Concrete CMS 5.4.1.1 - Cross-Site Scripting / Remote Code Execution

!/usr/bin/python Concrete CMS v5.4.1.1 xss/remote code execution exploit Download: http://www.concrete5.org/ Special Zeitgeist pre release - "Moving Forward" - 15th Jan 2011 "They must find it difficult, those who take authority as the truth instead of truth as the authority"...

FBI Chases Pro-Wikileaks Hackers !

U.S. intelligence agencies, the FBI, has asked all countries work together to jointly support track hackers who managed to paralyze the site Wikileaks 'enemy' Wikileaks. Reported by Yahoo News from the Smoking Gun website on Saturday 01.01.2011, FBI showed detailed written statement about the...

Debian DSA-2136-1 : tor - buffer overflow

Willem Pinckaers discovered that Tor, a tool to enable online anonymity, does not correctly handle all data read from the network. By supplying specially crafted packets a remote attacker can cause Tor to overflow its heap, crashing the process. Arbitrary code execution has not been confirmed but...

Fedora 13 : tor-0.2.1.28-1300.fc13 (2010-19159)

Major bugfixes : - Fix a remotely exploitable bug that could be used to crash instances of Tor remotely by overflowing on the heap. Remote-code execution hasn't been confirmed, but can't be ruled out. Everyone should upgrade. CVE-2010-1676 Directory authority changes : - Change IP address and por...

Nmap NSE: WHOIS

This script queries the WHOIS services of Regional Internet Registries RIR and attempts to retrieve information about the IP Address Assignment which contains the Target IP Address. This is a wrapper on the Nmap Security Scanner's http://nmap.org whois.nse. OpenVAS Vulnerability Test $Id:...

Access Control Security Bypass Vulnerability in Interstage Application Server

Overview Interstage Application Server has an access control security bypass vulnerability which could allow an attacker to access and execute a request from the IP address that should be denied. Impact A remote attacker could access and execute a request from the IP address that should be denied...

Design/Logic Flaw

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count, which allows remote authenticated users to cause a denial of service IP address exhaustion by making invalid attempts to establish sessions with the same VPN ID from multiple...

CVE-2010-4593

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count, which allows remote authenticated users to cause a denial of service IP address exhaustion by making invalid attempts to establish sessions with the same VPN ID from multiple...

CVE-2010-4593

The CVE-2010-4593 issue affects IBM Lotus Mobile Connect connections manager prior to version 6.1.4. It stems from improper maintenance of a reference count, enabling remote authenticated users to trigger a denial of service (IP address exhaustion) by issuing invalid session attempts using the sa...

CVE-2010-0039

The Application-Level Gateway ALG on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in incoming FTP traffic, which allows remote attackers to use the device's IP address for arbitrary intranet TCP traffic by...

CVE-2010-0039

The Application-Level Gateway ALG on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in incoming FTP traffic, which allows remote attackers to use the device's IP address for arbitrary intranet TCP traffic by...

CVE-2010-4593: Undefined Security Weakness

The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count, which allows remote authenticated users to cause a denial of service IP address exhaustion by making invalid attempts to establish sessions with the same VPN ID from multiple...

PT-2010-5560

Name of the Vulnerable Software and Affected Versions IBM Lotus Mobile Connect versions prior to 6.1.4 Description The issue is related to the Connection Manager in IBM Lotus Mobile Connect, which does not properly maintain a certain reference count. This allows remote authenticated users to caus...

DSA-2136-1 tor - potential code execution

Bulletin has no description...

Hacking Tool Used By Anonymous Could Reveal Users Identity

A new study finds that a tool used to carry out distributed denial of service DDoS attacks on behalf of whistle blower Web site Wikileaks may, itself, leak the identity of those running the software. Researchers from the University of Twente, Netherlands, looked at the Low Orbit Ion Cannon LOIC, ...

Second Dutch Teen Arrested Over Pro-WikiLeaks Cyber Attacks

Police in the Netherlands have arrested a second teenager in connection with the pro-WikiLeaks distributed denial-of-service DDoS attacks seen earlier this week. The arrest of the 19-year-old man follows Friday's attacks on websites belonging to the Dutch Police and the national prosecutor's...

Attacks Drive South Korea to Install DDoS Bunkers

In hopes of combating ongoing distributed-denial-of-service DDoS attacks, South Korea recently erected digital “bunkers” throughout their networks, according to a post on ZDNet’s Australian site. Created to help smaller businesses too poor to defend themselves, the “bunkers” are providing tempora...

Code injection

CFNetwork in Apple Mac OS X 10.6.x before 10.6.5 does not properly validate the domains of cookies, which makes it easier for remote web servers to track users by setting a cookie that is associated with a partial IP address...

Low: Red Hat Security Advisory: nss security update

Updated nss packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fr...

Exposing SCADA Systems With Shodan

Editor’s Note: The U.S.’s Industrial Control System Computer Emergency Response Team ICS-CERT recently issued a warning to its members about the ability of attackers to discover ICS systems using a simple search on Shodan, a public search engine that is used to locate systems accessible from the...