LastPass Patches Ormandy Remote Compromise Flaw

LastPass has patched a vulnerability in its Firefox add-on found by Google Project Zero researcher Tavis Ormandy that allows attackers complete remote compromise of the password manager, . The divisive Ormandy submitted a bug report on Tuesday to LastPass after a series of tweets hinting at serio...

secure8.clubwise.com XSS vulnerability

Vulnerable URL: https://secure8.clubwise.com/tamworth/inc/postcodeframe.asp?OutputForm=guestpass=memberpostcode=poscod2town=membercounty=1%22--%3E%3Csvg/onload=;prompt/OPENBUGBOUNTY/;%3E== Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XS...

Correction: BMC-2015-0005: File inclusion vulnerability caused by misconfiguration of "BIRT Viewer" servlet as used in BMC Remedy AR Reporting

Enigmail: ????? ????? ????????? ?? ???? ??????????? ??? ????????? Errata: This is a correction of our previous disclosure email from September 23rd, 2015. Our previous posting implied that the security vulnerability we discovered was in the "BIRT Viewer" servlet itself. This is NOT the case, but...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Multiple buffer overflows, memory corruptions, information disclosures, restriction bypass...

Cybersecurity Legislation Forecast is Grim

MINNEAPOLIS – If you’re expecting federal cybersecurity legislation any time soon, forget it. Despite the number of prospective bills on the Hill right now, Congress is unlikely to move anything forward any time soon, according to Matthew Rhoades, director cyberspace and security program Truman...

September 2014 Microsoft Patch Tuesday advance notification

Microsoft today announced a relatively light load of patches will be delivered on Patch Tuesday next week, along with some numbers that demonstrate public vulnerability disclosures continue to rise. Four security bulletins, one rated critical, are scheduled to be released next Tuesday. In what’s...

FuckShitUp - Multi Vulnerabilities Scanner written in PHP

Basically, FSU is bunch of tools written in PHP-CLI. Using build-in functions, you are able to grab url's using search engines - and so, dork for interesting files and full path disclosures. Using list of url's, scanner will look for Cross Site Scripting, Remote File Inclusion, SQL Injection and...

Adobe Reader / Acrobat multiple security vulnerabilities

Buffer overflows, memory corruptions, information disclosures, use-after-free...

Apple Mac OS X multiple security vulnerabilities

Information disclosures, memory corruptions, DoS, privilege escalations, protection bypass...

Skybox Security 6.3.x 6.4.x - Multiple Information Disclosures

Skybox Security 6.3.x 6.4.x - Multiple Information Disclosures Exploit Title: SKYBOX Security – Multiple Information Disclosure Date: 22-Jan-2014 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.skyboxsecurity.com Version: Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.1...

Four Oracle Demantra Security Vulnerabilities Found

Oracle’s Demantra, part of the company’s Value Chain Planning suite of software, is fraught with vulnerabilities according to several bug disclosures issued over the weekend. Researchers at the London-based computer security firm Portcullis claim the application is plagued by a four vulnerabiliti...

Senators Question Intelligence Officials About Snowden, Domestic Surveillance

In a hearing before the Senate Intelligence Committee to discuss the public portions of a new national security threat assessment, top intelligence and law enforcement officials said that attacks against financial networks and the critical infrastructure are major threats to the United States’...

IBM DB2 9.7 < Fix Pack 9 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 9.7 running on the remote host is prior to Fix Pack 9. It is, therefore, affected by one or more of the following vulnerabilities : - The included software, GSKit, contains several errors related to SSL and TLS that can result in denial of...

Bug Bounty to Reward Researchers with Redeemable Points

IntegraXor, a manufacturer of supervisory control and data acquisition SCADA equipment, announced last week that it would implement a bug bounty program offering points redeemable for company services to researchers that disclose security vulnerabilities in their IGX SCADA system. In most bug...

IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval

This module identifies IPMI 2.0-compatible systems and attempts to retrieve the HMAC-SHA1 password hashes of default usernames. The hashes can be stored in a file using the OUTPUTFILE option and then cracked using hmacsha1crack.rb in the tools subdirectory as well hashcat cpu 0.46 or newer using...

code_disclosure

This plugin greps every page in order to find code disclosures. Basically it greps for ?.? and %.% using the re module and reports findings. Code disclosures are usually generated due to web server misconfigurations, or wierd web application "features". Plugin type Grep Options This plugin doesnt...

Seven-Year Facebook Study Warns of 'Silent Listeners'

Facebook users are sharing less information publicly, yet continue to share countless bits of information with what one group of researchers has dubbed “silent listeners.” The researchers, from Carnegie Mellon University, recently wrapped up the world’s first multiyear, longitudinal privacy study...

Report Details Coca-Cola Cyber Attack That Never was Disclosed

In an exclusive report, Bloomberg News outlines a month-long, systematic attack on Cola-Cola’s computer systems that may have influenced the failed $2.4 billion acquisition of a Chinese juice company. The FBI knew about it. Coca-Cola knew about it. But shareholders were kept in the dark. The Coke...

Concrete 5.5.21 XSS / CSRF / Path Disclosure

====================================================================================================================== Vulnerable software: Concrete CMS 5.5.21 Downloaded from: http://citylan.dl.sourceforge.net/project/concretecms/concrete5/5.5.2.1/concrete5.5.2.1.zip...

New SEC Guidance May Impact Corporate Disclosure

As companies begin submitting their regulatory filings and financial reports from 2011, the SEC is pushing for more comprehensive data breach, cyber attack, and general risk-assessment disclosures. As it stands, companies not only downplay the severity of hacking and other Internet-borne threats ...