MS12-034: Description of the security update for DirectWrite in Windows: May 8, 2012

None None...

MS12-034: Description of the security update for Windows GDI+: May 8, 2012

None None...

servu/serv-u by replacing the servudaemon. ini elevation of privilege-vulnerability warning-the black bar safety net

servu 6.3/6. 4 and 7. 0,8. 0 and so there is a directory traversal vulnerability. Using a writable account to log in if it is anonymous ftp, it only read permissions C:\Documents and Settings\Administratorftp 127.0.0.1 Connected to 127.0.0.1. 2 2 0 Serv-U FTP Server v6. 4 for WinSock ready...

Citing Terms Of Service, Google Takes Down Blog Of Iranian Security Researcher

An Iranian man who revealed a vulnerability in a widely used point of sale POS system in Iran had his blog confiscated by Google, which cited violations of its Terms of Service. A Google spokesman acknowledged that the company pulled down the Blogger site that Khosrow Zarefarid, an Iranian IT...

Symantec pcAnywhere Insecure File Permissions Local Privilege Escalation

Exploit for windows platform in category local exploits ======= Summary ======= Name: Symantec pcAnywhere insecure file permissions local privilege escalation Release Date: 30 April 2012 Reference: NGS00117 Discoverer: Edward Torkington Vendor: Symantec Vendor Reference: Systems Affected: Symante...

A CISO's Guide To Application Security – Part 2: The Growing Threat to Applications

Editor’s Note: This post is the second in a multi-part series on Application Security, or “AppSec” prepared by our friends over at application testing firm Veracode. The series will define the components of a sound AppSec program, delineate the growing threats to software, weigh the costs of a da...

Talk to IT

Well in advance of your departure date, have a sit-down with IT to talk about your trip and about how to avoid exposing sensitive corporate assets and information to compromise. Your IT group will probably be able to help you find work arounds, secure a line back to the company network and even...

Free Configuration Check Tool by eEye Digital Security

Free Configuration Check Tool by eEye Digital Security eEye Digital Security, the industry's leading innovator of threat management solutions, just released new research, "Working Toward Configuration Best Practices" . Findings verify that proper configuration and mitigations remain the most...

What We Learned at HIMSS12

A few weeks ago, more than 35,000 healthcare IT professionals and 1,100 exhibitors converged on Las Vegas. Some were there to go shopping for "HIT" or health information technology; others were there to sell it. The IT professionals from across the healthcare spectrum were there to meet with each...

Code injection

The About option on the Help menu in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management...

Cross site scripting

Cross-site scripting XSS vulnerability in the Start Center Layout and Configuration component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service...

CVE-2011-4817

CVE-2011-4817 affects IBM Maximo Asset Management and related IBM assets (Asset Management Essentials, Tivoli AM for IT, Service Request Manager, Maximo Service Desk, CCMDB) on multiple versions (6.2, 7.1, 7.2/7.5). The issue is an information disclosure where the About menu in Help shows the use...

CVE-2012-0195

Cross-site scripting XSS vulnerability in the Start Center Layout and Configuration component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service...

CVE-2011-1397

CVE-2011-1397 is a CSRF vulnerability in IBM Maximo and related products (Asset Management, Essentials, Tivoli AM for IT, Service Request Manager, Maximo Service Desk, CCMDB) affecting 6.2, 7.1, 7.2 and 7.5. Attack could hijack user authentication via the Labor Reporting page. IBM remediation via...

ZyXel GS1510 Cross Site Scripting

Advisory Information Title: Multiple vulnerabilities in ZyXel GS1510 web front end Date published: 2012-03-14 12:57:15 AM upSploit Ref: UPS-2011-0042 Advisory Summary IT Security Geeks have discovered multiple vulnerabilities in the ZyXel 1510 24-port Ethernet switch, these include Admin password...

ActivaDigital SQL Injection

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Official Website: http://www.1337day.com 0 1 + Support...

CVE-2012-0292

The awhost32 service in Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 aka 12.5.x and 7.1 aka 12.6.x, Altiris Client Management Suite pcAnywhere Solution 7.0 aka 12.5.x and 7.1 aka 12.6.x, and Altiris Deployment Solution Remote pcAnywhere Solution 7.1 aka...

Code injection

The awhost32 service in Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 aka 12.5.x and 7.1 aka 12.6.x, Altiris Client Management Suite pcAnywhere Solution 7.0 aka 12.5.x and 7.1 aka 12.6.x, and Altiris Deployment Solution Remote pcAnywhere Solution 7.1 aka...

UPDATE: Interpol Operation Leads to Arrest of 25 Suspected Anons

Interpol announced yesterday that they had taken part in an international operation that led to the arrests of 25 alleged members of the Anonymous hacker collective. The not-arrested members of Anonymous reportedly lashed back with a stinging DDoS attack on Interpol’s website. The so-called...

RSA: Chaos In the Security World, And the Situation Is Perfect

Right on cue this week, the anarchic hacking collective Anonymous stepped up and grabbed the story line away from the lions of the IT security industry. With the annual RSA Conference set to begin, the whistle blowing site Wikileaks released the first of some five million e-mail messages stolen...