[SECURITY] Fedora 19 Update: python-jinja2-2.6-7.fc19

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. If you have any exposure to other text-based template languages, such as Smarty or Django, you should feel right at home with...

openSUSE Security Update : subversion (openSUSE-SU-2013:0687-1)

Subversion received minor version updates to fix remote triggerable vulnerabilities in moddavsvn which may result in denial of service. On openSUSE 12.1 : - update to 1.6.21 bnc813913, addressing remotely triggerable + CVE-2013-1845: moddavsvn excessive memory usage from property changes +...

openSUSE Security Update : subversion (openSUSE-SU-2013:1836-1)

This update fixes the following issues with subversion CVE-2013-4505,CVE-2013-4558 : - bnc850747: update to 1.8.5 - CVE-2013-4505: moddontdothat does not restrict requests from serf clients. - CVE-2013-4558: moddavsvn assertion triggered by autoversioning commits. + Client-side bugfixes : - fix...

openSUSE Security Update : subversion (openSUSE-SU-2013:1006-1)

This update of subversion includes several bug and security fixes. - update to 1.7.10 bnc821505 CVE-2013-1968 CVE-2013-2088 CVE-2013-2112 - Client-side bugfixes : - fix 'svn revert' 'no such table: revertlist' spurious error - fix 'svn diff' doesn't show some locally added files - fix changelist...

(RHSA-2014:0575) Low: Red Hat Enterprise Developer Toolset Version 1 One-month Retirement Notice

In accordance with the Red Hat Enterprise Developer Toolset Life Cycle policy, the Red Hat Developer Toolset Version 1 offering will be retired as of June 30, 2014, and support will no longer be provided. Accordingly, Red Hat will no longer provide updated packages, including critical impact...

Kali Linux 1.0.7 Released

Kernel 3.14, Tool Updates, Package Improvements Kali linux 1.0.7 has just been released, complete with a whole bunch of tool updates, a new kernel, and some cool new features. Check out our changelog for a full list of these items. As usual, you don’t need to re-download or re-install Kali to...

Stable Channel Update

The Chrome Team is excited to announce the promotion of Chrome 35 to the Stable channel for Windows, Mac, and Linux. Chrome 35.0.1916.114 contains a number of fixes and improvements, including: More developer control over touch input New JavaScript features Unprefixed Shadow DOM A number of new...

JVN#68340046: intra-mart vulnerable to open redirect

intra-mart is a software framework for creating web applications. intra-mart contains an open redirect vulnerability. Impact When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack. Solution Apply t...

Apple Fixes Critical Hole in Developer Center, Radar

Apple patched a potentially serious hole in its Developer Center earlier this week that could have given anyone unfettered access to the personal contact information of company developers, retail employees and even executives. Ironically enough, the bug existed in Apple’s internal bug reporting a...

Malicious Chrome Extension Hijacks CryptoCurrencies and Wallets

Although the number of malicious browser extensions has significantly increased in the past years, but recently a new extension of the Google Chrome is allegedly targeting Cryptocurrency users that is capable of stealing Bitcoins and other crypto coins silently. The malicious Chrome browser...

Bonefire 0.7.1 - Reinstall Admin Account

Bonefire 0.7.1 - Reinstall Admin Account !/usr/bin/env python coding: utf-8 Bonefire v.0.7.1 Reinstall Admin Account Exploit Author : Mehmet INCE Analysis write-up : http://www.mehmetince.net/ci-bonefire-reinstall-admin-account-vulnerability-analysis-exploit/ Description : Forgotten controls lead...

No-CMS 0.6.6 rev 1 - Admin Account Hijacking / RCE Exploit via Static Encryption Key

Exploit for php platform in category web applications ?php / Static encryptionkey of No-CMS lead to Session Array Injection in order to hijack administrator account then you will be able for upload php files to server via theme/module upload. This exploit generates cookie for administrator access...

CVE-2013-4279

imapsync 1.564 and earlier performs a release check by default, which sends sensitive information imapsync, operating system, and Perl version to the developer's site...

Content Provider in CamiApp for Android fails to restrict access permissions

Overview The Content Provider in CamiApp for Android provided by KOKUYO S Co.,Ltd. contains an issue where access permissions are not restricted. Hiroshi Kumagai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impa...

WordPress 3.8.2 patch analysis HMAC timing attack-vulnerability warning-the black bar safety net

author: [email protected] 0x00 background On github over and over to see for a long time, the official version of the diff only in php where changes to a location: | 1 2 | - if $hmac != $hash + if hashhmac 'md5', $hmac, $key !== hashhmac 'md5', $hash, $key ---|--- WP developers just...

Stack overflow

Stack-based buffer overflow in a certain decryption function in qconnDoor on BlackBerry Z10 devices with software 10.1.0.2312, when developer-mode has been previously enabled, allows remote attackers to execute arbitrary code via a crafted packet in a TCP session on a wireless network...

BlackBerry Z 10 Buffer Overflow

--------------------------------------------------------------------- modzero Security Advisory: BlackBerry Z 10 - Buffer Overflow in qconnDoor MZ-13-05 --------------------------------------------------------------------- --------------------------------------------------------------------- 1...

Beware of Zeus Banking Trojan Signed With Valid Digital Signature

A new dangerous variant of ZeuS Banking Trojan has been identified by Comodo AV labs which is signed by stolen Digital Certificate which belongs to Microsoft Developer to avoid detection from Web browsers and anti-virus systems. Every Windows PC in the world is set to accept software "signed" wit...

php-font-lib 0.3 Cross Site Scripting

========================================================== php-font-lib - Subset maker makesubset.php Reflected Cross-site Scripting Revision 1.0 ========================================================== Author: Daniel C. Marques @0xc0da Release date: 2014-03-23 Reference:...

crypto.generateCRMFRequest does not validate type of key — Mozilla

Mozilla developer David Keeler reported that the crypto.generateCRFMRequest method did not correctly validate the key type of the KeyParams argument when generating ec-dual-use requests. This could lead to a crash and a denial of service DOS attack...