CVE-2011-1499

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server...

Code injection

Red Hat Network RHN Satellite Server 5.3 and 5.4 does not properly rewrite unspecified URLs, which allows remote attackers to 1 obtain unspecified sensitive host information or 2 use the server as an inadvertent proxy to connect to arbitrary services and IP addresses via unspecified vectors...

[SECURITY] Fedora 15 Update: fail2ban-0.8.4-27.fc15

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/errorlog and bans IP that makes too many password failures. It updates firewall rules to reject the IP address...

The Problem of Issuing Certs For Unqualified Names

The recent attack on Comodo and several of its associated registration authorities has spurred quite a bit of re-examination of the way that the Web’s certificate authority infrastructure works–or doesn’t. One interesting result of this work is that the folks at the Electronic Frontier Foundation...

Windows Manage Inject in Memory Multiple Payloads

This module will inject in to several processes a given payload and connecting to a given list of IP Addresses. The module works with a given lists of IP Addresses and process PIDs if no PID is given it will start a the given process in the advanced options and inject the selected payload in to t...

Former employee held for hacking server of BPO unit in Hyderabad !

A former software professional on Saturday was arrested for allegedly hacking the server of a city-based BPO company, where he previously worked, police said. The hacker identified as Shaik Mahammad Ghouse Bhasa allegedly secured unauthorised access to the computer systems of M/s IVOICE Network...

DSA-2173-1 pam-pgsql - buffer overflow

Bulletin has no description...

CBI seeking Pakistan government's help in identifying members of a hacker group 'VERGIL'

The CBI will seek Pakistan government's help in identifying members of a hacker group 'VERGIL' operating from that country and was allegedly involved in defacing the official website of Bureau of Police Research and Development BPRD in 2010. Accepting a CBI plea, a Delhi court today issued a...

FreeBSD : mediawiki -- multiple vulnerabilities (8d04cfbd-344d-11e0-8669-0025222482c5)

Medawiki reports : An arbitrary script inclusion vulnerability was discovered. The vulnerability only allows execution of files with names ending in '.php' which are already present in the local filesystem. Only servers running Microsoft Windows and possibly Novell Netware are affected. Despite...

mediawiki -- multiple vulnerabilities

Medawiki reports: An arbitrary script inclusion vulnerability was discovered. The vulnerability only allows execution of files with names ending in ".php" which are already present in the local filesystem. Only servers running Microsoft Windows and possibly Novell Netware are affected. Despite...

Microsoft botnet take down will not stop spam !

A prominent security researcher said he doubts Microsoft's take down of the Waledac botnet would have any impact on spam levels, as the company claimed. "Waledac just is not a hugely prolific spammer," said Joe Stewart, director of malware analysis at SecureWorks and a noted botnet researcher. "S...

DD-WRT Info.live.htm Information Disclosure

The version of DD-WRT installed on the remote device allows an unauthenticated, remote attacker to retrieve sensitive information about the router itself and any attached hosts, such as geolocation information, IP addresses, MAC addresses and host names, even if remote administration is disabled...

DD-WRT Information Disclosure Vulnerability

Exploit for hardware platform in category remote exploits Author: Craig Heffner, /dev/ttyS0 Software Link: http://www.dd-wrt.com Version: v24-preSP2 Tested on: builds 14311, 14896 Remote attackers can gain sensitive information about a DD-WRT router and internal clients, including IP addresses, M...

DD-WRT 24-preSP2 - Information Disclosure

DD-WRT 24-preSP2 - Information Disclosure Exploit Title: DD-WRT Information Disclosure Vulnerability Date: 26-Dec-2010 Author: Craig Heffner, /dev/ttyS0 Software Link: http://www.dd-wrt.com Version: v24-preSP2 Tested on: builds 14311, 14896 Remote attackers can gain sensitive information about a...

DD-WRT 24-preSP2 - Information Disclosure

Exploit Title: DD-WRT Information Disclosure Vulnerability Date: 26-Dec-2010 Author: Craig Heffner, /dev/ttyS0 Software Link: http://www.dd-wrt.com Version: v24-preSP2 Tested on: builds 14311, 14896 Remote attackers can gain sensitive information about a DD-WRT router and internal clients,...

Fedora Update for bind FEDORA-2010-18521

Check for the Version of bind OpenVAS Vulnerability Test Fedora Update for bind FEDORA-2010-18521 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...

Dutch Teens Arrested for Cyberattacks on Mastercard and Visa

A Dutch hacker collective called Revspace aims to "re-educate" Dutch teens suspected of cyberattacks against Mastercard, Visa, and the Dutch National Prosecutors Office, transforming them into "ethical hackers." Last week, Dutch police arrested a 16-year-old boy for participating in web attacks...

Anonymous Targets WikiLeaks Critics in Operation Payback Campaign

Do you support WikiLeaks? Are you angry at critics trying to suppress it? Maybe you're considering joining online protests to shut down the websites of its opponents. Don't. A group of vigilantes named Anonymous has turned their Operation Payback campaign, previously targeting antipiracy...

[SECURITY] Fedora 14 Update: bind-9.7.2-4.P3.fc14

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

Simpli Easy (AFC Simple) Newsletter <= 4.2 XSS/Information Leakage

Exploit for php platform in category web applications ==================================================================== Simpli Easy AFC Simple Newsletter " method="post" Proof-of-concept: http://www.example.com/cp.php?do="alert1 2. Information Leakage By default, application saves subscribed...