SuSE 11 Security Update : GNOME screensaver (SAT Patch Number 2150)

When resuming a system, gnome-screensaver does not lock external displays that got connected while the system was suspended. CVE-2010-0285 - Pressing the 'Return' key repeatedly caused an X error that terminated gnome-screensaver. CVE-2010-0732 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

SuSE 11.2 Security Update : dhcp (SAT Patch Number 6831)

This update to ISC dhcp-4.2.4-P2 release provides a security fix for an issue with the use of lease times. Making certain changes to the end time of an IPv6 lease could cause the server to abort. Thanks to Glen Eustace of Massey University, New Zealand for finding this issue. CVE-2012-3955 has be...

PayPal Inc Exploitation Session - Bug Bounty Video 2012

Document Title: =============== PayPal Inc Exploitation Session - Bug Bounty Video 2012 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=773 View: http://www.youtube.com/watch?v=MM2JH9rQ7Io Advisories: http://www.vulnerability-lab.com/getcontent.php?id=634...

VMware Horizon View SEoL

According to its version, the installation of VMware Horizon View, formerly known as VMWare View Server, and VMware Virtual Desktop Infrastructure, on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a...

Classified Ultra ScriptsGenie XSS / SQL Injection Vulnerabilities

Classified Ultra ScriptsGenie suffers from cross site scripting and remote SQL injection vulnerabilities. Note that this finding houses site-specific data. Exploit Title; Classified Ultra ScriptsGenie Multiple Vulnerabilities Date; 20/1/13 Author; 3spi0n Script Vendor or Software Link;...

Classified Ultra ScriptsGenie Cross Site Scripting / SQL Injection

Exploit Title; Classified Ultra ScriptsGenie Multiple Vulnerabilities Date; 20/1/13 Author; 3spi0n Script Vendor or Software Link; http://www.hotscripts.com/listing/classified-ultra-scriptsgenie/ Category; Webapps Type; SQL Injection MySQLi Tested on; Ubuntu 12.10 / Win7 / Backtrack 5 Demo...

Windows Product Key Retrieval

Using the supplied credentials, Nessus was able to obtain the retrieve the Windows host's partial product key'. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid63620; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date: 2013/01/18 20:20:22 $";...

Java 7u11 Update Addresses Only One of Two Zero-Day Vulnerabilities

Microsoft can take some solace that it is not alone in sending out security updates that don’t fully address a zero-day vulnerability. A researcher at Immunity Inc., put Oracle on a similar hot seat this week when he reported that a recent out-of-band Java update repaired only one of two Java fla...

FreeBSD : java 7.x -- security manager bypass (d5e0317e-5e45-11e2-a113-c48508086173)

US CERT reports : Java 7 Update 10 and earlier versions of Java 7 contain a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manage...

Invision Gallery 2.0.5 - SQL Injection

Exploit Title : Invision Gallery SQL Injection Exploit Author : Ashiyane Digital Security Team software Homepage: www.invisionpower.com/apps/gallery/ Home : ww.Ashiyane.org Security Risk : High - SQL Injection version : 2.0.5 Dork : Invision Gallery 2.0.5 © 2013 IPS, Inc. inurl:img= or Invision...

Fedora 18 : BackupPC-3.2.1-10.fc18 (2012-20943)

cleanup build macros for Fedora - fix deprecated qw messages partial fix for bz 755076 - CVE-2011-5081 BackupPC: XSS flaw in RestoreFile.pm bz 795017, 795018, 795019 - Broken configuration for httpd 2.4 bz 871353 Note that Tenable Network Security has extracted the preceding description block...

Ubuntu 10.04 LTS : linux vulnerability (USN-1683-1)

A flaw was discovered in the Linux kernel's handling of script execution when module loading is enabled. A local attacker could exploit this flaw to cause a leak of kernel stack contents. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu...

java 7.x -- security manager bypass

US CERT reports: Java 7 Update 10 and earlier versions of Java 7 contain a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manager...

Joomla Incapsula 1.4.6_b Cross Site Scripting

Joomla Incapsula Component target="blank" class="IFJlink" Click here to upgrade your account Patch: ------ 22: " target="blank" class="IFJlink"Click here to upgrade your account -------------------------------------------------------------------------- Tested on: Microsoft Windows 7 Ul...

Joomla Incapsula Component <= 1.4.6_b Reflected Cross-Site Scripting Vulnerability

Summary Once installing the Incapsula for Joomla component, simply make the provided DNS changes and within minutes your website traffic will be seamlessly routed through Incapsula’s globally distributed network of POPs. Description The Joomla Incapsula component suffers from a XSS issue due to a...

Fraudulent digital certificates issued by TURKTRUST Inc.

...

DSA-2599-1 nss - mis-issued intermediates

Bulletin has no description...

Fake Turkish digital Certificates blocked by Browser vendors

It's the news of the day, a fraudulent digital certificate that could be used for active phishing attacks against Google's web properties. Using the certificate it is possible to spoof content in a classic phishing schema or perform a man-in-the-middle attack according Google Chrome Security Team...

Microsoft Releases Security Advisory on Fraudulent Digital Certificates

Microsoft has released Security Advisory 2798897 in response to active attacks using fraudulent digital certificates issued by TURKTRUST Inc. These fraudulent certificates could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. This vulnerability affects al...

Open-Realty CMS 3.x | Cross Site Request Forgery &#40;CSRF&#41; Vulnerability

OVERVIEW Open-Realty CMS 3.x versions are vulnerable to Cross Site Request Forgery. 2. BACKGROUND Open-Realty is the world's leading real estate listing marketing and management CMS application, and has enjoyed being the real estate web site software of choice for professional web site...