Internet Explorer zero-day exploit used watering hole attacks to target Japanese users

Attackers exploiting a zero-day vulnerability CVE-2013-3893 in Microsoft’s Internet Explorer browser and served them on compromised popular Japanese news websites. According to FireEye, at least three major Japanese media websites were compromised in watering hole attacks, dubbed Operation...

CVE-2013-5129

CVE-2013-5129 affects WebKit in Apple iOS prior to 7. It describes two user-assisted XSS vectors: (1) drag-and-drop and (2) copy-and-paste, allowing an attacker to inject arbitrary script/HTML via data handled by WebKit. The vulnerability arises from how WebKit processes dragged/pasted content an...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : libvirt vulnerabilities (USN-1954-1)

It was discovered that libvirt used the pkcheck tool in an unsafe manner. A local attacker could possibly use this flaw to bypass polkit authentication. In Ubuntu, libvirt polkit authentication is not enabled by default. CVE-2013-4311 It was discovered that libvirt incorrectly handled certain...

Kernel: fanotify: info leak in copy_event_to_user

The filleventmetadata function in fs/notify/fanotify/fanotifyuser.c in the Linux kernel through 3.9.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a read operation on the fanotify descriptor...

19-year-old Argentine Hacker arrested for stealing $50,000 monthly

Argentinian police have arrested a 19-year-old "superhacker" who was making $50,000 a month, working from his bedroom in Buenos Aires, by targeting international money transfer and gambling websites. Police say it took them a year to close in on the teenager, who was part of a six-strong gang whi...

FBI compromised Tor hidden service to bust largest Child Pornography Ring

A few days before the servers of the largest provider of Ultra Anonymous hosting were found to be serving custom malware designed to identify visitors who were using the Tor service to hide their identity online. The javascript code exploited a security vulnerability in the open-source version of...

IBM Security AppScan Enterprise 弱密码安全绕过漏洞(CVE-2013-0531)

BUGTRAQ ID: 62179 CVECAN ID: CVE-2013-0531 IBM Securityl AppScan Enterprise 是一个基于Web 的多用户Web 应用程序安全解决方案，提供集中的安全性扫描、数据合并和报告、补救功能、执行仪表板等功能 IBM Security AppScan Enterprise 即之前的IBM Rational AppScan Enterprise 支持使用弱加密算法的SSL套件，攻击者无需本地网络访问及身份验证，即可利用此漏洞解密客户端和服务器之间的通讯，或在客户端上执行中间人攻击，从而获取敏感信息，执行未授权操作 0 IBM...

North Korea Spying on South Korea Using Espionage Malware

For the time being, things on the Korean peninsula may have quieted down politically and militarily. But hackers on both sides continue to take shots at each other. The latest salvo appears to be coming from North Korea, which has been conducting an extensive espionage campaign against specific...

CVE-2013-4283

ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service server crash via a crafted Distinguished Name DN in a MOD operation request...

CVE-2013-4283

ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service server crash via a crafted Distinguished Name DN in a MOD operation request...

DEBIAN-CVE-2013-4283

ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service server crash via a crafted Distinguished Name DN in a MOD operation request...

UBUNTU-CVE-2013-4283

ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service server crash via a crafted Distinguished Name DN in a MOD operation request...

CVE-2013-4283

CVE-2013-4283 affects ns-slapd in 389 Directory Server prior to 1.3.0.8, enabling a remote attacker to crash the server via a crafted DN in a MOD operation. The vulnerability is confirmed by OpenVAS/Open Vulnerability references; remediation is to apply the vendor/security updates that include 38...

CVE-2013-4283

ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service server crash via a crafted Distinguished Name DN in a MOD operation request...

CVE-2013-4702

Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SCApiOperation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitrary files via vectors involving a 1 Operation, 2 Service, 3 Style, 4 Validate, or 5 Version value...

[Hidden File Finder v2.5] Tool to Find and Unhide/Remove all the Hidden Files

Hidden File Finder is the free software to quickly scan and discover all the Hidden files on your Windows system. It performs swift multi threaded scan of all the folders parallely and quickly uncovers all the hidden files. It automatically detects the Hidden Executable Files EXE, DLL, COM etc an...

Important: Red Hat Security Advisory: 389-ds-base security update

Updated 389-ds-base packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

389-ds-base: ns-slapd crash due to bogus DN

ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service server crash via a crafted Distinguished Name DN in a MOD operation request...

CVE-2013-4247

Off-by-one error in the builduncpathtoroot function in fs/cifs/connect.c in the Linux kernel before 3.9.6 allows remote attackers to cause a denial of service memory corruption and system crash via a DFS share mount operation that triggers use of an unexpected DFS referral name length...

Design/Logic Flaw

The OSIsoft PI Interface for IEEE C37.118 before 1.0.6.158 allows remote attackers to cause a denial of service instance shutdown and data-collection outage via crafted C37.118 configuration packets that trigger an invalid read operation...