DEBIAN-CVE-2015-8612

The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcphandler argument...

PT-2015-6977

Name of the Vulnerable Software and Affected Versions Oxwall versions prior to 1.8 Description The issue allows remote attackers to hijack the authentication of administrators for requests. This can be achieved through multiple cross-site request forgery CSRF vulnerabilities. Specifically,...

Bash: How to open TCP/UDP sockets

How to open TCP/UDP sockets using a built-in feature in Bash ? Bash shell has a built-in feature that allows to open TCP/UDP sockets using a simple syntax. This is very useful when tools like netcat are not installed or we don’t have the permission to use it. The syntax is $ exec...

CVE-2015-4355

Cross-site request forgery CSRF vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors...

Drupal Corner Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Corner is one of the website modification modules. A cross-site request forgery vulnerability exists in the Drupal Corner module. A remote attacker can exploit this vulnerability to...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Feature Set module for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable or 2 disable a module via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that 1 enable or 2 disable modules or 3 change variables via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable, 2 disable, or 3 delete a report via unspecified vectors...

CVE-2015-3356

Multiple cross-site request forgery CSRF vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that 1 enable or 2 disable modules or 3 change variables via unspecified vectors...

CVE-2015-3374

Multiple cross-site request forgery CSRF vulnerabilities in the Corner module for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable or 2 disable corners via unspecified vectors...

kernel security and bug fix update

kernel 2.6.18-404.0.0.0.1 - net fix tcptrimhead James Li orabug 14512145, 19219078 - ocfs2: dlm: fix recovery hung Junxiao Bi orabug 13956772 - i386: fix MTRR code Zhenzhong Duan orabug 15862649 - oprofile x86, mm: Add getuserpagesfast orabug 14277030 - oprofile export getuserpagesfast function...

openssh security, bug fix and enhancement update

6.6.1p1-11 + 0.9.3-9 - fix direction in CRYPTOSESSION audit message 1171248 6.6.1p1-10 + 0.9.3-9 - add new option GSSAPIEnablek5users and disable using /.k5users by default CVE-2014-9278 1169843 6.6.1p1-9 + 0.9.3-9 - log via monitor in chroots without /dev/log 1083482 6.6.1p1-8 + 0.9.3-9 - increa...

Brocade Enable Login Check Scanner

This module will test a range of Brocade network devices for a privileged logins and report successes. The device authentication mode must be set as 'aaa authentication enable default local'. Telnet authentication, e.g. 'enable telnet authentication', should not be enabled in the device...

CVE-2015-1458

Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcoreenableshellaccess and executing the "shell" command...

win32/7 x64 ultimate Add Admin ALI/ALI & Enable RDP Obfuscated Shellcode - 1218 bytes

Title: Obfuscated Shellcode Windows x64 1218 Bytes Add Administrator User/Pass ALI/ALI & Add ALI to RDP Group & Enable RDP From Registery & STOP Firewall & Auto Start terminal service length: 1218 bytes Date: 13 January 2015 Author: Ali Razmjoo tested On: Windows 7 x64 ultimate WinExec = 0x769e2c...

win32/7 x86 ultimate Add Admin ALI/ALI & Enable RDP Obfuscated Shellcode - 1218 bytes

Title: Obfuscated Shellcode Windows x86 1218 Bytes Add Administrator User/Pass ALI/ALI & Add ALI to RDP Group & Enable RDP From Registery & STOP Firewall & Auto Start terminal service length: 1218 bytes Date: 13 January 2015 Author: Ali Razmjoo tested On: Windows 7 x86 ultimate WinExec = 0x7666e6...

Obfuscated Shellcode Windows x86 - 1218 Bytes Add Administrator User/Pass ALI/ALI & Add ALI To RDP Group & Enable RDP From Registry & STOP Firewall & Auto Start Terminal Service

Obfuscated Shellcode Windows x86 - 1218 Bytes Add Administrator User/Pass ALI/ALI & Add ALI To RDP Group & Enable RDP From Registry & STOP Fire... Author: Ali Razmjoo ​​Title: ​Obfuscated Shellcode Windows x86 1218 Bytes Add Administrator User/Pass ALI/ALI & Add ALI to RDP Group & Enable RDP From...

Twiki Perl 4.x, 5.x, 6.x Upload Bypass / Code Execution Vulnerabilities

The debugenableplugins request parameter in Twiki versions 4.x, 5.x, and 6.0.0 allows arbitrary Perl code execution and suffer from a file upload bypass vulnerability. This is an advisory for TWiki administrators: The debugenableplugins request parameter allows arbitrary Perl code execution...

WordPress Pods Plugin <= 2.4 - Multiple CSRF

Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests that conduct cross-site scripting attacks via the "toggled" parameter in the pods-components page to wp-admin/admin.php, reset pod settings and data via the "podsreset" parameter in the...

Add global option "Enable group <anyone>"

As mentioned in JRA-18076 and JRA-23255, the predefined group anyone poses security risks in many cases as it exposes projects to unauthenticated users. I tend to think that in 90% of Jira instances that group has no use and is just a security risk dangling over our heads. I would suggest an opti...