JBoss: authentication bypass when running under JACC with ignoreBaseDecision on JBossWebRealm

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to...

DecisionTools SharpGrid - ActiveX Control Remote Code Execution

Application: DecisionTools SharpGrid ActiveX Control Code Execution Vulnerability Platforms: Windows Secunia: SA48571 Date: 2012-05-09 Author: Francis Provencher Protek Research Lab's Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2 Report Timeline 3 Technical...

Fedora 16 : php-pear-CAS-1.3.0-2.fc16 (2012-4119)

Upstream changelog Changes in version 1.3.0 Bug Fixes : - the saml logout url should be parsed urlencoded 24 dlineate - fix a proxy mode bug introduced in a previous comitt 16 Adam Franco - Fix includepath order so that the phpCAS path takes precedence 13 Adam Franco - fix invalid characters in t...

FBI will Monitor Social Media using Crawl Application

FBI will Monitor Social Media using Crawl Application The Federal Bureau of Investigation is looking for a better way to spy on Facebook and Twitter users. The Bureau is asking companies to build software that can effectively scan social media online for significant words, phrases and behavior so...

The Cloud Security Rules Book - Technology is your friends & Enemy

The Cloud Security Rules Book - Technology is your friends & Enemy Well-known security experts decipher the most challenging aspect of cloud computing-security. The Cloud Security Rules book is available on Amazon.com and selected book stores from October 2011. According to Description available...

Web of Trust (WOT) Wins in Court, Favors freedom of speech

Web of Trust WOT Wins in Court, Favors freedom of speech The world's leading safe surfing tool Web of Trust WOT has won the lawsuit filed against it in the United States. WOT was accused of defamation, violating rights, conspiracy and manipulating algorithms. The court of justice in Florida grant...

UNITED Security Summit 2011, 19-20 September - San Francisco

UNITED Security Summit 2011 , 19-20 September - San Francisco The UNITED Security Summit is focused on innovation and collaboration in the security community. Bringing together security decision makers, practitioners, commercial vendors, open source projects and academia, the Summit highlights...

IT Security Metrics: The Enterprise FUD Killer

One of the greatest knocks on the information security profession is that IT security is always asking for budget to spend against the latest threat, only to abandon the cause like harried firefighters, jumping from one conflagration to the next. Viruses, worms, spam, network access control, data...

Custom fileds inconsistently escaped in view and edit screens

Steps to replicate: Create a custom field and name it Hithere On view issue screens, the field appears as Hithere On edit issue screen, the field appears as Hithere on red font I guess we need to make a decision on which one is the desired functionality allow HTML or not and make it consistent...

Obama is Failing the Cybersecurity Test

That giant sucking sound you hear is the steady stream of talented security people and experienced policy makers getting out of Washington as quickly as possible as the Obama administration continues to be paralyzed by indecision and a lack of direction regarding cybersecurity. The latest chapter...

Hacker Mitnick teaches Social Engineering(social engineering) awareness-vulnerability warning-the black bar safety net

Security adviser as well as the famous hacker Kevin Mitnick noted that the staff be properly trained to be than a technology better able to avoid sensitive information by Social Engineering attack. “People previously used techniques to solve such problems, but Social Engineering can circumvent...

Advisory: WZCS vulnerabilities

Summary "The Wireless Zero Configuration system service enables automatic configuration for IEEE 802.11 wireless adapters for wireless communication." There are two closely related vulnerabilities: Once the "View Available Wireless Networks" dialogue box is opened the Pair-wise Master Keys of the...

A fragmentation attack against IP Filter

I did not want to release this on a Friday afternoon. Happy experimenting -Thomas ---- cut here ---- A fragmentation attack against IP Filter April 6th, 2001 Thomas Lopatic [email protected] The research for this advisory was supported by TUV data protect GmbH, a TUV Rheinland/Berlin-Brandenburg...