UniCredit Bank Cross Site Request Forgery / Cross Site Scripting / Shell Upload

============================================================================================== UNICREDITBANK Cross Site Scripting & Dom Based / File Upload / form without CSRF protection = ============================================================================================== TIME-LINE...

puppet: remote code execution on master from unauthenticated clients

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call...

Update to Bitcoin Client Fixes DoS Bug, Password Strength

The developers behind Bitcoin-QT, a software wallet used to protect and back up Bitcoin currency, have pushed out a new version of the client, fixing a critical denial-of-service bug, three security issues and fortifying password security. Version 0.8.4 of the original Bitcoin client was posted t...

CM3 AcoraCMS XSS / CSRF / Redirection / Disclosure

=============================== - Advisory - =============================== Tittle: CM3 AcoraCMS - Several Vulnerabilities Risk: Medium Date: 12.Sept.2012 Author: Pedro Andujar Twitter: @pandujar .: INTRO :. Acora CMS is a sleek and powerful off-the-shelf content management application coupled...

[SECURITY] Fedora 18 Update: squid-3.2.13-1.fc18

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DN...

[SECURITY] Fedora 19 Update: squid-3.2.13-1.fc19

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DN...

FreeBSD 'nfsserver' Module 访问绕过漏洞(CVE-2013-4851)

Bugtraq ID:61484 CVE ID:CVE-2013-4851 FreeBSD是一款基于BSD的操作系统 FreeBSD存在安全漏洞，允许恶意用户绕过部分安全限制 问题是由于内核不正确使用客户端提供的验证凭据，可允许远程客户端绕过安全限制，获得对受限资源的未授权访问 0 FreeBSD 9.x 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息： http://security.freebsd.org/advisories/FreeBSD-SA-13:08.nfsserver.asc...

Oracle Linux 6 : Core X11 clients (ELSA-2013-0502)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0502 advisory. - x11perf 1.5.4 CVE-2011-2504 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

[SECURITY] Fedora 17 Update: gypsy-0.9-1.fc17

Gypsy is a GPS multiplexing daemon which allows multiple clients to access GPS data from multiple GPS sources concurrently...

[SECURITY] Fedora 18 Update: gypsy-0.9-1.fc18

Gypsy is a GPS multiplexing daemon which allows multiple clients to access GPS data from multiple GPS sources concurrently...

CVE-2013-1919

Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to "passed-through IRQs or PCI devices."...

Puppet Multiple Vulnerabilities (2013/03/12)

According to its self-reported version number, the version of Puppet Open Source or Puppet Enterprise running on the remote host has the following vulnerabilities : - A vulnerability that allows an authenticated client to execute arbitrary code on a puppet master. CVE-2013-1640 - A vulnerability...

Online Poker Rooms Fraught With Vulnerabilities

In the lucrative world of online gambling, many poker rooms – especially those that rely on the user to download a client to play – are marred by insecurities. A recent study conducted by a pair of researchers suggests a number of online gaming companies whose poker clients rely on “skins,” aren’...

Command injection

The DataSim and DataPid demonstration clients in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allow remote servers to cause a denial of service incorrect pointer access and client cra...

South Korea Cyber Attack, Wiper malware and Chinese IP Address

Yesterday we reported about a massive Cyber attack on South Korea that was responsible for shutting down networks of South Korean banks and TV broadcasters. Police are still investigating the cyber attack but the country's Communications Commission has revealed that the hacking originated from a...

Scientific Linux Security Update : Core X11 clients on SL6.x i386/x86_64 (20130221)

It was found that the x11perfcomp utility included the current working directory in its PATH environment variable. Running x11perfcomp in an attacker- controlled directory would cause arbitrary code execution with the privileges of the user running x11perfcomp. CVE-2011-2504 Also with this update...

FreeBSD : puppet27 and puppet -- multiple vulnerabilities (cda566a0-2df0-4eb0-b70e-ed7a6fb0ab3c)

Moses Mendoza reports : A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or...

puppet27 and puppet -- multiple vulnerabilities

Moses Mendoza reports: A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or...

xorg security update

CentOS Errata and Security Advisory CESA-2013:0502 Updated core client packages for the X Window System that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low...

Zendesk security breach, "We've been hacked"

Customer service software provider Zendesk announced a security breach, that affected three major Zendesk clients i.e Tumblr, Pinterest and Twitter and allowed hackers into their systems. The hacks come just days after Apple ,Twitter and Facebook revealed that their employees computers fell victi...