Fedora 20 : qt3-3.3.8b-56.fc20 (2013-22847)

This update fixes CVE-2013-4549 XML Entity Expansion Denial of Service in Qt 3. See the Qt Project Security Advisory for details: http://lists.qt-project.org/pipermail/announce/2013-December/000036.ht ml In addition, this update fixes : - QTBUG-35459, a too low character limit for XML entities...

Fedora 19 : qt3-3.3.8b-56.fc19 (2013-22883)

This update fixes CVE-2013-4549 XML Entity Expansion Denial of Service in Qt 3. See the Qt Project Security Advisory for details: http://lists.qt-project.org/pipermail/announce/2013-December/000036.ht ml In addition, this update fixes : - QTBUG-35459, a too low character limit for XML entities...

URL Redirector Abuse and XSS vulnerabilities in WordPress

Hello 3APA3A! As I've announced earlier http://seclists.org/fulldisclosure/2013/Nov/219, I conducted a Day of bugs in WordPress 3. At 30.11.2013 I disclosed many new vulnerabilities in WordPress. I've disclosed 10 holes they were placed at my site for your attention. And this is translation of th...

[DAVOSET] Tool for conducting DDoS attacks

DAVOSET – it is console command line tool for conducting DDoS attacks on the sites via Abuse of Functionality vulnerabilities at other sites. Changelog v1.1.5 Added error handler in GetCookie. Added new services into lists of zombies. Removed non-working services from lists of zombies. Usage 1...

Abusing Network Time Protocol (NTP) to perform massive Reflection DDoS attack

In 2013, we have seen a significant increase in the use of a specific distributed denial of service DDoS methodology known as Distributed Reflection Denial of Service attacks DrDoS. Open and misconfigured DNS Domain Name System can be used by anyone to resolve domain names to IP addresses are...

UBUNTU-CVE-2013-4522

lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy...

Microsoft and Google Collaborate on Effort to Clean Web of Cild Abuse Images

Microsoft and Google are cooperating in an effort to make it much more difficult for child predators to find illegal images online by blocking search results for about 100,000 search terms. The companies also are collaborating on methods to better identify illegal abuse images and remove them mor...

CVE-2013-5598

PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object...

Multiple vulnerabilities in RokStories for WordPress

Hello 3APA3A! I want to warn you about multiple vulnerabilities in plugin RokStories for WordPress. In August 2012 I wrote about multiple vulnerabilities in RokBox for WordPress http://securityvulns.ru/docs28871.html. These vulnerabilities are similar, since the same developers put the same...

Multiple vulnerabilities in RokMicroNews for WordPress

Hello 3APA3A! I want to warn you about multiple vulnerabilities in plugin RokMicroNews for WordPress. In August 2012 I wrote about multiple vulnerabilities in RokBox for WordPress http://securityvulns.ru/docs28871.html. These vulnerabilities are similar, since the same developers put the same...

Multiple vulnerabilities in RokMicroNews for WordPress

Hello 3APA3A! I want to warn you about multiple vulnerabilities in plugin RokMicroNews for WordPress. In August 2012 I wrote about multiple vulnerabilities in RokBox for WordPress http://securityvulns.ru/docs28871.html. These vulnerabilities are similar, since the same developers put the same...

Multiple vulnerabilities in RokNewsPager for WordPress

Hello 3APA3A! I want to warn you about multiple vulnerabilities in plugin RokNewsPager for WordPress. In August 2012 I wrote about multiple vulnerabilities in RokBox for WordPress http://securityvulns.ru/docs28871.html. These vulnerabilities are similar, since the same developers put the same...

Multiple vulnerabilities in RokIntroScroller for WordPress

Hello 3APA3A! I want to warn you about multiple vulnerabilities in plugin RokIntroScroller for WordPress. In August 2012 I wrote about multiple vulnerabilities in RokBox for WordPress http://securityvulns.ru/docs28871.html. These vulnerabilities are similar, since the same developers put the same...

WordPress RokIntroScroller 1.8 XSS / DoS / Disclosure / Upload

Hello list! I want to warn you about multiple vulnerabilities in plugin RokIntroScroller for WordPress. In August 2012 I wrote about multiple vulnerabilities in RokBox for WordPress http://securityvulns.ru/docs28871.html. These vulnerabilities are similar, since the same developers put the same...

OTRS < 2.3.2 Restriction Bypass Vulnerability

Open Ticket Request System OTRS is prone to a restriction bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress RokNewsPager 1.17 Disclosure / Shell Upload / XSS / DoS

Hello list! I want to warn you about multiple vulnerabilities in plugin RokNewsPager for WordPress. In August 2012 I wrote about multiple vulnerabilities in RokBox for WordPress http://securityvulns.ru/docs28871.html. These vulnerabilities are similar, since the same developers put the same...

Pinterest Exploit exposes user information of 70 Million accounts

Security researcher Dan Melamed has found a serious Pinterest Exploit that exposed user's information of over 70 Million accounts. The security researcher Dan Melamed has found a Critical Pinterest Exploit that compromised the privacy of over 70 Million Users, the flaw allows hackers to view the...

Twitter Account 'Classifier' Detects Fraudulent Accounts

Fraudulent Twitter accounts are a booming business, accounting for significant underground money for spammers, fake antivirus scams, drive-by downloads and phishing schemes. But research presented at USENIX yesterday proposes a means for driving up the cost for attackers to get these campaigns of...

Weaknesses in CFAA language exposed at Black Hat

The Computer Fraud and Abuse Act CFAA can be unsettling even to the most stalwart security researcher. The law, enacted in 1986 and revisited several times since, is still littered with loopholes and nuances that can be leveraged by a prosecutor in a criminal case, or turned against a white hat i...

Solaris Recommended Patch Cluster 6/19 (x86) - Local Privilege Escalation

Solaris Recommended Patch Cluster 6/19 local root on x86 Larry W. Cashdollar 7/3/2013 @larry0 If the system administrator is updating the system using update manager or smpatch multi user mode a local user could execute commands as root. This only affects x86 systems as this code resides under a...