AIX 5.3 TL 7 : at (IZ43454)

The at command does not drop permissions when reading certain files. A local attacker may exploit this error to read any file on the system because the command is setuid root. The following file is vulnerable : /usr/bin/at. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the...

It's Time to Abandon Java

As humans, we have a difficult time letting go of things. Whether it be a favorite pair of jeans, a beloved dog or an old friend who you know is just bringing you down, putting aside things we know well is hard to do. But sometimes things are just too broken to be useful any longer, and that’s th...

Yahoo Mail XSS Vulnerability Could Affect Millions of Accounts

Security researcher Shahin Ramezany developed an XSS proof-of-concept exploit that he claims puts some 400 million Yahoo Mail users at risk of having their accounts taken over. In a video posted on YouTube last night, Ramezanydemonstrated an exploit for what he claims is a document object...

Allied Telesis AT-MCF2000M 3.0.2 - Remote Command Execution

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2013-01-02 Allied Telesis AT-MCF2000M 3.0.2 Gaining Root Shell Access Device: "The AT-MCF2000M is the management module for the...

Allied Telesis AT-MCF2000M 3.0.2 Local Root

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2013-01-02 Allied Telesis AT-MCF2000M 3.0.2 Gaining Root Shell Access Device: "The AT-MCF2000M is the management module for the...

Allied Telesis AT-MCF2000M 3.0.2 Gaining Root Shell Access

Exploit for hardware platform in category remote exploits Allied Telesis AT-MCF2000M 3.0.2 Gaining Root Shell Access Device: "The AT-MCF2000M is the management module for the AT-MCF2000 two-slot chassis. With the AT-MCF2000M management module, if there is a blade failure, insertion or removal, yo...

Allied Telesis AT-MCF2000M 3.0.2 - Remote Command Execution

Allied Telesis AT-MCF2000M 3.0.2 - Remote Command Execution :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2013-01-02 Allied Telesis AT-MCF2000M 3.0.2 Gaining Root Shell Acces...

CVE-2012-3378

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

DEBIAN-CVE-2012-3378

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

Design/Logic Flaw

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

CVE-2012-3378

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

CVE-2012-3378

CVE-2012-3378 affects GNOME at-spi2-atk 2.5.2. The vulnerability lies in the function register_application in atk-adaptor/bridge.c, which does not seed the random number generator, leading to predictable temporary file names. This enables local users to create or truncate files via a symlink atta...

CVE-2012-3378

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

CVE-2012-3378

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

Design/Logic Flaw

The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S stores touch coordinates in the dmesg buffer, which allows remot...

Espejo Design SQL Injection

== ABOUT ME: --- TAURUS OMAR --- INDEPENDENT SECURITY RESEARCHER --- ACCESOILEGAL.BLOGSPOT.COM --- @omartaurus --- omar-taurusatdragonsecuritydotorg --- omar-taurusatlivedotcom === INFO: Author : TAURUS OMAR Category : Webapps / 0day Title Exploit : Espejo Design - SQL Injection Vulnerability...

Cloudflare CEO: AT&T Voicemail Hack Key To Compromise

Loose security protecting voice mailboxes at mobile carrier AT&T provided a key element necessary to successfully hack the Google Enterprise Apps account of tech firm CloudFlare, according to an account of the hack posted by CEO Matthew Prince. Writing on the company’s blog on Monday, Prince said...

httpd: reverse web proxy vulnerability

The modproxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of 1 RewriteRule and 2 ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to...

Anonymous vs Britain's Home Office - Operation Trial At Home

Anonymous vs Britain's Home Office - Operation Trial At Home As announced during last days Anonymous has launched a Distributed Denial of Service DDoS against several UK government websites. A massive recruiting campaign is started on social media, a call to arm to protest the extradition of U.K...

Global Payments Inc. Acknowledges Breach

Following previous announcements from Visa and Mastercard, electronic credit card processor Global Payments Inc. acknowledged late Friday that its system was breached earlier this year. Global Payments announced via press release that a portion of its processing system had been compromised in ear...