It's Time to Abandon Java

As humans, we have a difficult time letting go of things. Whether it be a favorite pair of jeans, a beloved dog or an old friend who you know is just bringing you down, putting aside things we know well is hard to do. But sometimes things are just too broken to be useful any longer, and that’s th...

Yahoo Mail XSS Vulnerability Could Affect Millions of Accounts

Security researcher Shahin Ramezany developed an XSS proof-of-concept exploit that he claims puts some 400 million Yahoo Mail users at risk of having their accounts taken over. In a video posted on YouTube last night, Ramezanydemonstrated an exploit for what he claims is a document object...

Allied Telesis AT-MCF2000M 3.0.2 Local Root

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2013-01-02 Allied Telesis AT-MCF2000M 3.0.2 Gaining Root Shell Access Device: "The AT-MCF2000M is the management module for the...

Allied Telesis AT-MCF2000M 3.0.2 Gaining Root Shell Access

Exploit for hardware platform in category remote exploits Allied Telesis AT-MCF2000M 3.0.2 Gaining Root Shell Access Device: "The AT-MCF2000M is the management module for the AT-MCF2000 two-slot chassis. With the AT-MCF2000M management module, if there is a blade failure, insertion or removal, yo...

Allied Telesis AT-MCF2000M 3.0.2 - Remote Command Execution

Allied Telesis AT-MCF2000M 3.0.2 - Remote Command Execution :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2013-01-02 Allied Telesis AT-MCF2000M 3.0.2 Gaining Root Shell Acces...

Allied Telesis AT-MCF2000M 3.0.2 - Remote Command Execution

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2013-01-02 Allied Telesis AT-MCF2000M 3.0.2 Gaining Root Shell Access Device: "The AT-MCF2000M is the management module for the...

DEBIAN-CVE-2012-3378

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

CVE-2012-3378

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

CVE-2012-3378

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

Design/Logic Flaw

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

CVE-2012-3378

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

CVE-2012-3378

Removed by vendor...

CVE-2012-3378

CVE-2012-3378 affects GNOME at-spi2-atk 2.5.2. The vulnerability lies in the function register_application in atk-adaptor/bridge.c, which does not seed the random number generator, leading to predictable temporary file names. This enables local users to create or truncate files via a symlink atta...

CVE-2012-3378

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

CVE-2012-3378: Undefined Security Weakness

The registerapplication function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in...

PT-2012-4673

Name of the Vulnerable Software and Affected Versions GNOME at-spi2-atk version 2.5.2 Description The issue concerns the register application function in atk-adaptor/bridge.c, which does not properly seed the random number generator. This results in the generation of predictable temporary file...

Design/Logic Flaw

The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S stores touch coordinates in the dmesg buffer, which allows remot...

CVE-2012-2980: Undefined Security Weakness

The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S stores touch coordinates in the dmesg buffer, which allows remot...

Espejo Design SQL Injection

== ABOUT ME: --- TAURUS OMAR --- INDEPENDENT SECURITY RESEARCHER --- ACCESOILEGAL.BLOGSPOT.COM --- @omartaurus --- omar-taurusatdragonsecuritydotorg --- omar-taurusatlivedotcom === INFO: Author : TAURUS OMAR Category : Webapps / 0day Title Exploit : Espejo Design - SQL Injection Vulnerability...

Cloudflare CEO: AT&T Voicemail Hack Key To Compromise

Loose security protecting voice mailboxes at mobile carrier AT&T provided a key element necessary to successfully hack the Google Enterprise Apps account of tech firm CloudFlare, according to an account of the hack posted by CEO Matthew Prince. Writing on the company’s blog on Monday, Prince said...