CVE-2011-3337

eEye Audit ID 2499 in eEye Digital Security Audits 2406 through 2423 for eEye Retina Network Security Scanner on HP-UX, IRIX, and Solaris allows local users to gain privileges via a Trojan horse gauntlet program in an arbitrary directory under /usr/local/...

Cyber Security Fraud in the Banking Industry: Lessons Learned in OCC Examiner Training

In late October 2011, Coalfire participated in a day of IT audit training with about 35 bank examiners. As you would expect, we covered a lot of previously hot topics. The conversation changed as we started talking about the amount of fraud being realized by community banks and credit unions...

EU Audit Forces Changes To Facebook Privacy Policies

An audit of Facebook’s operations by the Office of the Data Protection Commissioner in Ireland will result in major changes to the way the social networking giant manages user data. The 143 page report, issued on Wednesday, calls on Facebook to give users more control over how their personal...

Homeland Security Warns SCADA Operators Of Internet-Facing Systems

In the wake of the hack of water and sewer infrastructure operated by a Texas community, the Department of Homeland Security is again warning owners and operators of critical infrastructure to take note of SCADA and industrial control systems that may be accessible from the Internet. DHS’s...

HP Facing Class Action Suit For Not Disclosing Printer Vulnerability

A class action lawsuit filed in U.S. District Court in California against Hewlett-Packard could have wide ranging implications for software makers, should the court agree with the plaintiff’s claim that the company violated the state’s consumer protection laws by failing to disclose a serious...

Zeema CMS Cross Site Scripting / Path Disclosure

Hello list! I want to warn you about Brute Force, Cross-Site Scripting and Full path disclosure vulnerabilities in Zeema CMS. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are all versions of Zeema CMS. ---------- Details:...

Issue key can be enumerated - Resolve Issue Feature

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that the application is succeptible to horizontal privilege elevation attacks within the Resolve Issue feature, accessible through the given address:...

CGI Generic Cross-Site Request Forgery Detection (potential)

Nessus has found HTML forms on the remote web server. Some CGI scripts do not appear to be protected by random tokens, a common anti-cross-site request forgery XSRF protection. The web application might be vulnerable to XSRF attacks. Note that : - Nessus did not exploit the flaw. - Nessus cannot...

Oracle Database Multiple Vulnerabilities (April 2008 CPU)

The remote Oracle database server is missing the April 2008 Critical Patch Update CPU and therefore is potentially affected by security issues in the following components : - Advanced Queuing - Audit - Authentication - Change Data Capture - Core RDBMS - Data Pump - Export - Oracle Enterprise...

IRS Security Deficiencies May Put Taxpayer Data At Risk

Information security failings are making it impossible for the U.S. Internal Revenue Service IRS to get its financial house in order and could be putting taxpayers’ sensitive information at risk, according to a financial audit of the agency by the Government Accountability Office GAO. Deficiencie...

[CAL-2011-0052]Adobe Shockwave Player Director File Parsing PAMM memory corruption vulnerability

CAL-2011-0052Adobe Shockwave Player Director File Parsing PAMM memory corruption vulnerability CAL ID: CAL-2011-0052 CVE ID: CVE-2011-2446 Discover: instruder of code audit labs of vulnhunt.com http://www.adobe.com/support/security/bulletins/apsb11-27.html 1 Affected Products ================= Te...

[CAL-2011-0054]Adobe Shockwave Player Director File Parsing data of rcsl chunk multiple DOS vulnerabilities

CAL-2011-0054Adobe Shockwave Player Director File Parsing data of rcsl chunk multiple DOS vulnerabilities CALID: CAL-2011-0054 CVE ID: CVE-2011-2448 Discover: instruder of code audit labs of vulnhunt.com http://www.adobe.com/support/security/bulletins/apsb11-27.html 1 Affected Products...

eEye Retina audit script could execute untrusted programs as root

Overview eEye Retina audit scripts have the capability to run remote shell scripts in order to determine vulnerable applications. One audit script in particular audit ID 2499 uses find1 and execute -exec when assessing a vulnerability within Gauntlet Firewall. An attacker who can write an...

Insider Threats vs Hackers - by Emmett Jorgensen

Insider Threats vs Hackers - by Emmett Jorgensen Emmett Jorgensen has worked in IT and Infosec for over 10 years. He works for Kanguru Solutions www.kanguru.com, a manufacturer of secure portable storage solutions. Article taken from 'The Hacker News' Magazine - October Edition. You can Download...

Another Dutch CA, KPN, Stops Issuing Certificates After Finding DDoS Tool On Server

Another Dutch certificate authority, KPN, has stopped issuing digital certificates after finding attack tools on a server in its Web infrastructures. The CA said that while it doesn’t have evidence right now that it’s CA infrastructure was compromised, it is taking the actions as a precaution. Th...

Government's Cloud Audit Program Falls Behind Schedule

In a speech on Wednesday, Federal Chief Information Officer Steven VanRoekel said that a federal plan for qualifying and providing security audits on private sector cloud providers will become mandatory for any agency that wanted to contact with third party cloud providers, according to a report ...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation. The krb5ldaplockoutaudit function in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.8 through 1.8.4 and 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denia...

DEBIAN-CVE-2011-1528

The krb5ldaplockoutaudit function in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.8 through 1.8.4 and 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service assertion failure and daemon exit via unspecified vectors, related to the...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation. The krb5db2lockoutaudit function in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.8 through 1.8.4, when the db2 aka Berkeley DB back end is used, allows remote attackers to cause a denial of...

Lilith: Perl script to audit web applications

Lilith: Perl script to audit web applications Lilith tool analyses webpages and looks for htmltags , which often refer to dynamic pages that might be subject to SQL injection or other flaws.Lilith basic function is to spider and analyses pages, following hyperlinks, injecting special characters...