NETGEAR ReadyNAS Perl Code Evaluation

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::Remote::HttpClient def initializein...

Trustwave Global Security Report: Breach Containment Better

For all that gets written about how poorly organizations have responded to data breaches as of late, believe it or not, one new study has deduced that companies are getting better. Almost three quarters of victims who sustained a compromise last year were able to contain it within 10 days. The st...

Yahoo!: http://us.rd.yahoo.com/

Thank you for your submission to Yahoo’s Bug Bounty program. While we recognize the effort that you put into the research and writing of a report for us to evaluate, we will take your report into consideration for any future releases. We appreciate your adherence to responsible disclosure...

Alienvault 4.3.1 - SQL Injection / Cross-Site Scripting

AlienVault 4.3.1 Unauthenticated SQL Injection Vulnerability Type: SQL Injection Reporter: Sasha Zivojinovic Company: Gotham Digital Science Affected Software: AlienVault 4.3.1 Severity: Critical =========================================================== Summary...

django -- multiple vulnerabilities

The Django project reports: These releases address an unexpected code-execution issue, a caching issue which can expose CSRF tokens and a MySQL typecasting issue. While these issues present limited risk and may not affect all Django users, we encourage all users to evaluate their own risk and...

CVE-2014-2234

A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent TEA feature without terminating certain TLS/SSL handshakes as specified in the SSLCTXsetverify callback function's documentation, which allows remote attackers to bypass extra verification within a...

Design/Logic Flaw

A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent TEA feature without terminating certain TLS/SSL handshakes as specified in the SSLCTXsetverify callback function's documentation, which allows remote attackers to bypass extra verification within a...

CVE-2014-2234

A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent TEA feature without terminating certain TLS/SSL handshakes as specified in the SSLCTXsetverify callback function's documentation, which allows remote attackers to bypass extra verification within a...

CVE-2014-2234

A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent TEA feature without terminating certain TLS/SSL handshakes as specified in the SSLCTXsetverify callback function's documentation, which allows remote attackers to bypass extra verification within a...

Institute for Electric Grid Cybersecurity Girds Utilities

Critical infrastructure policymakers are advocating the foundation of a new entity, the Institute for Electric Grid Cybersecurity, along with a new set of guidelines, to better protect the North American electric grid from cyber-attacks and determine how to respond if the grid is ever compromised...

Cisco Offers $300,000 Prize For 'Internet of Things' Security Apps

In the last few years, this emerging domain for the Internet of Things has been attracting the significant interest, and will continue for the years to come. It would be a $20 Trillion Market over the next several years, but Security and privacy are the key issues for such applications, and still...

Apache Struts Developer Mode OGNL Execution Exploit

This Metasploit module exploits a remote command execution vulnerability in Apache Struts 2. The problem exists on applications running in developer mode, where the DebuggingInterceptor allows evaluation and execution of OGNL expressions, which allows remote attackers to execute arbitrary Java...

Netgear ReadyNAS - Perl Code Evaluation (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'NETGEAR ReadyNAS Perl Code Evaluation', 'Description' = %q This module exploits a Perl code injection on NETGEAR ReadyNAS 4.2.23 and...

CVE-2013-4255

The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a 1 PREEMPT, 2 SUSPEND, 3 CONTINUE, 4 WANTVACATE, or 5 KILL policy that evaluate to an Unconfigured, Undefined, or Error state, which allows remote authenticated users to cause a denial of...

CVE-2009-5136

The policy definition evaluator in Condor before 7.4.2 does not properly handle attributes in a WANTSUSPEND policy that evaluate to an UNDEFINED state, which allows remote authenticated users to cause a denial of service condorstartd exit via a crafted job...

Threat Outbreak Alert: Fake Monetary Award Notification Email Messages on October 7, 2013

Medium Alert ID: 31166 First Published: 2013 October 8 14:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an award notification for the recipient. The text in the email message attempts to convince the recipient to op...

Researchers Nab $28k in Microsoft Bug Bounty Program

As part of its first-ever bounty program, Microsoft has paid out $28,000 to a small group of researchers who identified and reported vulnerabilities in Internet Explorer 11. The IE 11 bounty program only ran for one month during the summer, but it attracted a number of submissions from well-known...

condor: condor_startd DoS when parsing policy definition that evaluates to ERROR or UNDEFINED

The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a 1 PREEMPT, 2 SUSPEND, 3 CONTINUE, 4 WANTVACATE, or 5 KILL policy that evaluate to an Unconfigured, Undefined, or Error state, which allows remote authenticated users to cause a denial of...

[CVE-2013-2250] Apache OFBiz Nested expression evaluation allows remote users to execute arbitrary UEL functions in OFBiz

CVE-2013-2250 - Apache OFBiz Nested expression evaluation allows remote users to execute arbitrary UEL functions in OFBiz Vendor: The Apache Software Foundation Versions Affected: Apache OFBiz 10.04.01 to 10.04.05 Apache OFBiz 11.04.01 to 11.04.02 Apache OFBiz 12.04.01 Description: Parameter valu...

Oracle Linux 4 : squirrelmail (ELSA-2006-0668)

From Red Hat Security Advisory 2006:0668 : A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SquirrelMail is a...