Apache Tomcat 5.5.x < 5.5.36 DIGEST Authentication Multiple Security Weaknesses

According to its self-reported version number, the instance of Apache Tomcat 5.5.x listening on the remote host is prior to 5.5.36. It is, therefore, affected by the following vulnerabilities : - Replay-countermeasure functionality in HTTP Digest Access Authentication tracks cnonce values instead...

Stolen NASA Laptop Puts 'Large Number' of Employees at Risk

NASA has enacted new policies to protect employee and other sensitive information after a laptop was stolen from an employee’s locked vehicle, exposing records of personal information on a “large number” of NASA employees. The laptop was not protected by whole disk encryption, NASA officials said...

Low: Red Hat Security Advisory: Red Hat Storage 2.0 security, bug fix, and enhancement update #3

Updated glusterfs packages that fix multiple security issues, several bugs, and contain enhancements are now available for Red Hat Storage 2.0. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which give...

Team Ghostshell Allegedly Spills 2.5 M Russian Records

As part of what it’s calling “Project Blackstar,” the hacking collective Team Ghostshell posted approximately 2.5 million records it claims belong to Russian individuals who work across the political, educational and law enforcement spectrum online earlier this morning. With the project, detailed...

Report: Service Offers Cheap Access to Hacked Servers

An online service that sells fairly cheap access to compromised corporate machines creates a pay-to-play scenario for criminals seeking access to the networks of high-profile organizations, according to a Krebs on Security report. Brian Krebs writes that Dedicatexpress.com currently has access to...

HSBC Sites Knocked Offline in 'Large Scale' DoS Attack

Websites belonging to British bank and financial services company HSBC are back online today after reportedly experiencing a denial of service DoS attack. The attack, which lasted approximately 10 hours last night, was deemed a “large scale denial of service attack” by the company. “On 18 October...

Debian Security Advisory DSA 2558-1 (bacula)

The remote host is missing an update to bacula announced via advisory DSA 2558-1. OpenVAS Vulnerability Test $Id: deb25581.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2558-1 bacula Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Debian: Security Advisory (DSA-2558-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-4430

The dumpresource function in dird/dirdconf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors...

CVE-2012-4430

The dumpresource function in dird/dirdconf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors...

Using the Internet to Catch Traditional (Non-cyber) Criminals

It can happen to anyone…and when it does it usually catches everybody – the victim and his relatives – completely unprepared. I’m talking about kidnapping. Twice in my life I’ve been involved in helping the police track down and arrest gangs of kidnappers. The first case didn’t directly affect me...

bacula restriction bypass

ACLs are not enforced properly...

CVE-2012-4430: Undefined Security Weakness

The dumpresource function in dird/dirdconf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors...

[SECURITY] [DSA 2558-1] bacula security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2558-1 [email protected] http://www.debian.org/security/ Raphael Geissert October 08, 2012 http://www.debian.org/security/faq -...

Moderate: Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.2 security update

Updated Grid component packages that fix several security issues, add various enhancements and fix multiple bugs are now available for Red Hat Enterprise MRG 2 for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common...

Grum Botnet Attempts Another Comeback, Fails Again

The Grum botnet, which Dutch authorities and security researchers knocked offline earlier this summer, made a second, unsuccessful attempt at a comeback over the weekend when the bot herders stood up two new command-and-control servers in Turkey. The revival was short-lived however, and both C&Cs...

AIX NFSv4 vulnerability

IBM SECURITY ADVISORY First Issued: Thu Sept 13 13:43:29 CDT 2012 | Updated: Wed Sept 26 13:25:50 CDT 2012 | Updated: Removed the cve.mitre.org reference | Updated: Thu Dec 12 12:55:11 CST 2013 | Update: 1. Added KEYs for parsing purposes | 2. Moved to OpenSSL signature The most recent version of...

Ezylog Photovoltaic Management Server - Multiple Vulnerabilities

Ezylog Photovoltaic Management Server - Multiple Vulnerabilities Multiple vulnerabilities in Ezylog photovoltaic management server ================================================================= ADVISORY INFORMATION Title: Multiple vulnerabilities in Ezylog photovoltaic management server...

CVE-2012-4737

channels/chaniax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 does not enforce ACL rules during certa...

Team GhostShell leak One Million Records

TeamGhostShell a team linked with the Activist group Anonymous, is claiming that they have hacked some major U.S. institutions including major banking institutions, accounts of politicians and has posted those details online. The dumps comprising of millions of accounts has been let loose on the...