qpid-cpp: anonymous access to qpidd cannot be prevented

It was discovered that the Qpid daemon qpidd did not restrict access to anonymous users when the ANONYMOUS mechanism was disallowed...

RESTWS - Highly critical - Remote code execution - SA-CONTRIB-2016-040

This module enables you to expose Drupal entities as RESTful web services. RESTWS alters the default page callbacks for entities to provide additional functionality. A vulnerability in this approach allows an attacker to send specially crafted requests resulting in arbitrary PHP execution. There...

The vulnerability of the OpenSSL software allows a malicious attacker to compromise the accessibility of protected information.

The vulnerability in the ssl3sendclientkeyexchange function of s3clnt.c for OpenSSL allows remote DTLS servers to trigger a service failure such as swapping the null pointer and terminating the application abnormally by using a specially crafted handshake message together with an anonymous DH or...

Whonix 13 - Anonymous Operating System

Whonix is a desktop operating system designed for advanced security and privacy. It realistically addresses attacks while maintaining usability. It makes online anonymity possible via fail-safe, automatic, and desktop-wide use of the Tor network. A heavily reconfigured Debian base is run inside...

PCMAN FTP Server 2.0.7 ls Buffer Overflow

=begin Exploit Title: PCMAN FTP erver 2.0.7 Buffer Overflow Date: 22-06-2016 Software Link: https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z Exploit Author: quanyechavshuo Contact: [email protected] Website: http://xinghuacai.github.io Category: ftp remote exploit ...

Google Releases Security Update for Chrome

Google has released Chrome version 51.0.2704.103 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of one of these vulnerabilities may allow a remote attacker to obtain sensitive information from an affected system. US-CERT encourages users and administrators to review...

CVE-2016-3703

Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an accesstoken in the quer...

PT-2016-5666 · Red Hat · Red Hat Openshift Enterprise

Name of the Vulnerable Software and Affected Versions: Red Hat OpenShift Enterprise versions 3.1 through 3.2 Description: The issue arises from improper validation of the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod. This allows remot...

Tor Browser 6.0 - Everything you Need to Safely Browse the Internet

The Tor software protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, it prevents the sites you visit from learning your physical...

FreeBSD : chromium -- multiple vulnerabilities (c039a761-2c29-11e6-8912-3065ec8fd3ec)

Google Chrome Releases reports : 15 security fixes in this release, including : - 601073 High CVE-2016-1696: Cross-origin bypass in Extension bindings. Credit to anonymous. - 613266 High CVE-2016-1697: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - 603725 Medium CVE-2016-1698:...

SUSE-RU-2016:1478-1 Recommended update for samba

This update for Samba provides the following fixes: - Fix libads' record session expiry for spnego sasl binds. bsc979268 - Fix NTSTATUSACCESSDENIED when accessing windows public share. - Only validate MIC if 'map to guest' is not being used. - NetAPP SMB servers don't negotiate NTLMSSPSIGN...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 15 security fixes in this release, including: 601073 High CVE-2016-1696: Cross-origin bypass in Extension bindings. Credit to anonymous. 613266 High CVE-2016-1697: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. 603725 Medium CVE-2016-1698: Information lea...

TOR Mail Encrypted Server: OnionMail

TOR Mail Encrypted Server for Hidden Services OnionMail is an anonymous, encrypted mail server made to run on TOR network without losing the ability to communicate with the Internet. All OnionMail servers are configured as TOR hidden services and use SSL via STARTTLS. To use OnionMail all you nee...

3: Untrusted content loaded via the API proxy can access web console credentials on the same domain

An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser's localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized accesstoken was provided in t...

3: Untrusted content loaded via the API proxy can access web console credentials on the same domain

An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser's localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized accesstoken was provided in t...

File Replication Pro Directory Traversal Vulnerability

File Replication Pro is a file management solution for backing up, copying files from different network nodes. A directory traversal vulnerability exists in File Replication Pro 7.2.0 and earlier versions. An anonymous user can view the directory structure of files on the File Replication Pro...

PCMan FTP Server 2.0.7 - RENAME Remote Buffer Overflow (Metasploit)

PCMan FTP Server 2.0.7 - RENAME Remote Buffer Overflow Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Original Exploit Information Date: 29 Aug 2015 Exploit Author: Koby Tested on: Windows XP SP3 Link:...

Journalist Matthew Keys gets 2-Year Prison term for helping Anonymous Hackers

Former Reuters journalist Matthew Keys, who was convicted last year of helping the Anonymous group of hackers, has been sentenced to 24 months in prison for computer hacking charges. Keys was found guilty last year in October of giving Anonymous login credentials that allowed the group to deface...

British Authorities Order Hacker Lauri Love to hand Over Encryption Keys

The National Crime Agency NCA of United Kingdom is forcing the British citizen, and political hacktivist Lauri Love accused of hacking to hand over encryption keys to equipment seized from his home. Love, 31, is currently fighting extradition to the United States where he faces up to 99 years in...

Brosec - An interactive reference tool to help security professionals utilize useful payloads and commands

Brosec is a terminal based reference utility designed to help us infosec bros and broettes with useful yet sometimes complex payloads and commands that are often used during work as infosec practitioners. An example of one of Brosec's most popular use cases is the ability to generate on the fly...