Retail Trade Groups Want Fair Data Breach Reporting Rules

The National Retail Federation and dozens of other related groups cosigned a letter PDF to top congressional leaders last week pleading that they consider the passage of a federal law imposing uniform data breach notification rules that are equally applicable to every organization that handles...

Webfwlog 1.01 - Web-Based Firewall Log Analysis and Reporting

Webfwlog is a flexible web-based firewall log analyzer and reporting tool. It supports standard system logs for linux, FreeBSD, OpenBSD, NetBSD, Solaris, Irix, OS X, etc. as well as Windows XP®. Supported log file formats are netfilter, ipfilter, ipfw, ipchains and Windows XP®. Webfwlog also...

Web Auditing Framework: GoLismero

GoLismero is an open source framework for security testing. It’s currently geared towards web security, but it can easily be expanded to other kinds of scans. Features: Real platform independence. Tested on Windows, Linux, BSD and OS X. No native library dependencies. All of the framework has bee...

F5 Networks BIG-IP : GnuTLS vulnerability (SOL15637)

The gnutlsciphertext2compressed function in lib/gnutlscipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service buffer over-read and crash via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169. C Tenable Network Security, Inc. The...

PT-2014-8762

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.1.x through 4.1.14.6 phpMyAdmin versions 4.2.x through 4.2.11 Description A cross-site scripting XSS issue exists in the error-reporting feature of phpMyAdmin, allowing remote authenticated users to inject arbitrary web...

[SECURITY] Fedora 21 Update: haproxy-1.5.4-1.fc21

HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Indeed, it can: - route HTTP requests depending on statically assigned cookies - spread load among several servers while assuring server persistence through the use of HTTP cookies - switch to...

Veeam ONE 7.0 Patch 2 Release Notes

Challenge Release Notes for Veeam ONE 7.0 Patch 2. Cause Please confirm you are running Veeam ONE 7 or Veeam ONE 7R2 prior to installing this update. You can check this under Help | About in Veeam ONE Monitor Client, the build number should be 7.0.0.xxx. After upgrading, your version build will b...

IBM Rational License Key Server Administration and Reporting Tool 8.1.4.x < 8.1.4.4 Multiple Vulnerabilities

The remote host is running a version 8.1.4.x of IBM Rational License Key Server Administration and Reporting Tool RLKS that is prior to 8.1.4.4. It is, therefore, affected by multiple vulnerabilities : - The secure flag for session cookies is not properly set when in SSL mode. An attacker can...

IBM Rational License Key Server Administration and Reporting Tool Default Credentials

Nessus was able to login to the remote web interface for the IBM Rational License Key Server Administration and Reporting Tool using a default set of known credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

CVE-2014-0909

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

Code injection

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors...

CVE-2014-3079

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to bypass authorization checks and visit unspecified URLs with license-usage data via a DESCRIBE clause in a SPARQL query...

CVE-2014-0909: Exposure of Sensitive Information to an Unauthorized Actor

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2014-3938

Name of the Vulnerable Software and Affected Versions IBM Rational License Key Server versions 8.1.4.x through 8.1.4.3 Description The issue concerns the Administration and Reporting Tool in IBM Rational License Key Server, where the secure flag for the session cookie is not set in an https...

PT-2014-6098

Name of the Vulnerable Software and Affected Versions IBM Rational License Key Server versions 8.1.4.x before 8.1.4.4 Description The issue in the Administration and Reporting Tool allows remote authenticated users to hijack sessions. Recommendations For IBM Rational License Key Server versions...

CVE-2014-4756: Undefined Security Weakness

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors...

CVE-2014-3079: Undefined Security Weakness

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to bypass authorization checks and visit unspecified URLs with license-usage data via a DESCRIBE clause in a SPARQL query...

Syslog LogAnalyzer 3.6.5 - Stored XSS Exploit

Exploit for multiple platform in category web applications Vulnerability title: Syslog LogAnalyzer 3.6.5 Stored XSS Author: Dolev Farhi Contact: dolevf at yahoo dot com @dolevff Application: LogAnalyzer 3.6.5 Date: 8.2.2014 Relevant CVEs: CVE-2014-6070 Vulnerable version: alert"xss", and sending ...

LinSSID - Graphical wireless scanning for Linux (similar to Inssider)

LinSSID is graphically and functionally similar to Inssider Microsoft™ Windows®. It is written in C++ using Linux wireless tools, Qt5, and Qwt 6.1. LinSSID may be installed either by downloading source or binary from this site, or if you're using Debian/Ubuntu or one of its brethren, adding a ppa...

zAnti - Android Penetration Testing Toolkit (Free!)

zANTI is a comprehensive network diagnostics toolkit that enables complex audits and penetration tests at the push of a button. It provides cloud-based reporting that walks you through simple guidelines to ensure network safety. zANTI offers a comprehensive range of fully customizable scans to...