and possibly 5 allow remote attackers to create 1 user or 2 administrator accounts via a crafted URL in a request to the internal interface, aka Bug IDs CSCtc59231 a...