Bruce Schneier on Surveillance at Source Boston keynote

BOSTON – History is not entirely kind to those responsible for the Industrial Age in the 19th century. How, for example, were the consequences of industrial innovation such as pollution largely ignored? Flash forward to today’s digital age and ask the same question: How are those responsible for...

Clapper: NSA Queries Databases for Information on U.S. Persons

UPDATE–The NSA searches the data it collects incidentally on Americans, including phone calls and emails, during the course of terrorism investigations. James Clapper, the director of national intelligence, confirmed the searches in a letter to Sen. Ron Wyden, the first time that such actions hav...

Check_MK跨站请求伪造漏洞(CVE-2014-2330)

BUGTRAQ ID:66389 CVE ID:CVE-2014-2330 CheckMK是一款通用的Nagios/Icinga数据采集插件。 CheckMK 1.2.2p2及其他版本在实现上存在跨站请求伪造漏洞，成功利用后可使远程攻击者在受影响浏览器上下文中执行未授权操作。 0 mathias-kettner checkmk 1.2.2p2 目前厂商还没有提供补丁或者升级程序： http://mathias-kettner.de...

Check_MK 多个HTML注入和跨站脚本漏洞(CVE-2014-2329)

BUGTRAQ ID:66391 CVE ID:CVE-2014-2329 CheckMK是一款通用的Nagios/Icinga数据采集插件。 CheckMK 1.2.2p2及其他版本在实现上存在多个HTML注入漏洞和跨站脚本漏洞，成功利用后可使远程攻击者在受影响浏览器上下文中运行上传的HTML和脚本代码。 0 mathias-kettner checkmk 1.2.2p2 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://mathias-kettner.de...

Check_MK 任意文件删除漏洞(CVE-2014-2332)

BUGTRAQ ID:66396 CVE ID:CVE-2014-2332 CheckMK是一款通用的Nagios/Icinga数据采集插件。 CheckMK 1.2.2p2及其他版本在实现上存在任意文件删除漏洞，成功利用后可使远程攻击者删除受影响应用上下文内的任意文件。 0 mathias-kettner checkmk 1.2.2p2 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://mathias-kettner.de...

NSA RETRO Tool Collects Content of Phone Calls

The latest in the slow but steady trickle of leaks dripping out of NSA whistleblower Edward Snowden reportedly shows that the U.S. spying agency has the capacity to recall entire foreign phone call conversations for as long a month after the fact. The program, according to a Washington Post repor...

The NSA, Snowden and the Internet's Offensive Future

Despite everything that has transpired in the last year, Edward Snowden sounded calm, reflective and in some ways wistful yesterday discussing the fallout and consequences of the multitude of NSA programs and methods he’s revealed. Snowden bemoaned the fact that the NSA specifically and the...

MobileIron Data Collection

Binary data mobileironcollect.nbin...

Privacy Groups Seek to Halt Facebook Acquisition of WhatsApp

The appeal of WhatsApp, the cross-platform mobile messaging app recently acquired by Facebook for a stunning $19 billion price tag, was that it kept to its promise of not collecting user information that would be converted to ad revenue. The acquisition by Facebook, however, likely changes that...

SA-CONTRIB-2014-018 - Webform - Cross Site Scripting (XSS)

The Webform module enables you to create forms which can be used for surveys, contact forms or other data collection throughout your site. The module doesn't sufficiently sanitize field label titles when two fields have the same formkey, which can only be managed by carefully crafting the webform...

Congressmen Call For DNI Clapper's Ouster

A group of six Congressmen have asked President Barack Obama to remove James Clapper as director of national intelligence as a result of his misstatements to Congress about the NSA’s dragnet data-collection programs. The group, led by Rep. Darrell Issa R-Calif., said that Clapper’s role as DNI “i...

Crypto Pioneers Write Letter on NSA Surveillance to Obama

Perhaps the biggest condemnation of President Obama’s address last Friday announcing reforms to the NSA’s surveillance programs was his failure to mention any of the agency’s alleged involvement in subverting cryptography standards and the impact that has had on the trustworthiness of products...

SOL14907 - MySQL Server vulnerability CVE-2012-3163

Recommended action To eliminate this vulnerability, upgrade to a version that is listed in the Versions known to be not vulnerable column in the previous table. To mitigate this vulnerability on Enterprise Manager, you should not enable remote access to the statistics database. Remote access to t...

Former NSA Officials Detail Failures of Agency Programs in Letter to Obama

In the weeks and months leading up to 9/11, the National Security Agency had been working on a new information-gathering and analysis system known as THINTHREAD, a system that was built in-house and was meant to replace the uncountable number of stand-alone collection systems and attendant...

LimeSurvey ‘/admin/templates.php’脚本任意文件上传漏洞

LimeSurvey（前称PHPSurveyor）是LimeSurvey团队开发的一套开源的在线问卷调查程序，它支持调查程序开发、调查问卷发布以及数据收集等功能。 LimeSurvey中存在任意文件上传漏洞，该漏洞源于程序没有成充分过滤用户提交的输入。攻击者可利用该漏洞上传任意文件到受影响计算机，导致在受影响应用程序上下文中执行任意代码。 0 LimeSurvey 目前厂商还没有提供此漏洞的相关补丁或者升级程序，建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.limesurvey.org/...

Stanford Researchers Find Connecting Metadata With User Names is Simple

One of the key tenets of the argument that the National Security Agency and some lawmakers have constructed to justify the agency’s collection of phone metadata is that the information it’s collecting, such as phone numbers and length of call, can’t be tied to the callers’ names. However, some...

NSA Must Reform Practices, Organization

A presidentially appointed, five member panel issued a more than 300-page report yesterday calling for nearly 50 recommendations for changes in the way that the National Security Agency conducts its increasingly public and controversial sweeping surveillance programs. The entire report hinges on...

UN Adopts Resolution Protecting Privacy Online

On the same day that a panel of experts delivered a report to the United States president recommending sweeping changes to the way that the National Security Agency collects, handles and stores intelligence, the United Nations unanimously adopted a resolution calling for the protection of users’...

CVE-2013-6359

Munin::Master::Node in Munin before 2.0.18 allows remote attackers to cause a denial of service abort data collection for node via a plugin that uses "multigraph" as a multigraph service name...

Flashlight App Settles with FTC

The makers of a popular Android flashlight application have settled with the Federal Trade Commission over allegations that they covertly tracked the locations of the “Brightest Flashlight Free” users and sold that information to advertising firms. The FTC’s charges stem primarily from the fact...