PYSEC-2012-17

Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library...

NO BOOT FOR YOU ! Will Windows 8 Kill Live CDs and USBs?

In January 2012, Microsoft confirmed to PC manufacturers that they must enable Secure Boot by default on PCs to be "Certified for Windows 8". The purpose of Secure Boot is to put an end to computer viruses that sneak between the hardware and the operating system. These viruses, also known as...

phpmoneybooks 1.03 Stored XSS

Exploit for php platform in category web applications Exploit Title: phpmoneybooks 1.03 Stored XSS Date: Jun 28, 2012 Exploit Author: chap0 - chap0.blogspot.com - @chap0 Vendor Homepage: http://phpmoneybooks.com/ Software Link:...

PHP Money Books 1.03 Stored Cross Site Scripting

Exploit Title: phpmoneybooks 1.03 Stored XSS Date: Jun 28, 2012 Exploit Author: chap0 - chap0.blogspot.com - @chap0 Vendor Homepage: http://phpmoneybooks.com/ Software Link: http://sourceforge.net/projects/phpmoneybooks/files/phpMoneyBooks103.zip/download Version: 1.03 Patch: Upgrade to 1.04 Vend...

Pastebin Censored ! Anonymous launches AnonPaste - Uncensored

Pastebin Censored ! Anonymous launches AnonPaste - Uncensored Anonymous and the People's Liberation Front have launched a "totally secure and safe alternative" to Pastebin, the site used by the hacktivist collective to dump data recovered from hacks. AnonPaste for people to post uncensored...

New Android Malware Variant Can Remotely Root Phone

A new version of Android malware has been tweaked so it doesn’t require user interaction for an attacker to own the device, according to research published by Lookout Mobile Security yesterday. An updated variant of the Legacy Native LeNa malware utilizes the GingerBreak exploit to gain root...

New TGLoader Android Malware Found in Alternative Markets

Alternative mobile app markets have become a great place to find new games, utilities and other apps. But mostly they’re great if you’re looking for the latest stealthy Android malware. The newest example is a piece of malware called TGLoader that is showing up in repackaged legitimate apps and h...

11in1 Cross Site Request Forgery and Local File Include Vulnerabilities

11in1 is prone to a cross-site request-forgery and a local file include vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...

Performing an AIR restore without Enterprise Manager

Purpose You wish to perform an AIR Exchange, Active Directory, or SQL item restore, but do not have Enterprise Manager installed. Solution To perform an AIR restore without Enterprise Manager, run the SureBackup job created for the restore. Once it is running and complete, open the session and...

http-proxy-brute NSE Script

Performs brute force password guessing against HTTP proxy servers. Script Arguments http-proxy-brute.url sets an alternative URL to use when brute forcing default: http-proxy-brute.method changes the HTTP method to use when performing brute force guessing default: HEAD creds.service, creds.global...

Bypass SOPA (Stop Online Piracy Act) DNS Blocking with DeSopa 1.1

Bypass SOPA Stop Online Piracy Act DNS Blocking with DeSopa 1.1 A developer who calls himself T Rizk doesn't have much faith in Congress making the right decision on anti-piracy legislation, so he's built a work around for the impending censorship measures being considered DeSOPA. The Firefox...

Ubuntu: Security Advisory (USN-1238-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-3872

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise PE Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof ...

NetSupport Client Handshake Hostname Overflow

Added: 10/11/2011 CVE: CVE-2011-0404 BID: 45728 OSVDB: 70408 Background NetSupport Manager is a remote desktop support solution. Problem The NetSupport client/server communication is carried out over a proprietary communications protocol. This protocol begins with a handshake between the client a...

[SECURITY] Fedora 15 Update: apache-commons-daemon-1.0.7-1.fc15

The scope of this package is to define an API in line with the current Java Platform APIs to support an alternative invocation mechanism which could be used instead of the public static void mainString method. This specification covers the behavior and life cycle of what we define as Java daemons...

The rlogin service is running

This remote host is running a rlogin service. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Anonymous leaks Nimbuzz data for collusion with pro-censorship governments

Anonymous leaks Nimbuzz data for collusion with pro-censorship governments Anonymous Hackers leaks Nimbuzz data via the twitter account of AnonymousIRC which included a link to their latest leak from Nimbuzz . About thirty minutes later, that twitter account posted a link for download named...

Fedora Update for rssh FEDORA-2011-7272

Check for the Version of rssh OpenVAS Vulnerability Test Fedora Update for rssh FEDORA-2011-7272 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

[SECURITY] Fedora 13 Update: rssh-2.3.3-1.fc13

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. For example, if you have a server which you only want to allow users to copy files off of via scp, without providing shell access, you can use rssh to do that. It is a alternative to scponly...

[SECURITY] Fedora 14 Update: rssh-2.3.3-1.fc14

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. For example, if you have a server which you only want to allow users to copy files off of via scp, without providing shell access, you can use rssh to do that. It is a alternative to scponly...