Mozilla: Use-after-free in ListenerManager (MFSA 2013-17)

Use-after-free vulnerability in the ListenerManager implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to...

Mozilla: Compartment mismatch with quickstubs returned values (MFSA 2013-09)

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 do not properly implement quickstubs that use the jsval data type for their return values, which...

Compartment mismatch with quickstubs returned values — Mozilla

Mozilla developer Boris Zbarsky reported reported a problem where jsval-returning quickstubs fail to wrap their return values, causing a compartment mismatch. This mismatch can cause garbage collection to occur incorrectly and lead to a potentially exploitable crash...

AutoWrapperChanger fails to keep objects alive during garbage collection — Mozilla

Mozilla developer Olli Pettay discovered that the AutoWrapperChanger class fails to keep some javascript objects alive during garbage collection. This can lead to an exploitable crash allowing for arbitrary code execution...

FTC Launches Investigations into Mobile Apps for Kids

The Federal Trade Commission on Monday said it’s launching “non-public investigations” to determine if mobile application providers are violating federal laws by collecting information on children without their parents’ permission. A report indicates almost 60 percent 235 of the children-centric...

Windows Gather FileZilla FTP Server Credential Collection

This module will collect credentials from the FileZilla FTP server if installed. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rexml/document' class MetasploitModule 'Windows Gather FileZilla FTP Server...

VMware vCenter Data Collection

Binary data vmwarevcentercollect.nbin...

FreeBSD-SA-12:06.bind

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-12:06.bind Security Advisory The FreeBSD Project Topic: Multiple Denial of Service vulnerabilities with named8 Category: contrib Module: bind Announced: 2012-11-2...

Bulgarian torrent tracker forum hacked and accused of collecting user IP

A Russian hacker going by name - "kOS" hack into the Bulgarian torrent tracker "Arenabg" website https://forum.arenabg.com/ and leak the complete database of their forum and accused of collecting IP of users like PirateBay. Hacker said, "Why I hack this tracker? Because they store IP information...

Alliance Issues Guidance for Cloud-Based SIEM Services

The non-profit Cloud Security Alliance today released guidelines for the nascent Security as a Service SecaaS specialization within the broader realm of cloud computing. The goal, the group says, is to help companies and consumers gain a better handle on how best to evaluate, build and deploy...

Android Adware abusing permissions, Collecting more than they need

So you just bought a new Android-based smartphone, what comes next? What else but the most exciting part downloading the right apps to boost its functionality. Android gives you the freedom to personalize your device, which has made it attractive to those who want their smartphones to be as uniqu...

Gramophone 0.01b1 Cross Site Scripting

Exploit Title: Gramophone v0.01b1 'rs' XSS Date: 10/25/12 Author: G13 Twitter: @g13net Software Site: https://github.com/benbruscella/Gramophone Version: 0.01b1 Category: webapp php ToC 0x01 Description 0x02 XSS 0x03 Vendor Notification 0x01 Description Gramophone is a music system used to catalo...

New Verizon Marketing Initiative May Violate Users' Privacy

Verizon has drawn the ire of its customers and privacy advocates this week because a new initiative launched by the telecom company may violate users’ privacy. A new marketing program dubbed Precision Market Insights extracts information about Verizon’s customers on Android and iOS platforms...

Gathering Threat Intelligence With Open Tools

Threat intelligence is one of the go-to buzz phrases for many people in the security industry right now, and it’s thrown in so many contexts and situations, it’s quickly becoming almost meaningless. Most people understand that they need to get better information about what’s happening both on the...

Universal Man in the Browser Attacks

Researchers have discovered a new type of Man-in-the-Browser MItB attack that is Website independent, and does not target specific Websites, but instead collects data submitted to all sites. Trusteer have discovered a new Man in the Browser MitB scam that can collects data submitted to all websit...

Multi Gather GnuPG Credentials Collection

This module will collect the contents of all users' .gnupg directories on the targeted machine. Password protected secret keyrings can be cracked with John the Ripper JtR. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewo...

Gauss Malware Detection Tool released by Iranian CERT

Iranian National Computer Emergency Response Team releases a tool for Gauss malware detection. Cyber surveillance virus has been found in the Middle East that can spy on banking transactions and steal login and passwords, according Kaspersky Lab, a leading computer security firm. Gauss primarily...

Beijing Huasheng website management system injection vulnerability-vulnerability warning-the black bar safety net

Default background: admin/Login. asp Default password: admin 1 2 3 4 5 6 exp: http://www.xxxxx.com/showpt.asp?id=1568 and 1=2 union select 1,password,3,username,5,6,7,8,9,1 0,1 1,1 2,1 3,1 4,1 5 from admin Note: error will return to the home page. As the field does not, to construct their own it!...

Fedora Update for python-crypto FEDORA-2012-8392

Check for the Version of python-crypto OpenVAS Vulnerability Test Fedora Update for python-crypto FEDORA-2012-8392 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

CVE-2012-1971

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via vectors related to garba...