PT-2012-6222

Name of the Vulnerable Software and Affected Versions Xen versions 4.0 through 4.2 Description The issue allows local guest OS users to cause a denial of service, resulting in a CPU hang and host crash. This is related to a spinlock being held in the "bad copy error path" of the do tmem get...

PT-2012-6224

Name of the Vulnerable Software and Affected Versions Xen versions 4.0 through 4.2 Description The issue is related to the do tmem control function in the Transcendent Memory TMEM component, which does not properly check privileges. This allows local guest OS users to access control stack...

Google Implements Do Not Track in Chrome 23

Nearly two years after other browser vendors implemented it, Google on Tuesday finally released a version of Chrome that supports the Do Not Track functionality that helps users prevent Web sites from following their movements around the Web. Google’s move to include the technology is a response ...

Chrome 23 Released, 14 vulnerabilities patched

Google today released Chrome version 23 to the Stable Channel. 23.0.1271.64 for Windows, Mac, Linux, and Chrome Frame. Update includes patch for 12 vulnerabilities in the Windows version and two vulnerabilities in Mac OS X version. Chrome 23 is the support of the Do Not Track DNT protocol, number...

ManageEngine OpStor availability730.do days Parameter XSS

The remote ManageEngine OpStor install is affected by a cross-site scripting vulnerability. The application does not properly sanitize the 'days' parameter on the 'availability730.do' script. A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL...

Calling Foul on the Political Football That is Do Not Track

It looks like it’s time for a do-over for DNT. The oft-maligned specification has become—like many other standards efforts before it—a political football. Parties with interests on both sides of the issue have their own agendas, cannot agree on semantics and ignore, in this case, what should be t...

PT-2012-5924

Name of the Vulnerable Software and Affected Versions Shortcode Redirect plugin versions 1.0.01 and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the scr do redirect function. These vulnerabilities allow remote authenticated users with certain...

PT-2012-3374

Name of the Vulnerable Software and Affected Versions NextBBS version 0.6 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the do parameter to index.php. Recommendations For NextBBS version 0.6, update to...

CVE-2012-1604: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in NextBBS 0.6 allows remote attackers to inject arbitrary web script or HTML via the do parameter to index.php...

First Signs of Google's Do Not Track Feature Begin to Surface on Chrome

Google Chrome is indeed getting a Do Not Track DNT feature according to source code published in the developer’s release of the browser at the end of last week. The feature should clear Google’s dev and beta channels before making its way into the next stable build of the browser before the end o...

Apache Blocks IE 10 Do Not Track Privacy Setting

The co-founder of the Apache HTTP Server Project is under fire for a patch that instructs the world’s most popular Web server to ignore the Do Not Track privacy setting enabled by default in Internet Explorer 10. Do Not Track is a specification under consideration by the W3C and under development...

PT-2012-5640

Name of the Vulnerable Software and Affected Versions ManageEngine Firewall Analyzer version 7.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the url parameter in the fw/index2.do endpoint. This is a different attack...

CVE-2012-4891: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vector than CVE-2012-4889. NOTE: the provenance of this information is unknown; the details are obtained...

PT-2012-5638

Name of the Vulnerable Software and Affected Versions ManageEngine Firewall Analyzer version 7.2 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved by manipulating specific parameters ...

UBUNTU-CVE-2012-3420

Multiple memory leaks in Performance Co-Pilot PCP before 3.6.5 allow remote attackers to cause a denial of service memory consumption or daemon crash via a large number of PDUs with 1 a crafted context number to the DoFetch function in pmcd/src/dofetch.c or 2 a negative type value to the pmGetPDU...

Adobe Flash Player 11.3 Font Parsing Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 "Adobe Flash Player 11.3 Font Parsing...

Google Settles With FTC Over Tracking Cookies, Pays $22.5M Fine

Google has agreed to pay a $22.5 million fine to the Federal Trade Commission to settle charges that the company set tracking cookies on the machines of Safari users, after saying that it would not use such tracking measures or serve targeted ads to the users. The FTC investigation began after a...

Senate Committee to Discuss Do Not Track at Key Hearing

The dram surrounding the Do Not Track specification and its implementation by browser manufacturers is set to continue on Thursday when the Senate Commerce Committee will hold a hearing to discuss whether the proposed specification is strong enough or has been weakened by the digital advertising...

PT-2012-4586

Name of the Vulnerable Software and Affected Versions web@all versions prior to the version downloaded on May 30, 2012 Description The issue allows remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information. This can be...

EU Officials, Privacy Agencies Attempt to Clarify Cookie Rules

Officials in Europe this week are hoping to set clearer rules for online advertisers with new guidelines that are supported by the continent’s leading digital privacy agencies. According to a report from the Wall Street Journal, agencies from the European Union’s EU member countries met last week...