Code injection

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context via a...

CVE-2016-7613: Undefined Security Weakness

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context via a...

Stampado Ransomware Sells on Dark Web for $39

Dirt cheap ransomware selling for as little as $39 on the dark web has security experts concerned the low price coupled with its potency could trigger a wave of new infections. The ransomware is called Stampado and besides its hallmark low price, the ransomware is also unique because it threatens...

Popular Download Service μTorrent wants you to pay for its Software

Just to enhance the services being rendered. The popular peer-to-peer file sharing software application is aiming to achieve new heights by making their software be a paid scheme. uTorrent is one of the clients of BitTorrent Inc. the parent company which implements a BitTorrent protocol. Where ea...

CVE-2014-9386

Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691...

CVE-2014-9386: Undefined Security Weakness

Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691...

CVE-2014-3165

Use-after-free vulnerability in modules/websockets/WorkerThreadableWebSocketChannel.cpp in the Web Sockets implementation in Blink, as used in Google Chrome before 36.0.1985.143, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigge...

New Kronos Banking Malware Advertised On Russian Forums

Criminals are advertising a new banking Trojan on Russian forums, one going for a hefty price and being marketed as a method of evading detection and analysis. To date, however, security researchers have yet to obtain a sample of Kronos, which is available on a few forums for pre-order at a cost ...

CVE-2014-0214

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2014-0214: Improper Authentication

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2014-0214

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

Software defense: safe unlinking and reference count hardening

Object lifetime management vulnerabilities represent a very common class of memory safety vulnerability. These vulnerabilities come in many shapes and sizes, and are typically quite difficult to mitigate generically. Vulnerabilities of this type result commonly from incorrect accounting with...

Oracle Java JRE Unsupported Version Detection (Unix)

According to its self-reported version number, at least one installation of Oracle formerly Sun Java JRE on the remote host is no longer supported. The underlying detection plugins enumerates Java installations via binary, path and document inspection to ascertain confidence levels. As Java can b...

REST session not terminated

panel This issue deals with how JIRA manages session requests to the REST/SOAP API. The related issue JRA-27050 deals with session management for web Crawlers. The related issue JRA-27047 deals with session management for stateless requests to the REST/SOAP API. panel h4. Expected behavior 1. On...

OpenStack Keystone limitations bypass

Administrative user limitations and token lifetime limitations bypass...

"SecurityTube Wi-Fi Security Expert" (SWSE) online certification Launched

"SecurityTube Wi-Fi Security Expert" SWSE online certification Launched SecurityTube released their first fully online certification today - "SecurityTube Wi-Fi Security Expert " SWSE . The most interesting thing and key difference from other certifications, is that they are giving out the entire...

Oracle Java JRE Unsupported Version Detection

According to its self-reported version number, at least one installation of Oracle formerly Sun Java JRE on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security...

CVE-2011-2350: Undefined Security Weakness

The HTML parser in Google Chrome before 12.0.742.112 does not properly address "lifetime and re-entrancy issues," which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

Google Chrome < 12.0.742.112 Multiple Vulnerabilities

Binary data 800903.prm...

PT-2011-3791

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 12.0.742.112 Description The issue is related to the HTML parser, which does not properly address lifetime and re-entrancy issues. This allows remote attackers to cause a denial of service or possibly have...