Atlassian Confluence < 4.3.7 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Confluence on the remote host is a version prior to 4.3.7. It is, therefore, affected by multiple vulnerabilities : - A clickjacking vulnerability exists due to the lack of iframe busting prevention. An attacker may exploit...

European Commission Urges U.S to Reform Surveillance Methods

The European Commission is urging the United States government to make some changes to the way it handles surveillance to help restore the trust in the relationship between the EU and the U.S. The commission is asking for the U.S. to promote privacy rights internationally, adopt the EU’s data...

Yahoo is now offering up to $15,000 in bug bounty after policy review

Offering cash rewards for vulnerability reports has become something of a norm when it comes to big tech companies these days. Yahoo has changed its bug bounty policies following a deluge of negative feedback in the wake of the news that ethical hackers were rewarded with $12.50 in gift vouchers...

Features Gem for Ruby /tmp/out.html Local XSS

Features Gem for Ruby contains a flaw that allows a local cross-site scripting XSS attack. This flaw exists because the application does not validate certain input upon submission to /tmp/out.html. This may allow an attacker to create a specially crafted request that would execute arbitrary scrip...

CVE-2013-3171

The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via 1 a crafted XAML browser application XBAP or 2 a crafted .NET Framework...

Design/Logic Flaw

The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via 1 a crafted XAML browser application XBAP or 2 a crafted .NET Framework...

CVE-2013-3171

The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via 1 a crafted XAML browser application XBAP or 2 a crafted .NET Framework...

Default credentials

IBM XIV Storage System Gen3 before 11.2 relies on a default X.509 v3 certificate for authentication, which allows man-in-the-middle attackers to spoof servers by leveraging an inappropriate certificate-trust relationship...

CVE-2012-4829

IBM XIV Storage System Gen3 before 11.2 relies on a default X.509 v3 certificate for authentication, which allows man-in-the-middle attackers to spoof servers by leveraging an inappropriate certificate-trust relationship...

Veeam Explorer for Microsoft Exchange: Could not establish trust relationship for the SSL/TLS secure channel

Challenge When restoring items with Veeam Explorer for Microsoft Exchange or sending them as attachments, the following error occurs: The request failed. The underlying connection was closed: could not establish trust relationship for the SSL/TLS secure channel Cause There are two possible causes...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Agile PLM for Process component in Oracle Supply Chain Products Suite 5.2.2 and 6.1.0.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Supply Chain Relationship Management...

CVE-2012-3140

Unspecified vulnerability in the Oracle Agile PLM For Process component in Oracle Supply Chain Products Suite 6.0.0.6.3 and 6.1.0.1.14 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Supply Chain Relationship Management...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Agile PLM For Process component in Oracle Supply Chain Products Suite 6.0.0.6.3 and 6.1.0.1.14 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Supply Chain Relationship Management...

Diving Into Flame, Researchers Find A Link To Stuxnet

Researchers digging through the code of the recently discovered Flame worm say they have come across a wealth of evidence that suggests Flame and the now-famous Stuxnet worm share a common origin. Researchers from Kaspersky Lab say that a critical module that the Flame worm used to spread is...

Oracle Outside In OOXML Relationship Tag Parsing Stack Buffer Overflow

A stack buffer overflow vulnerability has been reported in Oracle Outside In...

Direct Manipulation XSS

Ruby on Rails contains a flaw that allows a remote cross-site scripting XSS attack. This flaw exists because the application does not validate direct manipulations of SafeBuffer objects via '' and other methods. This may allow a user to create a specially crafted request that would execute...

XSS via posted select tag options

Ruby on Rails is vulnerable to remote cross-site scripting because the application does not validate manually generated select tag options upon submission to actionpack/lib/actionview/helpers/formoptionshelper.rb. This may allow a user to create a specially crafted request that would execute...

THE "TRUTH" SIMMERS THE POT OF SABU

THE "TRUTH" SIMMERS THE POT OF SABU By: Patti Galle, Editor THN. As I look at my guy fawkes mask and reflect on the recent arrest of several lulzsec members, I have a wrenching feeling in my gut to tell the "truth." Gather around anonymous, lulzsec, FBI, passionate supporters, liberal haters, and...

ZDI-12-017 : Oracle Outside In OOXML Relationship Tag Parsing Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-017 : Oracle Outside In OOXML Relationship Tag Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-017 January 20, 2012 - -- CVE ID: - -- CVSS: 9.7, AV:N/AC:L/Au:N/C:C/I:C/A:P - -- Affected Vendors:...

Failed Accessing Windows Event Log

Challenge SCOM reports a Warning: "Failed Accessing Windows Event Log...". and in the State Change Events description you can find: "The Windows Event Log Provider was unable to open the nworksEventLog event log on computer 'nodexxx' for reading. The provider will retry opening the log every 30...