CVE-2012-4599

McAfee SmartFilter Administration, and SmartFilter Administration Bess Edition, before 4.2.1.01 does not require authentication for access to the JBoss Remote Method Invocation RMI interface, which allows remote attackers to execute arbitrary code via a crafted .war file...

CVE-2012-4599: Improper Authentication

McAfee SmartFilter Administration, and SmartFilter Administration Bess Edition, before 4.2.1.01 does not require authentication for access to the JBoss Remote Method Invocation RMI interface, which allows remote attackers to execute arbitrary code via a crafted .war file...

PT-2012-5507

Name of the Vulnerable Software and Affected Versions McAfee SmartFilter Administration versions prior to 4.2.1.01 McAfee SmartFilter Administration Bess Edition versions prior to 4.2.1.01 Description The issue allows remote attackers to execute arbitrary code via a crafted .war file, due to the...

Pakistani hackers deface Indian Southern Railways website

Website of the Southern Railways www.southernrailway.gov.in has been defaced apparently by Pakistani hackers. The hacker group that calls itself 'Pak Cyber Pyrates' replaced the home page of the website with a page with content that denounces India's role in Kashmir. Indian and Pakistani hacking...

Scientific Linux Security Update : tomcat5 on SL5.x i386/x86_64

A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent...

Dark Comet RAT Tailored For Attacks On Gamers, Governments

Researchers analyzing the Dark Comet remote access Trojan RAT program say that data from more than 400 campaigns suggests the malicious program is being used for a wide range of jobs, from attacks on online gamers, to potential hacks of air force bases and government Web sites. In the blog entry,...

CVE-2012-2672

Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function...

DEBIAN-CVE-2012-2672

Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function...

UBUNTU-CVE-2012-2672

Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function...

CVE-2012-2672

Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function...

CVE-2012-2672

Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function...

CVE-2012-2672

Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function...

CVE-2012-2672: Undefined Security Weakness

Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function...

News Roundup: What The Experts Are Saying About The Flame Worm

UPDATE: Are the winds of cyber war blowing, or is the newly discovered Flame worm just a tempest in a teapot? Just days after it was disclosed to the public, the Flame worm is fanning the flames of controversy within the security world. Threatpost takes a look at what people are saying. Calling...

CVE-2012-2561

HP Business Service Management BSM 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component via a crafted request to TCP port 1098, 1099, or 4444...

HP Business Service Management Remote Code Execution

HP Business Service Management BSM 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component via a crafted request to TCP port 1098, 1099, or 4444. Recent assessments: wchen-r7 at Septembe...

PT-2012-4102

Name of the Vulnerable Software and Affected Versions HP Business Service Management BSM version 9.12 Description The issue allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component. This is achieved by uploading crafted .war files due to improper...

Hacktivism - The Hacker News Magazine - May 2012 Issue

Welcome cyber space readers and internet junkies from around the world. May brings us into an in-depth look at our favorite topic: Hacktivism Our fearless leader, Mohit Kumar, founder of The Hacker News opens the discussion with a look at the meaning of Hackitivism and what it means for society...

Oracle GlassFish Server - REST Cross-Site Request Forgery

Details Vendor Site: Oracle www.oracle.com Date: April, 19th 2012 – CVE 2012-0550 Affected Software: Oracle GlassFish Server 3.1.1 build 12 Researcher: Roberto Suggi Liverani PDF version: http://www.security-assessment.com/files/documents/advisory/OracleGlassFishServerRESTCSRF.pdf Description...

Unfixed XSS vulnerability at www.bitgamer.su

Security researcher WaR, has submitted on 04/01/2012 a cross-site-scripting XSS vulnerability affecting www.bitgamer.su, which at the time of submission ranked 30031 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/02/2012. It is currently...