Protection strategies for the Security Advisory 2963983 IE 0day

We’ve received a number of customer inquiries about the workaround steps documented in Security Advisory 2963983 published on Saturday evening. We hope this blog post answers those questions. Steps you can take to stay safe The security advisory lists several options customers can take to stay...

CVE-2012-6646

F-Secure Anti-Virus, Safe Anywhere, and PSB Workstation Security before 11500 for Mac OS X allows local users to disable the Mac OS X firewall via unspecified vectors...

CVE-2012-6646

F-Secure Anti-Virus, Safe Anywhere, and PSB Workstation Security before 11500 for Mac OS X allows local users to disable the Mac OS X firewall via unspecified vectors...

CVE-2012-6646

F‑Secure Anti‑Virus, Safe Anywhere, and PSB Workstation Security for macOS versions prior to 11500 are affected. CVE‑2012‑6646 is described as allowing local users to disable the macOS firewall via unspecified vectors; the connected documents provide product names and a version floor but do not r...

DEBIAN-CVE-2014-0466

The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file...

XDcms Sql Injection 6-10

简要描述： Sql Injection 详细说明： 注入在XDCMS企业管理系统后台的内容编辑处，\system\modules\xdcms\content.php文件： 这次出在编辑处，用到的函数是editsave public function editsave $title=safehtml$POST'title';//第一处注入title字段，safehtml为过滤规则集，可被大写绕过进行注入 $commend=intval$POST'commend'; $username=safehtml$POST'username';//第二处注入username，大写可绕过过滤...

PNG Image Metadata Found Leveraging iFrame Injections

Researchers have discovered a relatively new way to distribute malware that relies on reading JavaScript code stored in an obfuscated PNG file’s metadata to trigger iFrame injections. The technique makes it highly unlikely a virus scanner would catch it because the injection method is so deeply...

[Capstone] Ultimate Disassembly Framework

Capstone is a lightweight multi-platform, multi-architecture disassembly framework. Our target is to make Capstone the ultimate disassembly engine for binary analysis and reversing in the security community. Features Support hardware architectures: ARM, ARM64 aka ARMv8, Mips & X86 more details...

Advisory 01/2013: PHP openssl_x509_parse() Memory Corruption Vulnerability

SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: PHP opensslx509parse Memory Corruption Vulnerability Release Date: 2013/12/13 Last Modified: 2013/12/13 Author: Stefan Esser stefan.esseratsektioneins.de Application: PHP 4.0.6 - PHP 4.4.9 PHP 5.0.x PHP 5.1.x PHP 5.2.x PHP 5.3....

[SECURITY] Fedora 20 Update: python-keyring-3.3-1.fc20

The Python keyring lib provides a easy way to access the system keyring service from python. It can be used in any application that needs safe password storage. The keyring services supported by the Python keyring lib: OSXKeychain: supports the Keychain service in Mac OS X. KDEKWallet: supports t...

[SECURITY] Fedora 19 Update: python-keyring-3.3-1.fc19

The Python keyring lib provides a easy way to access the system keyring service from python. It can be used in any application that needs safe password storage. The keyring services supported by the Python keyring lib: OSXKeychain: supports the Keychain service in Mac OS X. KDEKWallet: supports t...

[Hack PS4] PS4 Jailbreaking (with OrbisOS 0day)

EXPLOIT DETAILS OS: Orbis Console: PlayStation 4 Type: Privilege Escalation/Buffer Overflow allows to run assigned code Created on: 25 November 2013 AUTHOR Name: x-s4nd3r URL: http://twitter.com/xs4nd3r feel free to get him v& FILES: PS4 DevKit: https://depositfiles.com/files/deitivkle Jailbreak...

python-django: xss in is_safe_url function

The issafeurl function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting XSS or other vulnerabilities into Django applications that use this function, a...

Cisco ASA CX Safe Search Policy Bypass Vulnerability

A vulnerability in the Safe Search enforcement component of Cisco ASA CX Context-Aware Security could allow an unauthenticated, remote attacker to bypass security policy enforced by the affected component. The vulnerability is due to improper implementation of the logic that should perform the...

CVE-2013-5561

The Safe Search enforcement feature in Cisco Adaptive Security Appliance ASA CX Context-Aware Security Software does not properly perform filtering, which allows remote attackers to bypass intended policy restrictions via unspecified vectors, aka Bug ID CSCui94622...

Code injection

The Safe Search enforcement feature in Cisco Adaptive Security Appliance ASA CX Context-Aware Security Software does not properly perform filtering, which allows remote attackers to bypass intended policy restrictions via unspecified vectors, aka Bug ID CSCui94622...

CVE-2013-5561

The Safe Search enforcement feature in Cisco Adaptive Security Appliance ASA CX Context-Aware Security Software does not properly perform filtering, which allows remote attackers to bypass intended policy restrictions via unspecified vectors, aka Bug ID CSCui94622...

CVE-2013-5561

Cisco ASA CX Context-Aware Security Safe Search enforcement contains a bypass vulnerability (Bug CSCui94622) that could allow an unauthenticated, remote attacker to bypass security policy via crafted HTTP requests. No software update is available per Cisco advisory Cisco-SA-20131104-CVE-2013-5561...

CVE-2013-2065

1 DL and 2 Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions...

Code injection

1 DL and 2 Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions...