Vasillis Pappas Wins $200,000 Microsoft Blue Hat Prize

LAS VEGAS–Microsoft on Thursday handed out three rather large checks to a trio of security researchers, the largest one–$200,000–going to Vasillis Pappas who won the company’s first Blue Hat Prize competition for defensive technologies. Pappas’s kBouncer ROP mitigation technology edged out...

SA-CONTRIB-2012-057 - Printer, email and PDF versions - Cross Site Scripting (XSS)

CVE: CVE-2012-2084 This module provides printer-friendly versions of content, including send by e-mail and PDF versions. The module doesn't sufficiently escape URL elements which are printed back to the user. Versions affected Printer, email and PDF versions 6.x-1.x versions prior to 6.x-1.15...

Vulnerability in OpenSSL - CMS and S/MIME Bleichenbacher attack

A weakness in the OpenSSL CMS and PKCS 7 code can be exploited using Bleichenbacher’s attack on PKCS 1 v1.5 RSA padding also known as the million message attack MMA. Only users of CMS, PKCS 7, or S/MIME decryption operations are affected, SSL/TLS applications are not affected by this issue...

DIR 100 Router WebFilter - URL Bypass Vulnerability

Document Title: =============== DIR 100 Router WebFilter - URL Bypass Vulnerability References: =========== View: http://www.youtube.com/watch?v=SCFJXJwmdRA Download: http://www.vulnerability-lab.com/resources/videos/221.wmv Release Date: ============= 2011-07-07 Vulnerability Laboratory ID VL-ID...

DIR 100 Router WebFilter - URL Bypass Vulnerability

Document Title: =============== DIR 100 Router WebFilter - URL Bypass Vulnerability References: =========== View: http://www.youtube.com/watch?v=SCFJXJwmdRA Download: http://www.vulnerability-lab.com/resources/videos/221.wmv Release Date: ============= 2011-07-07 Vulnerability Laboratory ID VL-ID...

Fedora 14 : subversion-1.6.17-1.fc14 (2011-8341)

This update includes the latest release of Subversion, fixing three security issues : An infinite loop flaw was found in the way the moddavsvn module processed certain data sets. If the SVNPathAuthz directive was set to 'shortcircuit', and path-based access control for files and directories was...

Interview VZ Technocrate - Cyberwar & Activities 2011

Document Title: =============== Interview VZ Technocrate - Cyberwar & Activities 2011 References: =========== View: http://www.youtube.com/watch?v=qNUNZP8Rpfk Download: http://www.vulnerability-lab.com/resources/iv-07-technocrate.mp3 Release Date: ============= 2011-06-26 Vulnerability Laboratory...

Interview VZ Technocrate - Cyberwar & Activities 2011

Document Title: =============== Interview VZ Technocrate - Cyberwar & Activities 2011 References: =========== View: http://www.youtube.com/watch?v=qNUNZP8Rpfk Download: https://www.vulnerability-lab.com/resources/iv-07-technocrate.mp3 Release Date: ============= 2011-06-26 Vulnerability Laborator...

Fedora 15 : subversion-1.6.17-1.fc15 (2011-8352)

This update includes the latest release of Subversion, fixing three security issues : An infinite loop flaw was found in the way the moddavsvn module processed certain data sets. If the SVNPathAuthz directive was set to 'shortcircuit', and path-based access control for files and directories was...

Apple Hires New Security Chief

Apple has hired a software security expert to head up its growing internal security group. The company has hired David Rice, a former National Security Agency analyst and consultant on security issues, according to reports. Rice is currently the director of policy reform at the U.S. Cyber...

[CORE-2010-0624] MS OpenType CFF Parsing Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://corelabs.coresecurity.com/ MS OpenType CFF Parsing Vulnerability 1. Advisory Information Title: MS OpenType CFF Parsing Vulnerability Advisory Id: CORE-2010-0624 Advisory URL:...

ZDI-10-139: Novell iPrint Client Browser Plugin Parameter Name Remote Code Execution

ZDI-10-139: Novell iPrint Client Browser Plugin Parameter Name Remote Code Execution http://www.zerodayinitiative.com/advisories/ZDI-10-139 August 5, 2010 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Novell -- Affected Products: Novell iPrint -- TippingPointTM IPS Customer...

NTSOFT BBS E-Market Professional Cross Site Scripting

+================================================================================================+ + NTSOFT BBS E-Market Professional & XSS and Remote Execution Evil code + +================================================================================================+ Authors: Ivan Sanchez...

Interscan Web Security 5.0 - Arbitrary File Upload / Privilege Escalation

Advisory Name: Local Privilege Escalation in InterScan Web Security Virtual Apliance 5.0 Internal Cybsec Advisory Id: 2010-0604 Vulnerability Class: Local Privilege Escalation Release Date: 22-06-2010 Affected Applications: InterScan Web Security Virtual Aplliance 5.0. Other versions may be...

Apple Snags former Mozilla Security Chief

Apple has hired former Microsoft and Mozilla security specialist Window Snyder to help secure its Mac ecosystem. Snyder, who last worked as Mozilla’s security chief, confirmed she is joining Apple as senior product manager for security. At Mozilla, Snyder introduced the concept of threat modeling...

Huawei HG510 CSRF, Auth Bypass, DoS

Hello, Huawei HG510 is a device offered by the Serbian telecom operator, to provide ADSL Internet connection. Administration of settings on this device is allowed only from local LAN network but not only from private IP address eg 192.168.1.1 then You can access with public IP address only from...

Ivan Arce, Core Security

I’m not sure there are too many people around who put more serious thought into their answers in an interview than Ivan does. He doesn’t just throw out a flip sound bite that he knows will make good copy. Instead, he’s much more interested in having a discussion, explaining the reasoning behind h...

FreePBX 2.5.1 - SQL Injection

FreePBX 2.5.1 - SQL Injection Advisory Name: SQL injection in FreePBX 2.5.1 Internal Cybsec Advisory Id: 2010-0103 Vulnerability Class: SQL injection Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.1. Other versions may also be affected. Affected Platforms: Any running...

FreePBX 2.5.1 - SQL Injection

Advisory Name: SQL injection in FreePBX 2.5.1 Internal Cybsec Advisory Id: 2010-0103 Vulnerability Class: SQL injection Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.1. Other versions may also be affected. Affected Platforms: Any running FreePBX 2.5.1 Local / Remote:...

FreePBX 2.5.x < 2.6.0 - Persistent Cross-Site Scripting

Advisory Name: Permanent Cross-Site Scripting XSS in FreePBX 2.5.x – 2.6.0 Internal Cybsec Advisory Id: 2010-0102 Vulnerability Class: Permanent Cross-Site Scripting XSS Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.x and 2.6.0 - Other versions may also be affected...