FBI compromised Tor hidden service to bust largest Child Pornography Ring

A few days before the servers of the largest provider of Ultra Anonymous hosting were found to be serving custom malware designed to identify visitors who were using the Tor service to hide their identity online. The javascript code exploited a security vulnerability in the open-source version of...

FBI Used Firefox Exploit to Shutdown Illegal Site Running on Tor Network

TOR is the dark side of the Internet, the so-called dark web, which provides a safe haven to privacy advocates but is also where drugs, assassins for hire and other weird and illegal activities can allegedly be traded. A claimed zero-day vulnerability in Firefox 17 was used by the FBI to identify...

EFF, Eclectic Group of Organizations Sue NSA Over Data Collection

If politics makes strange bedfellows, as the saying goes, wholesale government surveillance takes that to an entirely new level. The clearest evidence yet of the broad and diverse set of groups opposed to the NSA’s domestic spying programs came Tuesday when the EFF said that is representing a...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2010)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2010 advisory. - block check for proper length of iov entries earlier in blkrqmapuseriov Xiaotian Feng CVE-2010-4668 - scm: lower SCMMAXFD Eric Dumazet...

Suit Filed Against NSA, Obama Over Surveillance Program

A group of people, including a former federal prosecutor and the parents of a Navy SEAL sniper killed in action, have filed a class-action law suit against the National Security Agency, Verizon and President Obama over the NSA’s collection of cell phone data. The suit says the order that enabled...

Multiple MySQL database Zero-day vulnerabilities published

Researcher discovered Multiple Zero-day vulnerabilities in MySQL database software including Stack based buffer overrun, Heap Based Overrun, Privilege Elevation, Denial of Service and Remote Preauth User Enumeration. Common Vulnerabilities and Exposures CVE assigned as : CVE-2012-5611 — MySQL Lin...

Egallery Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Hacker wanted by FBI held in India For Carding Crimes

Nikhil Kolbekar, aka HellsAngel, was arrested on July 11 in Mumbai, India. Eric Bogle, known as Swat Runs Train, and Justin Mills, or xTGxKAKAROT, were taken into custody in Canada, respectively Colorado, US. HellsAngel and Bogle is suspected of selling complete credit card details, including...

firewall-bypass NSE Script

Detects a vulnerability in netfilter and other firewalls that use helpers to dynamically open ports for protocols such as ftp and sip. The script works by spoofing a packet from the target server asking for opening a related connection to a target port which will be fulfilled by the firewall...

Horde 3.3.12 Backdoor Arbitrary PHP Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Horde 3.3.12...

Ubuntu: Security Advisory (USN-1203-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 10.10 : linux-mvl-dove vulnerabilities (USN-1208-1)

Dan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. CVE-2010-4076, CVE-2010-4077 Alex Shi and Eric Dumazet discovered that the network stack...

South Park: Apple's Tracking Me, Dude!

Apple may be trying to change the spin on its controversial location tracking, err…harvesting feature. The company issued a FAQ this week and pulled CEO Steve Jobs off of medical leave to argue the company’s case and quell concerns about the little known feature that include calls for an...

Eric Cooperation Server Detection

The remote host is running an Eric cooperation server. Eric is a Python IDE. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; ifdescription scriptid52974; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

Pligg 1.1.2 Blind SQL Injection and XSS Vulnerabilities

Exploit for php platform in category web applications Credit: Michael Brooks Special thanks to Eric Heikkinen for patching these quickly. Blind SQL Injection http://host/pligg1.1.2/search.php?adv=1&status= 'and+sleep9or+sleep9or+1%3D' &search=on&advancesearch= Search...

Pligg CMS 1.1.2 - Blind SQL Injection / Cross-Site Scripting

Credit: Michael Brooks Special thanks to Eric Heikkinen for patching these quickly. Blind SQL Injection http://host/pligg1.1.2/search.php?adv=1&status= 'and+sleep9or+sleep9or+1%3D' &search=on&advancesearch= Search +&sgroup=on&stags=0&slink=on&scategory=on&scomments=0&suser=0 XSS:...

Pligg CMS 1.1.2 - Blind SQL Injection Cross-Site Scripting

Pligg CMS 1.1.2 - Blind SQL Injection Cross-Site Scripting Credit: Michael Brooks Special thanks to Eric Heikkinen for patching these quickly. Blind SQL Injection http://host/pligg1.1.2/search.php?adv=1&status= 'and+sleep9or+sleep9or+1%3D' &search=on&advancesearch= Search...

PGP Desktop unsigned data injection vulnerability

Overview PGP Desktop 10.0.3 and earlier versions as well as 10.1.0 are vulnerable to an unsigned data injection attack. PGP Command Line versions 9.6 and greater are not affected by this vulnerability. Description The PGP Desktop user interface incorrectly displays messages with unsigned data as...

SA-CONTRIB-2010-060 - Scheduler - Cross Site Scripting

Scheduler allows nodes to be published and unpublished on specified dates. Scheduler does not sanitize titles for unpublished nodes on the scheduled nodes overview list, leading to a Cross Site Scripting XSS vulnerability that may lead to a malicious user gaining full administrative access. The...

Google Is 'Paranoid' on Security Following Aurora

Google learned some hard security lessons after it was attacked late last year by hackers, said CEO Eric Schmidt. “Google is now particularly paranoid about that,” Schmidt said during a question-and-answer session following Google’s Atmosphere 2010 conference before about 400 CIOs. Read the full...