CVE-2009-5085

IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended trust restrictions vi...

sssd security, bug fix, and enhancement update

1.5.1-37 - Reverts: rhbz680443 - Dynamic DNS update fails if multiple servers are - given in ipaserver config option 1.5.1-36 - Resolves: rhbz709333 - sssd. should require sssd-client. 1.5.1-35 - Resolves: rhbz707340 - latest sssd fails if ldapdefaultauthtoktype is - not mentioned - Resolves:...

Check Point多域管理/Provider-1文件覆盖漏洞

CVE ID：CVE-2011-2664 Check Point Provider-1是一款安全管理解决方案，用来满足具有复杂安全策略需求企业的可扩展性要求。 Check Point多域管理/Provider-1存在未明错误，允许攻击者覆盖任意文件或修改SofaWare 管理服务器配置。 Check Point Provider-1 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息：...

An Interview With Telex's J. Alex Halderman

A group of researchers from the University of Michigan and the University of Waterloo have developed a proxy system called Telex that provides a method for users to circumvent state-level censorship of the Web. It uses an architecture that includes a proxy at the ISP level and uses connections to...

CVE-2011-2664

Unspecified vulnerability in Check Point Multi-Domain Management / Provider-1 NGX R65, R70, R71, and R75, and SmartCenter during installation on non-Windows machines, allows local users on the MDS system to overwrite arbitrary files via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in Check Point Multi-Domain Management / Provider-1 NGX R65, R70, R71, and R75, and SmartCenter during installation on non-Windows machines, allows local users on the MDS system to overwrite arbitrary files via unknown vectors...

CVE-2011-2664

CVE-2011-2664 concerns a post-installation/installation-time vulnerability in Check Point’s Multi-Domain Management / Provider-1 and related SmartCenter components. An unprivileged local user can overwrite arbitrary files via a symlink-related weakness in a post-install script used to generate th...

Google Removes .CO.CC Subdomains Over Phishing, Spam Concerns

In a rare and sweeping move, Google has removed all of the sites hosted on .co.cc domains from its search results, saying that because such a large percentage of the sites on that freehosting provider are low-quality or spammy, they decided to de-index all of them. The .co.cc domain is well-known...

UK Serious Organised Crime agency website down after LulzSec Ddos attack

UK Serious Organised Crime agency website down after LulzSec Ddos attack The UK Serious Organised Crime agency has taken its website offline after ddos attack by hacking group Lulz Security. Soca said it had taken its website offline to limit the impact attack on clients hosted by its service...

BrainNET ISP/TV Provider hacked by ProDom Security

BrainNET ISP/TV Provider hacked by ProDom Security ProDom Security Hackers Hacks into Brain.net.pk an ISP/TV Provider . Hacker dump data on free file hosting sites : URL: https://www.multiupload.com/0KWDE7ZJBB . There are 3 file in archive : README = Readme File cracked.txt = Login's Cracked so...

File overwrite vulnerability in Multi-Domain Management / Provider-1 script (CVE-2011-2664)

...

Java HotSpot Cryptographic Provider signature verification vulnerability

An attacker can add a cryptographic provider containing cipher implementation signed by an untrusted certificate. The attacker can also create his or her own jurisdiction policy files signed by an untrusted certificate. In order to achieve this, the attacker must first of all add a fake...

linux-flashplugin -- cross-site scripting vulnerability

Adobe Product Security Incident Response Team reports: An important vulnerability has been identified in Adobe Flash Player 10.3.181.16 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.22 and earlier versions for Android. This universal cross-site...

Fedora 14 : sssd-1.5.7-1.fc14 (2011-5815)

Fri Apr 29 2011 Stephen Gallagher - 1.5.7-1 - Resolves: rhbz700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites - cached password with predicatable filename - Wed Apr 20 2011 Stephen Gallagher - 1.5.6.1-1 - Re-add manpage translations - Wed Apr 20 2011 Stephen Gallagher - 1.5.6-1 - New...

DEBIAN-CVE-2011-1143

epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.4.4 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted .pcap file...

Cross site scripting

The Janrain Engage formerly RPX module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting XSS attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login...

Android Content Provider File Disclosure

This module exploits a cross-domain issue within the Android web browser to exfiltrate files from a vulnerable device. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Android Content Provider...

Common Admission Test (CAT) Site Hacked and this buzz makes IIMs website go offline !

The Indian Institutes of Management on Monday dismantled the web portal of their Common Admission Test CAT amid fears that some students managed to access their results in the 2010 CAT through the website ten days before schedule. The IIMs dismissed speculation that the CAT website "www.catiim.in...

SA-CONTRIB-2010-109 - Embedded Media Field, Media: Video Flotsam, Media: Audio Flotsam - Multiple Vulnerabilities

1 - Arbitrary File Upload/Code Execution Vulnerability The Embedded Thumbnail module packaged with the project allows users who upload videos to upload their own thumbnails to replace The Drupal Embedded Media Field module. Unfortunately, the Embedded Thumbnail Module contains a vulnerability tha...

Indishell.in Locked By Domain Provider on complaint of Government Authorities !

Indishell.in Locked By Domain Provider on complaint of Government Authorities ! Email Send Via Domain Provider to Indishell Owner : On Mon, Dec 6, 2010 at 4:44 PM, [email protected] [email protected] wrote: Hello, Dear Customer . We have Received a Complaint From The Government...