admin/fixCaseInSpacePermissions.jsp lacks an XSRF token to 'fix the case of your space permissions'

admin/fixCaseInSpacePermissions.jsp does not require a csrf token to 'fix the case of your space permissions'. When fixing this issue, please ensure that the JSP is converted to an action or deleted - we don't want to have to maintain our XSRF infrastructure in JSPs...

Use VoIP – or Copper

Google Voice is a free VOIP service that can be used to create “throw away” voice accounts for travelers. Having your conversations handled on Google’s infrastructure also provides a measure of security over foreign telecommunications networks, which – depending on the country – could cooperating...

No Patch Coming for Newly Announced Vulnerabilities in ABB Legacy Products

Two independent researchers who’ve been warning of the threat of serious attacks against bug-riddled ICS and SCADA systems today issued an alert through ICS-CERT that vulnerabilities in ABB products could lead to DoS attacks or allow an attacker to remotely launch malicious code. No patch is...

[SECURITY] [DSA 2443-1] linux-2.6 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------------------- Debian Security Advisory DSA-2443-1 [email protected] http://www.debian.org/security/ Dann Frazier March 26, 2012 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2443-1] linux-2.6 security update

---------------------------------------------------------------------- Debian Security Advisory DSA-2443-1 [email protected] http://www.debian.org/security/ Dann Frazier March 26, 2012 http://www.debian.org/security/faq - ----------------------------------------------------------------------...

DSA-2443-1 linux-2.6 - several

Bulletin has no description...

Free Configuration Check Tool by eEye Digital Security

Free Configuration Check Tool by eEye Digital Security eEye Digital Security, the industry's leading innovator of threat management solutions, just released new research, "Working Toward Configuration Best Practices" . Findings verify that proper configuration and mitigations remain the most...

portaudit -- auditfile remote code execution

Michael Gmelin and Jörg Scheinert has reported a remote command execution vulnerability in portaudit. An attacker who can get the user to use a specially crafted audit file will be able to run commands on the users system, with the privileges of the user running running portaudit often root. The...

[Onapsis Security Advisory 2012-03] Oracle JD Edwards SawKernel Arbitrary File Read

Onapsis Security Advisory: Oracle JD Edwards SawKernel Arbitrary File Read This advisory can be downloaded in PDF format from http://www.onapsis.com/. By downloading this advisory from the Onapsis Resource Center, you will gain access to beforehand information on upcoming advisories, presentation...

[Onapsis Security Advisory 2012-07] Oracle JD Edwards SawKernel SET_INI Configuration Modification

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory: Oracle JD Edwards SawKernel SETINI Configuration Modification This advisory can be downloaded in PDF format from http://www.onapsis.com/. By downloading this advisory from the Onapsis Resource Center, you will gain access to...

[Onapsis Security Advisory 2012-01] Oracle JD Edwards JDENET Arbitrary File Write

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory: Oracle JD Edwards JDENET Arbitrary File Write This advisory can be downloaded in PDF format from http://www.onapsis.com/. By downloading this advisory from the Onapsis Resource Center, you will gain access to beforehand...

60 Minutes Weighs Stuxnet's Legacy

The security community might understand what the Stuxnet worm did. Now the war is over what the worm means – Stuxnet’s legacy, if you will. The latest to weigh in on that question is Steve Croft, of the CBS news magazine 60 Minutes. We knew this story was coming when a 60 Minutes news crew turned...

Despite Intrusions, Chances Of U.S.-China Cyber War Are Small

SAN FRANCISCO – A panel of security and policy experts said that, despite dire warnings about the information warfare capabilities of China and other developing nations, the risk of an all-out cyber war is remote, and that the U.S. still holds many of the cards. Despite widespread portrayals of...

OpenJDK: AtomicReferenceArray insufficient array type check (Concurrency, 7082299)

Unspecified vulnerability in the Virtual Desktop Infrastructure VDI component in Oracle Virtualization 3.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Session. NOTE: this CVE identifier was accidentally used for a Concurrency issue in...

Cybersecurity Act of 2012 Introduced Without Emergency Presidential Powers Provisions

A bipartisan group of Senators introduced the Cybersecurity Act of 2012 yesterday. The bill aims to secure federal and private sector networks that provide essential services or that are deemed “critical” to the nation in some other way. According to a Homeland Security and Government Affairs...

2013 Federal Budget Includes Nearly $800M For Cybersecurity

President Obama is asking for $769 million to fund information security initiatives via the Department of Homeland Security in 2013. That amount is nearly twice what DHS asked for last year to fund its cybersecurity work. “The Administration proposes $769 million to support the operations of the...

Creating Replication Jobs in Backup & Replication version 6.x

Challenge How to create replication jobs. Solution To replicate virtual machines, you should create a replication job by means of the New Replication Job wizard. You can perform the created job immediately, schedule, or save it. Before You Begin • Prior to creating a replication job, make sure yo...

DNS domain transfer disclosure vulnerability details-vulnerability warning-the black bar safety net

The zone transfer operation refers to a backup server to use from the main server's data to refresh their zone database. This is running the DNS service provides a certain degree of redundancy, its purpose is to prevent the primary domain name server due to an unexpected fault becomes unavailable...

Market Fail: Regulations May Be Only Hope For Securing Critical Infrastructure

Threatpost’s exclusive interview with Ralph Langner continues, as our conversation shifts from the legacy of the Stuxnet worm to larger issues facing the critical infrastructure sector including mounting attacks, tensions between vendors and security researchers over responsible disclosure, and...

CVE-2011-3571

Unspecified vulnerability in the Virtual Desktop Infrastructure VDI component in Oracle Virtualization 3.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Session. NOTE: this CVE identifier was accidentally used for a Concurrency issue in...