FreeBSD : i2p -- Multiple Vulnerabilities (13419364-1685-11e4-bf04-60a44c524f57)

The i2p project reports : XSS and remote execution vulnerabilities reported by Exodus Intelligence. Exodus Intelligence reports : The vulnerability we have found is able to perform remote code execution with a specially crafted payload. This payload can be customized to unmask a user and show the...

TAILS Team Recommends Workarounds for Flaw in I2P

The developers of the TAILS operating system say that users can mitigate the severity of the critical vulnerability researchers discovered in the I2P software that’s bundled with TAILS with a couple of workarounds, but there is no patch for the bug yet. The vulnerability that affects TAILS is in...

i2p -- Multiple Vulnerabilities

The i2p project reports: XSS and remote execution vulnerabilities reported by Exodus Intelligence. Exodus Intelligence reports: The vulnerability we have found is able to perform remote code execution with a specially crafted payload. This payload can be customized to unmask a user and show the...

Researchers Demonstrate Zero-Day Vulnerabilities in Tails Operating System

The critical zero-day security flaws, discovered in the privacy and security dedicated Linux-based Tails operating system by the researcher at Exodus Intelligence that could help attackers or law enforcements to de-anonymize anyone’s identity, actually lie in the I2P software that’s bundled with...

Warning — Zero-Day Vulnerabilities Identified in Tails Operating System

The critical zero-day security flaws has been discovered in the privacy and security dedicated Linux-based operating system “Tails” that could be used by an attacker to unmask your identity. Tails, which is been used and recommended by the global surveillance whistleblower Edward Snowden to remai...

Researchers Plan to Disclose Critical Bugs to TAILS Team Soon

The developers of the TAILS operating system are poised to release a new version of the software–which is designed to preserve privacy and anonymity–and it includes several security fixes. However, there are several other security issues that aren’t patched in the new release, vulnerabilities...

New Variant of Havex Malware Scans for OPC Servers at SCADA Systems

At the beginning of the month, we have reported about the new surge of a Stuxnet-like malware “Havex”, which was previously targeting organizations in the energy sector, had been used to carry out industrial espionage against a number of companies in Europe and compromised over 1,000 European and...

Oracle Business Intelligence Mobile App Designer UIXCacheResourceServlet Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Business Intelligence Mobile App Designer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UIXCacheResourceServlet servlet. The issue lies i...

Crowd-Sourced Threat Intelligence: AlienVault Open Threat Exchange™ (OTX)

For years, the systems and networks that run our businesses have been secured by the efforts of IT and security practitioners acting on their own. We continue to deploy the latest countermeasures, always trying to keep up with adversaries. Criminal attackers, on the other hand, have shared...

DNI, Justice Department Deny Targeting Americans for Surveillance Based on Religion, Politics

The Director of National Intelligence and the Department of Justice have denied a report based on leaked documents from Edward Snowden that United States intelligence and law enforcement agencies conduct surveillance of Americans based on their ethnicity, religious affiliation or political stance...

90 Percent of the Information Intercepted by NSA Belongs to Ordinary Internet Users

If anybody says that NSA is watching you, nobody surprises. But, a large scale investigation published by Washington Post indicates that the scope of surveillance carried out by US National Security Agency was massive even than the expectation of you and me. Just because you are an ordinary perso...

EFF Sues NSA, ODNI Over Zero-Day Disclosure Processes

The Electronic Frontier Foundation wants a peek behind the curtain of the government’s Vulnerabilities Equities Process. The advocacy group on Tuesday filed a Freedom of Information Act FOIA lawsuit against the National Security Agency and the Office of the Director of National Intelligence hopin...

Splunk <= 4.3.3 Arbitrary File Read

No description provided by source. Exploit Title: Splunk = 4.3.3 Reading Arbitrary Files Contents Date: 09/03/2012 Exploit Author: Marcio Almeida [email protected] Vendor Homepage: http://www.splunk.com/ Software Link: http://www.splunk.com/download?r=header Version: 4.3.3 and priors...

Panda Global Protection 2010 local Dos (unfiltered wcscpy())

No description provided by source. include windows.h include string.h include ddk/ntapi.h include tlhelp32.h define SystemModuleInfo 11 / Program : Panda Global Protection 2010 3.01.00 Homepage : http://www.pandasecurity.com Discovery : 2010/04/09 Author Contacted : 2010/07/15 Status of vuln :...

SpagoBI 4.0 - Persistent XSS Vulnerability

No description provided by source. 01. Advisory Information Title: Persistent Cross-Site Scripting XSS in SpagoBI Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE...

ICS Malware Found on Vendors' Update Installers

Malware targeting industrial control systems has infected the update installers belonging to three known industrial control vendors, according to an advisory from the Industrial Control Systems Cyber Emergency Response Team ICS-CERT. The Havex remote access Trojan RAT is targeting vendors via...

New Oil and Natural Gas ONG-ISAC Launches

Energy utilities certainly have not been spared by hackers who for years have targeted vulnerabilities in process control systems and networks with alarming success. In a move to close the gap and keep that corner of the U.S.’ critical infrastructure secure, a new information sharing group popped...

New Data Shows FBI Issued More Than 19k National Security Letters in 2013

The United States federal government issued more than 19,000 National Security Letters–perhaps its most powerful tool for domestic intelligence collection–in 2013, and those NSLs contained more than 38,000 individual requests for information. The new data was released by the Office of the Directo...

Smart Pentester - An SSH based Penetration Testing Framework

Smart Pentester is an SSH based Penetration Testing Framework. It provides a GUI for well known tools like nmap, hping, tcpdump, volatility, hydra and etc. Smart Pentester Framework will provide you a User Interface for Penetration testing, Malware Analysis, Forensic Analysis, Cyber Intelligence,...

Crowdsourcing a Tool for Application Vulnerability Research

Pulling in security help on a project has traditionally meant either hiring more full-time help, or bringing in an outside consultant. Enterprises and vendors alike, however, are starting to really go outside the perimeter these days and are taking advantage of crowdsourcing. Given the paranoia i...