Senate Listens to Data Breach Testimony

The Senate Subcommittee on Consumer Protection, Product Safety, and Insurance heard testimony on from several witnesses yesterday regarding the proposed national data breach legislation, including Maneesha Mithal of the Federal Trade Commission FTC and Mark Bregman, CTO of Symantec. Read the full...

SA-CONTRIB-2010-027: Email Input Filter - Arbitrary code execution

Email Input Filter converts email style markup into web friendly format. Arbitrary code execution vulnerability in this module allows a remote attacker with the ability to create content using an input format with the email input filter enabled to execute arbitrary PHP code on an affected system...

AST-2010-003: Invalid parsing of ACL rules can compromise security

Asterisk Project Security Advisory - AST-2010-003 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | Invalid parsing of ACL rules can compromise | | | security |...

Weatherford, Kaminsky: Top 2010 Security Issues

Mark Weatherford, CISO for California, and Dan Kaminsky, finder of last year’s DNS flaw, offer five security predictions for 2010. Read the full article. CSO...

Apache module mod_rewrite LDAP protocol Buffer Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Apache modul...

Stable Update: Fix Google Chrome not Starting

Google Chrome's Stable channel has been updated to 3.0.195.33 to fix a potential issue that could cause Google Chrome to stop working and a security issue. This release removes a dependency on a Windows library t2embed.dll that is not required by Google Chrome. If that library is missing or the...

[SECURITY] [DSA 1923-1] New libhtml-parser-perl packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA-1923-1 [email protected] http://www.debian.org/security/ Nico Golde October 27th, 2009 http://www.debian.org/security/faq -...

SA-CONTRIB-2009-085 - Insert Node - Cross Site Scripting

The Insert Node module provides an input filter that enables a node to be inserted within the body field of another node. The module fails to sanitize the inserted node, making it vulnerable to a cross site scripting XSS attack. Versions affected Insert Node module versions for Drupal 5.x prior t...

[SECURITY] Fedora 10 Update: planet-2.0-10.fc10

Planet is a flexible feed aggregator, this means that it downloads feeds and aggregates their content together into a single combined feed with the latest news first. It uses Mark Pilgrim's Ultra-liberal feed parser so can read from RDF, RSS and Atom feeds and Tomas Styblo's template library to...

[SECURITY] Fedora 11 Update: planet-2.0-10.fc11

Planet is a flexible feed aggregator, this means that it downloads feeds and aggregates their content together into a single combined feed with the latest news first. It uses Mark Pilgrim's Ultra-liberal feed parser so can read from RDF, RSS and Atom feeds and Tomas Styblo's template library to...

DEBIAN-CVE-2008-3075

The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" exclamation point shell metacharacter in 1 the filename of a ZIP archive and possibly 2 the filename of the first file in a ZIP archive, which is not properly...

plugin: improper Implementation of shellescape() (arbitrary code execution)

The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" exclamation point shell metacharacter in 1 the filename of a ZIP archive and possibly 2 the filename of the first file in a ZIP archive, which is not properly...

Mozilla BOM characters stripped from JavaScript before execution

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via byte order mark BOM characters that are removed from JavaScript code before...

CVE-2008-4065

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via byte order mark BOM characters that are removed from JavaScript code before...

CVE-2008-4065: Improper Neutralization of Input During Web Page Generation

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via byte order mark BOM characters that are removed from JavaScript code before...

SA-2008-051 - Mailsave - Cross site scripting

Mailsave is a module that is designed to interact with mailhandler. It will detach files that are emailed to the site and save them with the node. The module trusts the mimetype that is send with the file enabling malicious users with the ability to upload files to execute cross site scripting...

RedDot CMS 7.5 (LngId) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/env python un-comment your selection. import urllib2 import urllib import string import getopt import sys def banner: print print "RED DOT CMS 7.5 database enumeration" print "by Mark Crowther and Rodrigo Marcos" def usage: print print "usage:" print...

Unfixed XSS vulnerability at critical-security.pastebin.org

Security researcher Mark, has submitted on 13/02/2008 a cross-site-scripting XSS vulnerability affecting critical-security.pastebin.org, which at the time of submission ranked 662286 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 19/03/2008. I...

Debian Security Advisory DSA 257-1 (sendmail)

The remote host is missing an update to sendmail announced via advisory DSA 257-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 5.04 / 5.10 / 6.06 LTS : openssh vulnerabilities (USN-355-1)

Tavis Ormandy discovered that the SSH daemon did not properly handle authentication packets with duplicated blocks. By sending specially crafted packets, a remote attacker could exploit this to cause the ssh daemon to drain all available CPU resources until the login grace time expired...