As Defenders Adapt, Offensive Techniques Continue to Evolve

MIAMI BEACH–The security teams that have to defend enterprise networks are faced with a broad and deep threat landscape populated with all manner of malware and targeted attacks. Those teams often have to react quickly to new threats, well before vendors respond with new technologies. By the look...

Design/Logic Flaw

PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames, which has unspecified impact and attack vectors related to "graphical installers for Linux and Mac OS X."...

Design/Logic Flaw

PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scripts related to "graphical installers for Linux and Mac OS X," which has unspecified impact and attack vectors...

Telephony Denial-of-Service Attacks Prompt Federal Attention

The call-center equivalent of network-based denial-of-service attacks, known as telephony denial-of-service TDoS, have targeted emergency services among other industries, enough to garner attention from the Department of Homeland Security, Federal Bureau of Investigation, Federal Communications...

CVE-2013-1083

Unspecified vulnerability in the login functionality in the Reporting Module in Novell Identity Manager aka IDM Roles Based Provisioning Module 4.0.2 before Field Patch C has unknown impact and attack vectors...

Design/Logic Flaw

Unspecified vulnerability in the login functionality in the Reporting Module in Novell Identity Manager aka IDM Roles Based Provisioning Module 4.0.2 before Field Patch C has unknown impact and attack vectors...

CVE-2013-1083

Unspecified vulnerability in the login functionality in the Reporting Module in Novell Identity Manager aka IDM Roles Based Provisioning Module 4.0.2 before Field Patch C has unknown impact and attack vectors...

CVE-2012-0553

Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.28, has unspecified impact and attack vectors, a different vulnerability than CVE-2013-1492...

CVE-2013-1492

Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30, has unspecified impact and attack vectors, a different vulnerability than CVE-2012-0553...

CVE-2012-0553

CVE-2012-0553 describes a buffer overflow in yaSSL used by MySQL 5.1.x (before 5.1.68) and 5.5.x (before 5.5.28); impact and attack vectors are not specified in the description.

CVE-2013-0924

The extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the permissions API is consistent with file permissions, which has unspecified impact and attack vectors...

Code injection

The extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the permissions API is consistent with file permissions, which has unspecified impact and attack vectors...

Design/Logic Flaw

Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs aka APIPermission::kTab permission before providing a URL to this extension, which has unspecified impact and remote attack vectors...

CVE-2013-0924

The extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the permissions API is consistent with file permissions, which has unspecified impact and attack vectors...

CVE-2013-0925

CVE-2013-0925 affects Google Chrome (pre-26.0.1410.43). The issue: a Chrome extension can receive a URL without the extension having Tabs (APIPermission::kTab), implying a potential information leakage risk. The linked OpenVAS/NASL entries reiterate multiple Chrome vulnerabilities from Apr 2013 e...

CVE-2013-0924

Removed by vendor...

CVE-2013-1492

Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30, has unspecified impact and attack vectors, a different vulnerability than CVE-2012-0553...

CVE-2013-0924: Undefined Security Weakness

The extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the permissions API is consistent with file permissions, which has unspecified impact and attack vectors...

Code injection

Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors...

jenkins: cause building jobs without direct access

Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors...