[SECURITY] Fedora 10 Update: python-markdown2-1.0.1.15-1.fc10

Markdown is a text-to-HTML filter; it translates an easy-to-read / easy-to-write structured text format into HTML. Markdown's text format is most similar to that of plain text email, and supports features such as headers, emphasis, code blocks, blockquotes, and links. This is a fast and complete...

Mozilla Releases Preview Builds of Firefox with Content Security Policy

Mozilla has released a preview build of Firefox that includes its new Content Security Policy specification, a framework that’s designed to enable site owners to protect against common Web-based attacks. The CSP specification is Mozilla’s effort to provide Web site operators with a simpler way to...

[SECURITY] Fedora 10 Update: puppet-0.24.8-4.fc10

Puppet lets you centrally manage every important aspect of your system usin g a cross-platform specification language that manages all the separate elements normally aggregated in different files, like users, cron jobs, and hosts, along with obviously discrete elements like packages, services, an...

CVE-2009-3026

protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption an...

Detailed description of SSL and TLS Web Security penetration testing-vulnerability warning-the black bar safety net

If the Web Service of the SSL and TLS Protocol security problem, the consequences will be how? Obviously, in this case the attacker can have all your security information, including user name, passwords, credit card, Bank information...... All in all. This article will give the reader a detailed...

Multiple Browsers - Denial of Service

One bug to rule them all IE5,IE6,IE7,IE8,Netscape,Firefox,Safari,Opera,Konqueror, Seamonkey,Wii,PS3,iPhone,iPod,Nokia,Siemens.... and more. Don't wet your pants - it's DoS only Release mode: Tried hard to coordinate - gave up Reference : GSEC-TZO-26-2009 - One bug to rule them all WWW :...

Apple hires ex-OLPC security architect

Former director of security architecture at One Laptop per Child OLPC Ivan Krstic has joined Apple to help thwart hacker attacks against the Mac operating system. Krstic, a well-respected innovator who designed the Bitfrost security specification for the OLPC initiative, joined Cupertino this wee...

IBM WebSphere Application Server 7.0 < Fix Pack 3 Multiple Vulnerabilities

Binary data 4991.prm...

Mandriva Update for kdetoys MDVA-2008:008 (kdetoys)

Check for the Version of kdetoys OpenVAS Vulnerability Test Mandriva Update for kdetoys MDVA-2008:008 kdetoys Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Mandriva Update for koffice MDKSA-2007:018 (koffice)

Check for the Version of koffice OpenVAS Vulnerability Test Mandriva Update for koffice MDKSA-2007:018 koffice Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Update for kdegraphics MDKSA-2007:024 (kdegraphics)

Check for the Version of kdegraphics OpenVAS Vulnerability Test Mandriva Update for kdegraphics MDKSA-2007:024 kdegraphics Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or...

RedHat Update for libexif RHSA-2007:1166-01

Check for the Version of libexif OpenVAS Vulnerability Test RedHat Update for libexif RHSA-2007:1166-01 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

JOnAS Cross Site Scripting

Digital Security Research Group DSecRG Advisory DSECRG-09-008 ------------------link to original advisory -------------------------- http://www.dsecrg.com/pages/vul/show.php?id=81 Application: JOnAS Java Open Application Server Versions Affected: JOnAS4.10.3 / Apache Tomcat 5.5.26 Vendor URL:...

Constructed of no-man's environment: Exploiting the Realtek RTL8139 single-chip Ethernet Controller-vulnerability warning-the black bar safety net

Author: Azy Finish: 2008-10-22 Excellent rootkit hereinafter abbreviated as rk usually should have hidden a stable communication function. As good programmers have been pursuing with the most simple code to complete the functional requirements of the same, excellent rk coder also has been adherin...

Certain characters can be used to allow cross-site scripting

When accepting HTML content from untrusted users, Web sites sometimes employ some kind of filtering to ensure that the content cannot contain scripts. If the content is to be used inside an HTML attribute, characters that separate attributes need to be filtered out to prevent scripted attributes...

MySQL privilege escalation

It's possible to specify file of different database in CREATE TABLE...

CGIWrap Charset Specification Weakness Error Message XSS

The remote host is running CGIWrap, a wrapper for CGI scripts to provide enhanced security. The version of CGIWrap installed on the remote host does not specify a charset when responses are for error pages. An attacker may be able to leverage this issue to inject arbitrary HTML and script code in...

Multiple XSS vulnerabilities from character encoding — Mozilla

WebKit developer Alexey Proskuryakov reported that the Mozilla HTML parser treated the backspace character as whitespace contrary to the HTML specification and different from other browsers. This difference might lead to Cross-site Scripting XSS risks on sites which filtered input in accordance...

SA-2008-016 - OpenID - Incorrect claimed_id returned for OpenID 2.0

The OpenID module has a vulnerability which allows OpenID version 2.0 positive assertions that are not properly verified to return an invalid or impersonated claimedid. To exploit this vulnerability an attacker could set up an OpenID provider, example1.com, that claimed to be the authority for...

CVE-2007-4595

Cross-site scripting XSS vulnerability in Mayaa before 1.1.12 allows remote attackers to inject arbitrary web script or HTML in certain circumstances involving 1 lack of charset specification within a META element or 2 a META element that specifies an unrecognized charset, which trigger automatic...