Mozilla Working on More "Attack Aware" Applications

Mozilla is working on making their web applications more “attack aware,” according to a blog post on the company’s Web Application Security blog Wednesday. In the blog post, Mozilla’s web security nomad Michael Coates, discusses how these “attack aware” applications will be able to differentiate...

kernel security and bug fix update

2.6.18-194.8.1.0.1.el5 - xen check to see if hypervisor supports memory reservation change Chuck Anderson orabug 7556514 - Add entropy support to igb John Sobecki orabug 7607479 - nfs convert ENETUNREACH to ENOTCONN orabug 7689332 - NET Add xen pv/bonding netconsole support Tina Yang orabug 69930...

BtiTracker 1.3.x / 1.4.x SQL Injection

!/usr/bin/env python xpl0it /\ \ /\ \ /\ \ //\ / \ ,\L\ /\ \ ,\ \ \ \ /' /\ \ /'\ /'/\ /\ /'/\ \ \ / /\ /\ \ \ /\ /\ /\ \L\ /\ //\ /\ \ \ \ \ / \ \ \ \ \ \ \ \ /\ \ \ \ \ \\ /\ \ \ \ \/ \ //////////// // // //// // \ // www.insecurity.ro // BtiTracker...

Cisco Secure Desktop 3.x - translation Cross-Site Scripting

Cisco Secure Desktop 3.x - translation Cross-Site Scripting source: https://www.securityfocus.com/bid/37960/info Cisco Secure Desktop is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrar...

New Attack Locates Web Users Via XSS, Google Data

The security researcher who created the MySpace XSS worm in 2005 has developed a technique that enables an attacker to accurately locate a Web user with GPS coordinates, without using IP-based geolocation. Samy Kamkar, the author of the infamous Samy worm that spread through MySpace, on Monday...

kernel security update

CentOS Errata and Security Advisory CESA-2009:1670 Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages...

Allow issue security level to use any custom field that implements UserCFNotificationTypeAware

It would be useful to be able to set the security level on an issue to include everyone who participated on an issue so if you had a security level that was only the reporter and the assignee, if the issue needs to get reassigned the issue could still be seen by the original assignee. The JIRA...

Toward Privacy-Aware OpenSocial Applications

Kun Liu from IBM Research discusses the potential for developing privacy-aware social networking applications through the measurement and monitoring of privacy risks...

Firefox browser engine crashes

The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via vectors related to 1...

PHP 5.2.6 - error_log Safe_mode Bypass

PHP 5.2.6 - errorlog Safemode Bypass SecurityReason.com PHP 5.2.6 errorlog safemode bypass Author: Maksymilian Arciemowicz cXIb8O3 securityreason.com Date: - - Written: 10.11.2008 - - Public: 20.11.2008 SecurityReason Research SecurityAlert Id: 57 CWE: CWE-264 SecurityRisk: Medium Affected...

Low: Red Hat Security Advisory: nss_ldap security and bug fix update

An updated nssldap package that fixes a security issue and several bugs is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The nssldap package contains the nssldap and pamldap modules. The nssldap module is a plug-in which allows...

Debian Security Advisory DSA 342-1 (mozart)

The remote host is missing an update to mozart announced via advisory DSA 342-1. OpenVAS Vulnerability Test $Id: deb3421.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 342-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Mandrake Linux Security Advisory : krb5 (MDKSA-2006:139)

A flaw was discovered in some bundled Kerberos-aware packages that would fail to check the results of the setuid call. This call can fail in some circumstances on the Linux 2.6 kernel if certain user limits are reached, which could be abused by a local attacker to get the applications to continue...

Evince Document Viewer (DocumentMedia) Buffer Overflow Exploit

No description provided by source. / Creator: K-sPecial xzziroz.net of .aware awarenetwork.org Name: evince-ps-field-bof.c Date: 11/27/2006 Version: 1.00 - creation Other: this idea originaly came from the bid for the 'gv' buffer overflow 20978, i don't believe it's known until now that evince is...

Preemptive Protection agains Apple Open Directory Denial of Service Vulnerability

The OpenLDAP software allows LDAP-aware programs on a network to get information from a server. Apple uses OpenLDAP as a part of their Open Directory product. An error in the implementation of OpenLDAP may allow a remote attacker with the ability to send a malformed LDAP request to cause Open...

CVE-2003-0538

The mailcap file for mozart 1.2.5 and earlier causes Oz applications to be passed to the Oz interpreter, which allows remote attackers to execute arbitrary Oz programs in a MIME-aware client program...

CVE-2003-0538

The mailcap configuration in mozart 1.2.5 and earlier causes Oz applications to be passed to the Oz interpreter, allowing remote attackers to execute arbitrary Oz programs in a MIME-aware client. Impact is arbitrary code execution under the user running the MIME client; affected: mozart with mail...

Critical: Red Hat Security Advisory: : Updated Kerberos 5 packages available

Updated Kerberos 5 packages are now available for Red Hat Linux 6.2, 7, and 7.1. These updates close a potential vulnerability present in the gssapi-aware ftpd included in the krb5-workstation package. By use of a carefully-crafted authentication request, a malicious client could exploit a...

Concerning the LDAP Enabled Netscape FTP Server

Over the last few days a great number of people have mailed us in regards to the "Netscape Professional Services FTP Server Vulnerability" http://www.securityfocus.com/bid/1375 discovered by Michal Zalewski [email protected] and posted to the Bugtraq mailing list on Wed, 21 Jun 2000. The following...