AirLive IP Surveillance Camera there is a command injection vulnerability, a large number of products affected-vulnerability warning-the black bar safety net

A large number of AirLive IP Surveillance Camera is exposed there is a command injection vulnerability, an attacker can use this vulnerability to steal user login credentials and control equipment. The vulnerability principle and scope of impact OvisLink company manufactured a large number of...

SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack

A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. This flaw allows a man-in-the-middle MITM attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a...

X (Formerly Twitter): Profile Pic padding (Length-hiding) fails due to use of GZIP

Back in August, I noted that Twitter was appending anywhere from dozens to thousands of junk 0x20 bytes on the end of the JPEG and PNG files they serve for users’ profile images. It was suggested that, though invalid, they were doing this deliberately, as an information-hiding mechanism. The HTTP...

Mozilla Fixes Site Error-Handling Bug

Mozilla has fixed a bug in the way that its Bugzilla Web site and others handled certain errors, which could have been exploited to execute a man-in-the-middle attack against an unsuspecting user. The bug was related to the way that the sites responded to certain requests from client machines whe...

SSL tampering via non-200 responses to proxy CONNECT requests — Mozilla

Microsoft security researchers Shuo Chen, Ziqing Mao, Yi-Min Wang, and Ming Zhang reported that when a CONNECT request is sent to a proxy server and a non-200 response is returned, then the body of the response is incorrectly rendered within the context of the request Host: header. An active...

Symantec Veritas Storage Foundation Scheduler服务绕过认证漏洞

BUGTRAQ ID: 30596 Veritas Storage Foundation是用于管理Veritas产品存储的解决方案。 Veritas Storage Foundation提供了Windows Scheduler服务（VxSchedService.exe）默认在TCP 4888端口上监听来自客户端系统的入站调度信息。由于管理控制台允许NULL NTLMSSP认证，因此网络攻击者可以绕过内嵌的认证直接连接到Scheduler服务套接字，以SYSTEM用户的权限执行任意代码。 Symantec Veritas Storage Foundation for Windows 5.1...