Access Control Security Bypass Vulnerability in Interstage Application Server

Overview Interstage Application Server has an access control security bypass vulnerability which could allow an attacker to access and execute a request from the IP address that should be denied. Impact A remote attacker could access and execute a request from the IP address that should be denied...

Design/Logic Flaw

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count, which allows remote authenticated users to cause a denial of service IP address exhaustion by making invalid attempts to establish sessions with the same VPN ID from multiple...

CVE-2010-4593

The CVE-2010-4593 issue affects IBM Lotus Mobile Connect connections manager prior to version 6.1.4. It stems from improper maintenance of a reference count, enabling remote authenticated users to trigger a denial of service (IP address exhaustion) by issuing invalid session attempts using the sa...

CVE-2010-4593

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count, which allows remote authenticated users to cause a denial of service IP address exhaustion by making invalid attempts to establish sessions with the same VPN ID from multiple...

CVE-2010-0039

The Application-Level Gateway ALG on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in incoming FTP traffic, which allows remote attackers to use the device's IP address for arbitrary intranet TCP traffic by...

CVE-2010-0039

The Application-Level Gateway ALG on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in incoming FTP traffic, which allows remote attackers to use the device's IP address for arbitrary intranet TCP traffic by...

DSA-2136-1 tor - potential code execution

Bulletin has no description...

Hacking Tool Used By Anonymous Could Reveal Users Identity

A new study finds that a tool used to carry out distributed denial of service DDoS attacks on behalf of whistle blower Web site Wikileaks may, itself, leak the identity of those running the software. Researchers from the University of Twente, Netherlands, looked at the Low Orbit Ion Cannon LOIC, ...

Second Dutch Teen Arrested Over Pro-WikiLeaks Cyber Attacks

Police in the Netherlands have arrested a second teenager in connection with the pro-WikiLeaks distributed denial-of-service DDoS attacks seen earlier this week. The arrest of the 19-year-old man follows Friday's attacks on websites belonging to the Dutch Police and the national prosecutor's...

Attacks Drive South Korea to Install DDoS Bunkers

In hopes of combating ongoing distributed-denial-of-service DDoS attacks, South Korea recently erected digital “bunkers” throughout their networks, according to a post on ZDNet’s Australian site. Created to help smaller businesses too poor to defend themselves, the “bunkers” are providing tempora...

Code injection

CFNetwork in Apple Mac OS X 10.6.x before 10.6.5 does not properly validate the domains of cookies, which makes it easier for remote web servers to track users by setting a cookie that is associated with a partial IP address...

Low: Red Hat Security Advisory: nss security update

Updated nss packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fr...

Exposing SCADA Systems With Shodan

Editor’s Note: The U.S.’s Industrial Control System Computer Emergency Response Team ICS-CERT recently issued a warning to its members about the ability of attackers to discover ICS systems using a simple search on Shodan, a public search engine that is used to locate systems accessible from the...

69.69.247.90 Server Rooted By "Rat Techie"

Finally 69.69.247.90 Server Rooted By "Rat Techie" There are 100's of sites on the server, some of them are ... answerjeffersoncity.com apoplew.com apsemo.org bgcjeffersoncity.org bisgeslaw.com bluegrassmartins.com bookandtoy.net bookrak.com cabllc.com call-sti.com callstihelp.com capitaldiesel.c...

BSA-009 Security Update for nss

Alexander Reichle-Schmehl uploaded new packages for nss which fixed the following security problems: CVE-2010-3170 NSS recognizes a wildcard IP address in the subjects Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a...

Simpli Easy Newsletter 4.2 Cross Site Scripting

Simpli Easy AFC Simple Newsletter " method="post" Proof-of-concept: http://www.example.com/cp.php?do="alert1 2. Information Leakage By default, application saves subscribed email addresses and correspondent IP addresses to plain text file el.txt Proof-of-concept: http://www.example.com/el.txt...

Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) Policy Bypass

, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Oracle JRE - java.net.URLConnection class – Same-of-Origin SOP Policy Bypass PDF: http://www.security-assessment.com/files/advisories/OracleJREjavaneturlconnectionSOPBypass.pdf CVE...

CVE-2010-3170

Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 recognize a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL serve...

Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS / 10.10 : nss vulnerabilities (USN-1007-1)

Richard Moore discovered that NSS would sometimes incorrectly match an SSL certificate which had a Common Name that used a wildcard followed by a partial IP address. While it is very unlikely that a Certificate Authority would issue such a certificate, if an attacker were able to perform a...

Oracle JRE - java.net.URLConnection class Same-of-Origin SOP Policy Bypass

Oracle JRE - java.net.URLConnection class Same-of-Origin SOP Policy Bypass Description Security-Assessment.com discovered that a Java Applet making use of java.net.URLConnection class can be used to bypass same-of-origin SOP policy and domain based security controls in modern browsers when...