[SECURITY] Fedora 21 Update: ettercap-0.8.2-1.fc21

Ettercap is a suite for man in the middle attacks on LAN. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols even ciphered ones and includes many feature for network and ho st analys...

Debian DLA-42-1 : live-config security update

A vulnerability against Debian Live, the live systems project, was reported. The default, the live images include a SSH server allowing for log in with default user and password. This fix set PasswordAuthentication in /etc/ssh/sshdconfig as 'no'. NOTE: Tenable Network Security has extracted the...

[SECURITY] Fedora 22 Update: ettercap-0.8.2-1.fc22

Ettercap is a suite for man in the middle attacks on LAN. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols even ciphered ones and includes many feature for network and ho st analys...

WordPress Live Forms Plugin <= 3.0.1 - Blind SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Solution Update the plugin...

Live Forms - Visual Form Builder 3.0.1 - Blind SQL Injection

The AJAX action ‘getreqlist’ is available to all logged in users. The parameter ‘ipp’ sent to this action is vulnerable to Blind MySQL Injection. This can be leveraged by detecting how long a query takes to return...

TeX Live Local File Deletion Vulnerability

TeX Live is an international TeX user organization TUG developed a set of TeX electronic typesetting system. The system provides typesetting language, macro definition and other functions. A local file deletion vulnerability exists in TeX Live. A local attacker can exploit this vulnerability to...

Discuz!3.0-3.2版本的通杀xss存储漏洞（需开始直播功能）

简要描述： 这个必须得高危啊！！！！！！！！！！！ 来个雷劈可好？ 详细说明： 小白不会审计代码 然后咱们就直接进入主题吧！ discuz3.0-3.2有个功能叫直播的。实习版主就能开启哈 接着咱们就用admin帐号先把一个帖子弄成直播！ 接着。我们用新注册的用户。。咳咳。得等两分钟。再能发话哈 然后用等待的时间去进行弄exp 弄成base16的 点击发表 呵呵。弹窗了 漏洞证明： 来。接着 discuz 3.1版本测试...

CVE-2015-2086

Cross-site scripting XSS vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title...

CVE-2015-2086

Cross-site scripting XSS vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title...

Cross site scripting

Cross-site scripting XSS vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title...

CVE-2015-2086

Cross-site scripting XSS vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title...

Debian DSA-3170-1 : linux - security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation. - CVE-2013-7421 / CVE-2014-9644 It was discovered that the Crypto API allowed unprivileged users to load arbitrary kernel modules. A local user can use...

WordPress Acobot Live Chat & Contact Form Plugin <= 2.0 - Multiple CSRF

Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests that change plugin settings or conduct cross-site scripting attacks. Solution Upgrade the plugin...

SA-CONTRIB-2015-047 - Panopoly Magic - Cross Site Scripting (XSS)

This module enables live previews of Panels panes in the modal dialog for adding or editing them. The module doesn't sufficiently filter the pane title when re-rendering the live preview. This vulnerability is mitigated by the fact that an attacker must have permission to add or edit Panels panes...

Rekall Memory Forensic Framework

Rekall is an advanced forensic and incident response framework. While it began life purely as a memory forensic framework, it has now evolved into a complete platform. Rekall implements the most advanced analysis techniques in the field, while still being developed in the open, with a free and op...

WordPress Acobot Live Chat And Contact Form 2.0 CSRF / XSS

Title: WordPress 'Acobot Live Chat & Contact Form' CSRF/XSS Version: 2.0 Author: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2015/01/26 Download: https://wordpress.org/plugins/acobot/ Contacted WordPress: 2015/01/26 ========================================================== Plugin descriptio...

Nearby Live: Group Invite not properly authenticated

There is no check whether the inviting user is allowed to invite a user into a group and through manipulation a user may sent themself and invite to any group. Example: Group A created by User 1 with Owner invitation only with ID x User 2 sends malicious himself invite with ID x and receives invi...

GRR Rapid Response

GRR Rapid Response is an incident response framework focused on remote live forensics. GRR consists of an agent client that can be deployed to a target system, and server infrastructure that can manage and talk to the agent. Client Features: Cross-platform support for Linux, OS X and Windows...

UK Police Arrested Second Hacker Over PlayStation and Xbox DDoS attacks

A UK man linked to the notorious hacking group, Lizard Squad, that claimed responsibility for knocking Sony’s PlayStation Network and Microsoft’s Xbox Live offline on Christmas Day has been arrested by the United Kingdom police. Lizard Squad launched simultaneous Distributed Denial-of-Service DDo...

Teen Arrested in UK for Xbox, PlayStation Attacks

Police in the UK, working in cooperation with the FBI, arrested an 18-year-old man Friday in connection with recent DDoS attacks on the PlayStation Network and Xbox Live services. The authorities arrested the unnamed man in Southport, and he is being held on suspicion of computer crime and...