Required Group Policy Preference Actions for Microsoft Security Bulletin MS14-025

US-CERT is aware of continued exploitation of insecurely stored passwords in Group Policy Preferences, due to incomplete implementations of Microsoft Security Bulletin MS14-025. Systems may still be vulnerable to exploitation if administrators have not cleared all previously stored passwords from...

Stolen U.S. Government Credentials Found Online

Credentials stolen in breaches and sundry hacks belonging to close to 100 unique U.S. government domains are scattered among a number of paste sites and are searchable in other locations online. Analysts at Recorded Future said on Wednesday that through open source intelligence gathering and...

OPM Breach Dates Back to December

The attack on the Office of Personnel Management that was disclosed earlier this month began as early as December 2014 and likely was the end result of a social engineering attack that enabled the hackers to gain valid user credentials and move around OPM’s network. During a hearing on Capitol Hi...

Hill Debates Course of Action on China Cyberespionage

Lawmakers and experts on the U.S.-China Economic and Security Review Commission today debated with and quizzed security and legal experts on the best course of action against cyberespionage attributed to China. The Senate committee heard pros and cons related to a number of possible scenarios...

OPM Warned About Vulnerabilities, Governance Weaknesses

It’s hardly a surprise that the U.S. Office of Personnel Management OPM was targeted by nation-state hackers, given the sensitivity of the personal information the office stored. It’s also no shocker that OPM has been successfully infiltrated more than once given the state of its information...

Is China Behind the Massive Data Theft of 4 Million U.S. Officials?

The US federal agency has notified its 4 Million current and former government employees that their private data has been compromised in a massive data breach. Hackers managed to break into US government computer systems in the Office of Personnel Management OPM and steal records of Millions of...

OPM Hack May Have Exposed Security Clearance Data

Twenty-four hours after unnamed White House officials said the Office of Personnel Management OPM data breach was linked to China, one security company has connected the intrusion to the massive break-ins earlier this year at insurance companies Anthem and Premera Blue Cross, while a D.C. think...

SUSE-SU-2015:1024-1 Security update for FUSE

This update for FUSE fixes the following security issue: CVE-2015-3202: FUSE did not clear the environment upon execution of external programs. Security Issues: CVE-2015-3202...

Chinese Hackers Broke into the Database of U.S. Federal Employees

Chinese hackers broke into the computer systems of United States government agency that keeps the personal information of all federal employees, according to the paper published in the New York Times. The attack occurred on the Office of Personnel Management and Senior American officials believe...

CVE-2013-4183

The clearvolume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors...

symfony 1.0.5 released (security fix)

I've just released symfony 1.0.5. If you use the symfony built-in phpmailer and you do if you use the -sendMail method in your actions, you must upgrade to this release or apply the following patch: http://trac.symfony-project.com/trac/changeset/4380?format=diff&new=4380. PHPMailer has a remote...

security flaw

The blockpreparewrite function in fs/buffer.c for Linux kernel 2.6.x before 2.6.13 does not properly clear buffers during certain error conditions, which allows local users to read portions of files that have been unlinked...

FUSE 2.2/2.3 - Local Information Disclosure

// source: https://www.securityfocus.com/bid/13857/info FUSE is susceptible to a local information disclosure vulnerability. This issue is due to a failure of the kernel module to properly clear used memory prior to its reuse. This vulnerability allows malicious local users to gain access to...

CVE-2005-1858

FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information...

phpBB 2.0.12 - Change User Rights Authentication Bypass

/ Paisterist's code was nice but heres mil's version. precompiled: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/897.rar Usage: bcc32 897.cpp and place the exe in your firefox profile dir. Usually C:\Documents and Settings\Application...

CVE-2004-0622

Apple Mac OS X 10.3.4, 10.4, 10.5, and possibly other versions does not properly clear memory for login aka Loginwindow.app, Keychain, or FileVault passwords, which could allow the root user or an attacker with physical access to obtain sensitive information by reading memory...

CVE-2004-0622

Apple Mac OS X 10.3.4, 10.4, 10.5, and possibly other versions does not properly clear memory for login aka Loginwindow.app, Keychain, or FileVault passwords, which could allow the root user or an attacker with physical access to obtain sensitive information by reading memory...

Mac OS X stores login/Keychain/FileVault passwords on disk

It seems that Mac OS X 10.3.4 tested doesn't bother clearing memory containing sensitive data, or using mlock to avoid swapping. A quick grep of the swapfiles will show up various morsels: rez: sudo strings -8 /var/vm/swapfile0 |grep -A 4 -i longname longname password user's password here /bin/zs...

CVE-2003-0291

3com OfficeConnect Remote 812 ADSL Router 1.1.7 does not properly clear memory from DHCP responses, which allows remote attackers to identify the contents of previous HTTP requests by sniffing DHCP packets...