Bruce Schneier on Surveillance and Trust

Dennis Fisher talks with Bruce Schneier about the differences between bulk and targeted surveillance, the most concerning NSA revelations and making surveillance more expensive for intelligence agencies. Download: digitalunderground145.mp3...

CVE-2014-0724

The bulk administration interface in Cisco Unified Communications Manager UCM 10.01 and earlier allows remote attackers to bypass authentication and read arbitrary files by using an unspecified prompt, aka Bug ID CSCum05340...

Cisco Unified Communications Manager Arbitrary File Read Vulnerability

A vulnerability in the bulk administration interface of Cisco Unified Communications Manager UCM could allow an authenticated, remote attacker to read arbitrary files from the underlying file system. The vulnerability is due to insufficient input validation. An attacker could exploit this...

'Our Threat Model Has Changed'

PUNTA CANA–The golden era of bulk surveillance through the acquisition of phone records and other data from telecommunications companies may already be fading, but the larger threat to privacy and security is just beginning to emerge: the use of legal tools and coercion to get around encryption a...

Updated python-oauth2 packages fix CVE-2013-4347

It was found that in python-oauth2, an application for authorization flows for web applications, the nonce value generated isn't sufficiently random. While doing bulk operations the nonce might be repeated, so there is a chance of predictability. This could allow MITM attackers to conduct replay...

[SpearPhisher] A Simple Phishing Email Generation Tool

SpearPhisher is a simple point and click Windows GUI tool designed for mostly non-technical people who would like to supplement the education and awareness aspect of their information security program. Not only is it useful to non-technical folks, penetration testers may find it handy for sending...

DNI Releases FISC Docs, But Legislators Say Much More Remains Hidden

The federal government has released hundreds of pages of documents, including orders and opinions from the secretive Foreign Intelligence Surveillance Court, related to the NSA’s surveillance programs, but legislators who have been involved in the process say that there still are significant...

Force password reset for all users

Administrators should have an easy way to force users to change passwords in bulk format in emergencies. Has this been discussed as a possible feature? Are there drawbacks to having a mass password reset force in administration? Would setting password expiration to 1 day expire all passwords in 2...

Force password reset for all users

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-30236. panel Administrators should have an easy way to force users to change passwords in bulk format in emergencies. Has this...

Surveillance, Legal Access Could Be Weakening Internet Infrastructure

LAS VEGAS–The pervasive bulk surveillance performed by the NSA and other government agencies that’s been revealed in recent weeks relies on court orders, as do other kinds of legal access operations, such as wiretapping or lawful intercepts. Those orders are shrouded in secrecy and the...

Stellar Wind Surveillance program under Obama administration

According to secret documents obtained by the Guardian, Obama administration permitted the National Security Agency to surveillance the Emails and Internet metadata of all Americans. This secret warrant less surveillance program, collectively known by the NSA code name Stellar Wind, was launched ...

Stellar Wind Surveillance program under Obama administration

According to secret documents obtained by the Guardian, Obama administration permitted the National Security Agency to surveillance the Emails and Internet metadata of all Americans. This secret warrant less surveillance program, collectively known by the NSA code name Stellar Wind, was launched ...

CVE-2012-6037

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with "unknown fields," which are not properly handled in error messages in the 1...

CVE-2012-6037

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with "unknown fields," which are not properly handled in error messages in the 1...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with "unknown fields," which are not properly handled in error messages in the 1...

Design/Logic Flaw

Unspecified vulnerability in the Views Bulk Operations module 6 before 6.x-1.10 for Drupal allows remote authenticated users with user management permissions to bypass intended access restrictions and delete anonymous users user 0 via unspecified vectors...

CVE-2010-5277

Unspecified vulnerability in the Views Bulk Operations module 6 before 6.x-1.10 for Drupal allows remote authenticated users with user management permissions to bypass intended access restrictions and delete anonymous users user 0 via unspecified vectors...

CVE-2010-5277

The CVE-2010-5277 issue affects the Drupal module Views Bulk Operations (VBO) for Drupal 6.x prior to 6.x-1.10 . The vulnerability allows remote authenticated users with user management permissions to bypass access restrictions and delete the anonymous user (user 0) via vectors described in the D...

CVE-2012-2057

Cross-site request forgery CSRF vulnerability in the Ubercart Bulk Stock Updater module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors related to formAPI...

CVE-2012-2057

CVE-2012-2057 affects the Ubercart Bulk Stock Updater module for Drupal 6.x (Ubercart 2.x). The vulnerability arises because the module does not properly use the Drupal Form API, enabling a CSRF attack that could allow remote attackers to hijack the authentication of unspecified victims via unkno...