[SECURITY] Fedora 20 Update: Pound-2.6-8.fc20

The Pound program is a reverse proxy, load balancer and HTTPS front-end for Web servers. Pound was developed to enable distributing the load among several Web-servers and to allow for a convenient SSL wrapper for those Web servers that do not offer it natively. Pound is distributed under the GPL ...

Researcher Found TextSecure Messenger App Vulnerable to Unknown Key-Share Attack

Do you use TextSecure Private Messenger for your private conversations? If yes, then Are you sure you are actually using a Secure messaging app? TextSecure, an Android app developed by Open WhisperSystems, is completely open-source and claims to support end-to-end encryption of text messages. The...

[SECURITY] Fedora 21 Update: python-django-horizon-2014.1.3-1.fc21

Horizon is a Django application for providing Openstack UI components. It allows performing site administrator viewing account resource usage, configuring users, accounts, quotas, flavors, etc. and end user operations start/stop/delete instances, create/restore snapshots, view instance VNC consol...

Facebook Now Accessible Via Tor Anonymous Network Using .Onion Address

If you are fan of the largest social networking site Facebook, but also want to remain anonymous while using your Facebook account, then there is really a Good news for you. Facebook on Friday began offering a way for security and Privacy conscious users to connect to its social networking servic...

Tor 0.2.5.10 - Anonymity Online (Tor 0.2.3.x is deprecated!)

Tor 0.2.5.10 is the first stable release in the 0.2.5 series. It adds several new security features, including improved denial-of-service resistance for relays, new compiler hardening options, and a system-call sandbox for hardened installations on Linux requires seccomp2. The controller protocol...

Oracle Identity Manager (October 2014 CPU

The remote host is missing the October 2014 Critical Patch Update for Oracle Identity Manager. It is, therefore, affected by multiple vulnerabilities : - The application is affected by a vulnerability in Apache Commons BeanUtils in which ClassLoader objects can be set via the class attribute of a...

CVE-2014-6557

Unspecified vulnerability in the Application Performance Management component in Oracle Enterprise Manager Grid Control before 12.1.0.6.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to End User Experience Management...

CVE-2014-6487

Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote authenticated users to affect integrity via unknown vectors related to End User Self Service...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote authenticated users to affect integrity via unknown vectors related to End User Self Service...

Design/Logic Flaw

Unspecified vulnerability in the Application Performance Management component in Oracle Enterprise Manager Grid Control before 12.1.0.6.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to End User Experience Management...

CVE-2014-6487

CVE-2014-6487 is an unspecified vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware versions 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2. The flaw is described as allowing remote authenticated users to affect integrity via unknown vectors related to End User Self Ser...

CVE-2014-6487

Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote authenticated users to affect integrity via unknown vectors related to End User Self Service...

CVE-2014-6557

Unspecified vulnerability in the Application Performance Management component in Oracle Enterprise Manager Grid Control before 12.1.0.6.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to End User Experience Management...

Supesite 前台注入 #3 (Delete)

简要描述： Delete 如果ucenter和supesite在一个裤的话 可以尝试把uckey注入出来 然后…… 详细说明： 在cp.php中 $ac = empty$GET'ac' ? 'profile' : trim$GET'ac'; ifinarray$ac, array'index', 'news', 'profile', 'credit', 'models' includeonceSROOT.'./source/cp'.$ac.'.php'; 包含进来 在source/cpnews.php中 ifempty$itemid //这里让$itemid 不为空...

PHPOK最新版前台SQL注入漏洞(可直接获取管理员密码)

简要描述： PHPOK最新版前台某功能存在SQL注入漏洞，可直接UNION注入获取管理员密码 详细说明： PHPOK4.1最新版（2014-08-18更新） 官网：http://www.phpok.com/phpok.html 官网演示站点：http://demo.phpok.com 这里先整理下PHPOK系统的前台数据处理流程: /framework/api/apicontrol.php = /framework/phpokcall.php = /framework/model/data.php PHPOK系统在前台获取“文章总数”的功能实现上存在SQL注入漏洞。...

Supesite 前台二次注入一枚

简要描述： 二次猪肉。 详细说明： 在cp.php中 $ac = empty$GET'ac' ? 'profile' : trim$GET'ac'; ifinarray$ac, array'index', 'news', 'profile', 'credit', 'models' includeonceSROOT.'./source/cp'.$ac.'.php'; 包含文件进来 在source/cpnews.php中 $newsarr = array'subject' = $POST'subject', 'catid' = $POST'catid', 'type' =...

krb5 security update

CentOS Errata and Security Advisory CESA-2014:1255 Updated krb5 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which...

Shiro: successful authentication without specifying user name or password

It was discovered that Apache Shiro authenticated users without specifying a user name or a password when used in conjunction with an LDAP back end that allowed unauthenticated binds...

DESTOON前台getshell

简要描述： 如题。。 详细说明： \module\know\answer.inc.php 143 - 161行 case 'raise': //这个功能是 "知道功能" 悬赏的次数更新,因为默认只允许2次提高悬赏的次数 if$credit $credit dalert$L'lackcredit', 'goback'; $couldraise = $couldadmin;//是否是 "知道"发布的作者. if$item'process' != 1 $couldraise = false; if$item'raise' = $MOD'maxraise' $couldraise = false...

Google Changes SafeSearch Option for Administrators

Google is removing a feature that allowed administrator to require their users to employ a search option that removes explicit content from search results. The decision is tied to the fact that the option required the use of an unsecured connection to Google, something that the company said allow...