Unrestricted file upload

Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI aka Magento Mass Importer plugin 0.7.17a and earlier for Magento Community Edition CE allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP fil...

Lame Duck Senate to Vote on NSA Reforming USA FREEDOM Act

The United States Senate will move to vote on the USA FREEDOM Act before the current congressional session closes at the end of the year, a move that pleases digital rights groups. In its current form, the bill would ban the bulk collection of Americans’ private records while granting the...

CVE-2014-8770

Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI aka Magento Mass Importer plugin 0.7.17a and earlier for Magento Community Edition CE allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP fil...

Joomla Community com_comprofiler SQL Injection (CVE-2008-2093)

An SQL injection vulnerability has been reported in Mambo Com ComprofilerMambo Com Comprofiler. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

'The Hacker News' Celebrating its 4th Anniversary

Dear THN Readers, 'The Hacker News' is celebrating its 4th Anniversary today and we would like to thank every single Hacker, Researcher, Journalist, Enthusiast who has contributed to our phenomenal growth. When we began our journey 4 years back as a Small Local Community of few Hackers and Securi...

SEC Consult SA-20140716-0 :: Multiple SSRF vulnerabilities in Alfresco Community Edition

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140716-0 ======================================================================= title: Multiple SSRF vulnerabilities product: Alfresco Community Edition vulnerable version: =4.2.f fixed version: 5.0.a...

Effects full version Windows: iSIGHT surveillance espionage found Windows latest 0day vulnerabilities-vulnerability warning-the black bar safety net

the iSIGHT in Russian cyber-espionage discovered to affect all versions of Windows System with the latest 0day vulnerabilities, vulnerability number CVE-2 0 1 4-4 1 1 4, At present, Microsoft is the emergency of the vulnerability of making the patch. ! Yesterday, Microsoft partners iSIGHT Partner...

CVE-2014-6922

The KFAI Community Radio aka com.skyblue.pra.kfai application 2.0.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6922

The CVE-2014-6922 entry refers to the KFAI Community Radio (Android app, package com.skyblue.pra.kfai) version 2.0.4, which does not verify X.509 certificates when connecting to SSL servers. This behavior enables man-in-the-middle attackers to spoof servers and exfiltrate sensitive information vi...

Design/Logic Flaw

The WebSEAL component in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, when e-community SSO is enabled, allows remote attackers to cause a denial of service component hang via unspecified vectors...

[SECURITY] Fedora 20 Update: tomcat-7.0.52-1.fc20

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

Paypal Inc BB #32 - Multiple Persistent Vulnerabilities

Document Title: =============== Paypal Inc BB 32 - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=716 Release Date: ============= 2014-09-22 Vulnerability Laboratory ID VL-ID: ==================================== 716...

Paypal Inc BB #32 - Multiple Persistent Vulnerabilities

Document Title: =============== Paypal Inc BB 32 - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=716 Release Date: ============= 2014-09-22 Vulnerability Laboratory ID VL-ID: ==================================== 716...

New Initiative Simply Secure Aims to Make Security Tools Easier to Use

The dramatic revelations of large-scale government surveillance and deep penetration of the Internet by intelligence services and other adversaries have increased the interest of the general public in tools such as encryption software, anonymity services and others that previously were mainly of...

Two final thoughts from the PCI Community Meeting

The 2014 North American PCI Community Meeting has drawn to a close, but the messages and lessons learned will continue to resonate with me long after Ive returned home to Denver. There were two messages from the SSC this week that really struck a chord with me and I wanted to expand on why I thin...

CVE-2012-4240

SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

CVE-2012-4240

SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

CVE-2012-4240

Group-Office Calendar SQL Injection (CVE-2012-4240) affects Group-Office community versions prior to 4.0.90. The vulnerability lies in modules/calendar/json.php where the sort parameter is unsafely injected into an ORDER BY SQL clause. An authenticated user can exploit this to cause database erro...

PCI Community Meeting Keynote

Admiral James Stavridis delivered this mornings PCI Community Meeting keynote presentation, Sailing the Cyber Sea: The New Realities of 21st Century Security to an engaged and near-capacity crowd. Admiral Stavridis, a four-star admiral and former NATO Supreme Allied Commander, touched briefly on...

Forensics Session Takeaways from Day 2

Day two of the PCI Community Meeting presented an array of security topics ranging from best practices, EMV, security awareness, and more. I had the pleasure of sitting in on a forensics presentation, which leveraged information from a variety of industry leaders and provided valuable insight int...