ManageEngine ServiceDesk Plus 8.0 Improper User Privileges

================================================================================ Secur-I Research Group Security Advisory SRG-2011-002 ================================================================================ Title : ManageEngine ServiceDesk Plus Improper User Privileges Management...

Researchers Find Browser History-Sniffing Still Ongoing

The practice of history sniffing, which has been seen as out-of-bounds and a serious privacy violation for the better part of a decade now, is still ongoing by some ad networks, researchers have found. A study completed recently by researchers at Stanford University’s Center for Internet and...

SQL injection in Social Slider

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Social Slider, which can be exploited to perform SQL injection attacks. 1 SQL Injection Vulnerability in Social Slider Input passed via the "rA" POST parameter to /wp-content/plugins/social-slider-2/ajax.php is not properly...

Microsoft Research Team Reports Bugs in Facebook, Google Picasa

Microsoft’s Vulnerability Research team is keeping itself busy finding bugs in other vendors’ products, with the two latest being a vulnerability in Google’s Picasa photo editing and sharing application and a bug in Facebook that could lead to the compromise of a victim’s account. The bug in Pica...

PT-2011-26: Multiple Cross-Site Request Forgery and "Stored XSS" Vulnerabilities in Cisco ACS

Positive Research Center has discovered multiple Cross-Site Request Forgery and "stored XSS" Vulnerabilities in Cisco ACS. Forms do not provide protection against CSRF attacks. One can create a spoofing web form and trick the Cisco ACS administrator into submitting it. If the administrator alread...

Important: Red Hat Security Advisory: JBoss Enterprise Web Platform 5.1.1 update

Updated JBoss Enterprise Web Platform 5.1.1 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS ba...

Important: Red Hat Security Advisory: jboss-seam security update

An updated jboss-seam.jar file for JBoss Enterprise Application Platform 4.3.0.CP09 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System...

Important: Red Hat Security Advisory: jboss-seam2 security update

Updated jboss-seam2 packages that fix one security issue are now available for JBoss Enterprise Application Platform 4.3 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.1 update

JBoss Enterprise Application Platform 5.1.1, which fixes one security issue and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, whi...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.1 update

Updated JBoss Enterprise Application Platform 5.1.1 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.1 update

Updated JBoss Enterprise Application Platform 5.1.1 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

GDI+ - gdiplus.dll CreateDashedPath Integer Overflow

GDI+ - gdiplus.dll CreateDashedPath Integer Overflow Abysssec Research 1 Advisory information Title : GDI+ CreateDashedPath Integer overflow in gdiplus.dll Discovery : Nicolas july from vupen Analysis : Abysssec.com Vendor : http://www.microsoft.com Impact : High Contact : info at abysssec.com...

CVE-2011-0287

Unspecified vulnerability in the BlackBerry Administration API in Research In Motion RIM BlackBerry Enterprise Server BES software 5.0.1 through 5.0.3, and BlackBerry Enterprise Server Express software 5.0.1 through 5.0.3, allows remote attackers to read text files or cause a denial of service vi...

Design/Logic Flaw

Unspecified vulnerability in the BlackBerry Administration API in Research In Motion RIM BlackBerry Enterprise Server BES software 5.0.1 through 5.0.3, and BlackBerry Enterprise Server Express software 5.0.1 through 5.0.3, allows remote attackers to read text files or cause a denial of service vi...

U.S. House Committee Questions Ability to Secure Wall Street Data

Cyber security experts warned on Thursday that the U.S. government is failing to learn the lessons of past computer and intelligence breaches and often exhibits a careless attitude towards securing the data it keeps. The testimony came in a hearing on Thursday before the U.S. House of...

NGS00060 Technical Advisory: Blue Coat BCAAA Remote Code Execution Vulnerability

======= Summary ======= Name: Blue Coat BCAAA Remote Code Execution Vulnerability Release Date: 5 July 2011 Reference: NGS00060 Discoverer: Paul Harrington [email protected] Vendor: Blue Coat Systems Inc Vendor Reference: 2-358686722 Systems Affected: All versions of BCAAA associated...

PT-2011-21: SQL injection vulnerability in OneOrZero AIMS

Positive Research Center has discovered multiply SQL injection vulnerabilities in OneOrZero AIMS. Application incorrectly validates input data. That allows attackers to conduct SQL injection attack. "SQL Injection" is a way to bypass network protection and attack the database. Settings transferre...

IceBB CMS v1.0.x RC10 - SQL Injection Vulnerability

Document Title: =============== IceBB CMS v1.0.x RC10 - SQL Injection Vulnerability Release Date: ============= 2011-07-08 Vulnerability Laboratory ID VL-ID: ==================================== 108 Product & Service Introduction: =============================== IceBB is a powerful, fast, free, a...

Attackers Target PNNL, Force Lab Off the Web

An attack against the Pacific Northwest National Laboratory has forced the lab to shut off access to the Internet, and the lab’s external Web site also is inaccessible right now. The attack on the lab, which conducts national security and cybersecurity research among other things, is the latest i...

NGS00051 Technical Advisory: Cisco VPN Client Privilege Escalation

======= Summary ======= Name: Cisco VPN Client Privilege Escalation Release Date: 28 June 2011 Reference: NGS00051 Discoverer: Gavin Jones [email protected] Vendor: Cisco Vendor Reference: Systems Affected: Cisco VPN client Windows 64 Bit Risk: High Status: Fixed ======== TimeLine =======...