PT-2012-6100

Name of the Vulnerable Software and Affected Versions PayPal IPN utility affected versions not specified Description The issue concerns a lack of verification in the PayPal IPN utility that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the...

PT-2012-6104

Name of the Vulnerable Software and Affected Versions osCommerce Sage Pay Direct module affected versions not specified Description The issue concerns a lack of verification in the Sage Pay Direct module that the server hostname matches a domain name in the subject's Common Name CN or...

PT-2012-4413

Name of the Vulnerable Software and Affected Versions Webmin versions 1.590 and earlier Description The issue allows remote attackers to read arbitrary files without proper authorization. This is due to a lack of authorization check in the file/edit html.cgi component, which permits access to a...

Sitecom Home Storage Center - Directory Traversal

Security Advisory AA-004: Directory Traversal Vulnerability in Sitecom Home Storage Center Severity Rating: High Discovery Date: July 29, 2012 Vendor Notification: July 30, 2012 Disclosure Date: September 3, 2012 Vulnerability Type= Directory Traversal Impact= - System Access - Exposure of...

PT-2012-3836

Name of the Vulnerable Software and Affected Versions Elixir versions prior to 0.8.0 Elixir versions 0.8.0 Description The issue arises from Elixir using Blowfish in CFB mode without constructing a unique initialization vector IV. This makes it easier for context-dependent users to obtain sensiti...

PT-2012-4140

Name of the Vulnerable Software and Affected Versions Plixer Scrutinizer aka Dell SonicWALL Scrutinizer versions prior to 9.5.0 Description The issue concerns the lack of token authentication in the cgi-bin/admin.cgi endpoint of the web console, allowing remote attackers to add administrative...

PT-2012-3091

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue makes it easier for remote attackers to copy bug reports without detection because it does not audit when users copy or clone a bug report. Recommendations For versions prior to 1.2.9,...

Critics Continue Pushing for Bigger Probe into Google Street View Practices

Privacy advocates continue urging for a wider federal investigation into Google Street View practices following Google’s $25,000 fine for stonewalling federal officials during an earlier probe of Wi-Fi snooping allegations. The Federal Communications Commission late last week gave the Internet...

PT-2012-3547

Name of the Vulnerable Software and Affected Versions Siemens Scalance S Security Module firewall versions prior to 2.3.0.3 Description The issue allows remote attackers to gain access via a brute-force attack on the administrative password due to the lack of rate limiting on authentication...

PT-2012-1184

Name of the Vulnerable Software and Affected Versions Schneider Electric Modicon Quantum PLC affected versions not specified Schneider Electric Modicon M340 affected versions not specified Description The issue is related to a lack of authentication between the Unity software and the PLC, which c...

KLA10394 Multiple vulnerabilities in Siemens

Multiple critical vulnerabilities have been found in Siemens products. Malicious users can exploit these vulnerabilities to read & modify arbitrary files, cause denial of service, execute arbitrary code, bypass authentication, obtain access and inject arbitrary HTTP headers. Below is a complete...

openx -- undisclosed security issue

OpenX does not provide information about vulnerabilities beyond their existence...

Skype zero day HTML/(Javascript) code injection

Skype zero day HTML/Javascript code injection Noptri Public Security Advisory has publised a working skype zero day vulnerability with POC for skype. Skype users need be aware of this vulnerability. Affected Software: Software: Skype INJECTION HERE + Office Phone Number: INJECTION HERE + Mobile...

CVE-2011-3138: Undefined Security Weakness

The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit JDK class, which might allow attackers to bypass...

#Blackhat Conference : Square Mobile Gadget allows to Hack Credit Cards

Blackhat Conference : Square Mobile Gadget allows to Hack Credit Cards Researchers at the Black Hat security conference today revealed two ways the Square payment system , which turns any iPhone, iPad or Android into a point-of-sale credit card processor, could be used for fraud. Square a mobile...

Facebook Mobile User Enumeration

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Facebook doesn't ensures the user information may not be collected by any bot or any automated process. Even though you can protect from this kind of attacks using captchas or tokens security into the forms. Step by step: - - Go to http://m.facebook.c...

Securstar - DriveCrypt - Local Kernel Denial of Service/Memory Disclosure/Privilege Escalation

===============================ADVISORY=============================== Advisory: Securstar - DriveCrypt - Local Kernel Denial of Service/Memory Disclosure/Privilege Escalation Advisory ID: DSEC-2011-0001 Author: Neil Kettle, Digit Security Ltd Affected Software: Securstar DriveCrypt Vendor URL:...

Lulzsec Exposed, Long Live Anonymous !

Lulzsec Exposed, Long Live Anonymous ! Lulz war ! Today Hacking group "Lulzsec" completed their 50th day and also announce the retirement of Lulz boat. What are the Reasons behind this ? Lulz Security's rise to prominence has been extraordinarily fast.The hacking group first emerged in May and in...

Hi5.com XSS / XSRF / URL Redirection / Lack Of Encryption

============================================= INTERNET SECURITY AUDITORS ALERT 2010-11 - Original release date: 29th October 2010 - Last revised: 1st May 2011 - Discovered by: Eduardo Garcia Melia - Severity: 7.8/10 CVSSv2 Base Scored ============================================= I. VULNERABILITY...

CVE-2011-1094

kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate...