3967 matches found
Debian DLA-65-1 : python-django security update
This update address an issue with reverse generating external URLs; a denial of service involving file uploads; a potential session hijacking issue in the remote-user middleware; and a data leak in the administrative interface. http://www.freexian.com/services/debian-lts.html CVE-2014-0480 Django...
SQL Injection Vulnerability in Administrative Service System of Shenzhen Taiji CloudSoft Technology Co.
Shenzhen Taiji Cloud Soft Technology Co., Ltd. administrative service system is a set of administrative departments to provide e-government services platform, the company has developed more than 40 kinds of administrative business comprehensive administrative electronic monitoring; province, city...
Google Apps 'Defect' Leaks Private WHOIS Data Of 280,000
Google has notified hundreds of thousands of domain registrants that their private WHOIS information has been exposed in the clear, opening them up to identity theft, phishing scams and more. Researchers from Cisco Talos last night said the problem likely lies with one of Google’s registrar...
Mac OS X < 10.10.2 Multiple Vulnerabilities
Binary data 8644.prm...
NFL Mobile App Leaks Unencrypted Credentials
Update – As if the National Football League doesn’t have enough to worry about during Super Bowl week with deflated footballs and cheating allegations marring its most important event, a security firm has found a glaring vulnerability in its mobile application. Just in time for the big game, NFL...
用友旗下某服务器日志平台泄露用户隐私及企业数据
简要描述： RT,好在量不大。 详细说明： http://223.203.195.109:8080/log 漏洞证明：...
Lizard Squad vs Anonymous — 'PlayStation, Xbox and Tor Network' Attacks
It was the sad Christmas day for gamers all around the world!! A lot of people get new PlayStations and Xboxes on Christmas, but this Christmas they bought the game, popped it into the console for online gaming, and what they found? Oh Crap! I can't log on. It was the notorious hacker group "Liza...
Anonymous Hacks Swedish Government in Revenge for 'Pirate Bay' Takedown
An online "hacktivist" group that calls itself Anonymous has claimed responsibility for hacking into email accounts of Swedish government in response to the seizure of world renowned The Pirate Bay website and server by Swedish police last week. Apart from Sweden government officials, the Anonymo...
Mozilla Critical Security Update for Firefox Thunderbird ESR
The Mozilla Foundation yesterday released nine security updates fixing as many vulnerabilities in its popular Firefox browser. The fixes address three critical vulnerabilities, and others rated high and moderate. Mozilla issues critical ratings for bugs an attacker can exploit in order to run cod...
F.B.I., Mandiant Investigating Sony Pictures Breach
Sony Pictures Entertainment SPE is continuing to investigate a potentially massive breach that last week compromised most of the company’s systems and leaked several films online, some which haven’t even been released in theaters yet. Officials from the FBI and experts with Mandiant, FireEye’s...
curl: out-of-bounds read
Symeon Paraschoudis discovered that the curleasyduphandle function has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending...
CURL-CVE-2014-3707 duphandle read out of bounds
libcurl's function curleasyduphandle has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending. When doing an HTTP POST transfer with libcurl, you can use the CURLOPTCOPYPOSTFIELDS option to specify a memory area holding the data to send to the...
openstack-cinder: Cinder-volume host data leak to virtual machine instance
The 1 GlusterFS and 2 Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header...
openstack-cinder: Cinder-volume host data leak to virtual machine instance
The 1 GlusterFS and 2 Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header...
openstack-keystone: configuration data information leak through Keystone catalog
A flaw was found in the keystone catalog URL replacement. A user with permissions to register an endpoint could use this flaw to leak configuration data, including the master admintoken. Only keystone setups that allow non-cloud-admin users to create endpoints were affected by this issue...
CVE-2014-7717
The Mills-Hazel Property Mgmt aka com.appexpress.millshazelpropertymanagement application 3.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
chromium: information leak in XSS Auditor fixed in Chrome 38.0.2125.101
The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome before 38.0.2125.101, does not properly provide substitute data for pages blocked by the XSS auditor, which allows remote attackers to obtain sensitive information via a...
The Snappening — Snapchat Hacker Threatens to Leak thousands of Images
The waves of celebrities photos have not yet stopped completely, and a new privacy threat has emerged exposing tens of thousands of private photographs and videos of innocent users are circulating over the Internet. The personal image that are believed to be sent through Snapchat — the ephemeral...
[SECURITY] [DLA 65-1] python-django security update
Package : python-django Version : 1.2.3-3+squeeze11 CVE ID : CVE-2014-0480 CVE-2014-0481 CVE-2014-0482 CVE-2014-0483 This update address an issue with reverse generating external URLs; a denial of service involving file uploads; a potential session hijacking issue in the remote-user middleware; a...