[Blackhash] Audit Passwords Without Hashes

A traditional password audit typically involves extracting password hashes from systems and then sending those hashes to a third-party security auditor or an in-house security team. These security specialists have the knowledge and tools to effectively audit password hashes. They use password...

GnuTLS Bug Exposes Shortcomings in TLS Test Suites

Code audits are often ugly tasks and can sometimes find ugly things. Case in point: the GnuTLS goto bug. Chief architect and Red Hat engineer Nikos Mavrogiannopoulos initiated a code audit of the open source crypto library that eventually turned up last week’s critical bug. The bad code has been...

JBoss Enterprise Application Platform明文密码本地信息泄漏漏洞

Bugtraq ID:65762 CVE ID:CVE-2014-0058 JBOSS是一个基于J2EE的开放源代码的应用服务器。 JBoss Enterprise Application Platform的安全审核功能会以明文方式记录请求参数，当使用BASIC或者基于FORM的验证时会记录敏感信息，可访问日志文件的攻击者可获取敏感信息。 0 JBoss Enterprise Application Platform 6.2.1 厂商补丁： JBOSS ----- 用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞：...

CVE-2014-0058

The security audit functionality in Red Hat JBoss Enterprise Application Platform EAP 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files...

Input validation

The security audit functionality in Red Hat JBoss Enterprise Application Platform EAP 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files...

CVE-2014-0058

CVE-2014-0058 affects Red Hat JBoss EAP 6.x prior to 6.2.1. The security audit feature logs request parameters in plaintext, which could let a local attacker with access to audit logs obtain passwords or credentials. Public references in connected documents confirm Red Hat addressed this via a se...

CVE-2014-0058

The security audit functionality in Red Hat JBoss Enterprise Application Platform EAP 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files...

RHEL 5 / 6 : JBoss EAP (RHSA-2014:0204)

Updated Red Hat JBoss Enterprise Application Platform 6.2.1 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score,...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

Low: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 security update

Updated Red Hat JBoss Enterprise Application Platform 6.2.1 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score,...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

Low: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 security update

An update for Red Hat JBoss Enterprise Application Platform 6.2.1 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which...

phpmywind最新版本注入漏洞第二弹

简要描述： 继续之前的代码审计，发现其他地方还有类似的问题存在，都是没有对变量进行适当的过滤就直接拼接到sql语句里面执行，导致任意sql指令的执行。 详细说明： 漏洞位于member.php 689行处： $r = $dosql-GetOne"SELECT checkinfo FROM @goodsorder WHERE username='$cuname' AND id=$id"; id参数未做任何过滤直接放到sql语句里面执行。 利用分析：...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Spacewalk and Red Hat Network RHN Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the 1 whereCriteria variable in a software channels search; 2 endyear, 3 starthour, 4 endampm, 5 endday, 6 endhour, 7 endminute, 8...

CVE-2013-4415

Multiple cross-site scripting XSS vulnerabilities in Spacewalk and Red Hat Network RHN Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the 1 whereCriteria variable in a software channels search; 2 endyear, 3 starthour, 4 endampm, 5 endday, 6 endhour, 7 endminute, 8...

Atmail WebMail 7.0.2 Cross Site Scripting

============================================= INTERNET SECURITY AUDITORS ALERT 2013-014 - Original release date: March 25th, 2013 - Last revised: March 25th, 2013 - Discovered by: Vicente Aguilera Diaz - Severity: 4.3/10 CVSSv2 Base Scored - CVE-ID: CVE-2013-6229...

phpyun any file deleted resulting in injection+getshell-a vulnerability warning-the black bar safety net

Could have been just sent in the Law of the passenger interior, but today saw the official has been fixed, so nothing to hide, just issued. Hope you all learned knowledge, but also want a great God let me write this code, would have been hard to force, require no Agency. phpyun cloud talent syste...

CVE-2013-5885

Unspecified vulnerability in Oracle Solaris 11.1 allows local users to affect integrity via unknown vectors related to Audit...

Design/Logic Flaw

Unspecified vulnerability in Oracle Solaris 11.1 allows local users to affect integrity via unknown vectors related to Audit...

CVE-2013-5885

CVE-2013-5885 affects Oracle Solaris 11.1, specifically the Audit component. The connected sources confirm a local‑privilege/ integrity impact via unknown vectors related to Audit, allowing a local user to affect integrity. The vulnerability is discussed in the Jan 2014 Oracle CPU (SRU11_1_13_6_0...