Code injection

The U.S. Defense Information Systems Agency DISA Security Readiness Review SRR script for the Solaris x86 platform executes files in arbitrary directories as root for filenames equal to 1 java, 2 openssl, 3 php, 4 snort, 5 tshark, 6 vncserver, or 7 wireshark, which allows local users to gain...

CVE-2009-4211

The U.S. Defense Information Systems Agency DISA Security Readiness Review SRR script for the Solaris x86 platform executes files in arbitrary directories as root for filenames equal to 1 java, 2 openssl, 3 php, 4 snort, 5 tshark, 6 vncserver, or 7 wireshark, which allows local users to gain...

U.S. Defense Information Systems Agency (DISA) Unix Security Readiness Review (SRR) root compromise / VU#433821

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Executive Summary - ----------------- Unprivileged local users can obtain root access on Unix systems where the DISA SRR scripts are run. If a remote user can introduce a file into the filesystem e.g. anonymous ftp, http upload, cdrom, samba share,...

CVE-2009-4211: Undefined Security Weakness

The U.S. Defense Information Systems Agency DISA Security Readiness Review SRR script for the Solaris x86 platform executes files in arbitrary directories as root for filenames equal to 1 java, 2 openssl, 3 php, 4 snort, 5 tshark, 6 vncserver, or 7 wireshark, which allows local users to gain...

Congress Calls for Internal Security Review

After a former Congressional staffer exposed some sensitive data on a file-sharing network recently, some lawmakers are calling for the Congress to start an internal review of its own data security policies immediately. The situation, which is linked to an ethics investigation in the House of...

Microsoft Blames Human Error For Critical SMB2 Vulnerability

Microsoft is blaming human error for the the critical SMB v2 vulnerability that exposed Windows users to remote code execution attacks and argues that it’s near impossible to catch these types of bugs with existing code review tools and techniques. According to a post-mortem of the issue by Redmo...

Unfixed XSS vulnerability at www.rawandwild.com

Security researcher jath, has submitted on 22/09/2009 a cross-site-scripting XSS vulnerability affecting www.rawandwild.com, which at the time of submission ranked 6827275 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/11/2011. It is...

Hathaway Resigns as Federal Cybersecurity Adviser

Melissa Hathaway has left her post as the country’s top cybersecurity adviser, casting even more doubt on who will take the open job of cybersecurity coordinator created by President Obama in May. Hathaway said she is resigning for personal reasons and has no interest in the coordinator job,...

[InterN0T] transLucid 1.75 - Multiple Vulnerabilities

transLucid - Cross Site Scripting and HTML Injection Vulnerabilities Version Affected: 1.75 newest Info: transLucidonline is the easy website publishing system with which anyone can create and maintain web content, in multiple languages and based on a growing list of ready-made, professional...

Translucid 1.75 XSS / HTML Injection

transLucid - Cross Site Scripting and HTML Injection Vulnerabilities Version Affected: 1.75 newest Info: transLucidonline is the easy website publishing system with which anyone can create and maintain web content, in multiple languages and based on a growing list of ready-made, professional...

Pivot 1.40.4-7 Multiple Remote Vulnerabilities

No description provided by source. Pivot - XSS and HTML Injection Vulnerabilities Versions Affected: 1.40.4 and 1.40.7 22nd March 2009 newest Info: Pivot is a web-based tool to help you maintain dynamic sites, like weblogs or online journals. Pivot is released under the GPL so it is completely fr...

Unfixed XSS vulnerability at www.washingtonchinareview.org

Security researcher Xylitol, has submitted on 06/10/2009 a cross-site-scripting XSS vulnerability affecting www.washingtonchinareview.org, which at the time of submission ranked 12424883 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/06/201...

Crypto flaws becoming a killer for Web applications

One of the few things that most people in the security community seem to agree on is that there is a dire need for better security around Web applications. That need begins with the lack of security training for most Web developers and extends through the inconsistent use of Web-application...

Cybersecurity czar position, 60-day review report coming this week

From The Washington Post Ellen Nakashima The Obama administration is set to announce the creation of a new high-level position to run the cybersecurity program for the country. The announcement is expected on Friday, along with the release of the report on the administration’s 60-day review of th...

Counterpoint: The need for a cybersecurity czar is real

As everyone prepares to examine the results of the Obama Administration’s cyber-security review, one of the largest issues in play remains to what extent the White House will embrace recommendations to create a Cabinet-level position to address the matter or some role superior to today’s “cyber...

Few details likely at RSA on Obama's cybersecurity review

One of the more widely anticipated keynotes at the RSA Conference this week is the talk by Melissa Hathaway, who was in charge of the Obama administration’s recently completed review of the country’s information security standing. However it now looks unlikely that Hathaway will actually reveal a...

Pentagon spent $100 million on cybersecurity fixes

From Cnet Elinor Mills The security of U.S. networks is in such disarray that the Pentagon has spent $100 million in the last six months alone to repair damage done by cyber attacks. That huge number presumably includes cleaning up after external attacks, viruses and internal problems. Experts sa...

CVE-2009-0706

SQL injection vulnerability in the Simple Review comsimplereview component 1.3.5 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the category parameter to index.php...

Sql injection

SQL injection vulnerability in the Simple Review comsimplereview component 1.3.5 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the category parameter to index.php...

CVE-2009-0706

The CVE-2009-0706 issue affects the Simple Review (com_simple_review) Joomla!/Mambo component (1.3.5). The root cause is an SQL injection in the category parameter sent to index.php, enabling remote attackers to execute arbitrary SQL commands. The vulnerability is rated HIGH (CVSS v2 base 7.5). E...