GetResourceServlet pre-auth arbitrary file download vulnerability

The GetResourceServlet Servlet is vulnerable to an arbitrary file download attack. As the Servlet doesn’t implement its own authorization checks, this can be exploited anonymously. By taking an attacker controlled name parameter and using this in a call to URLConnection.openConnection, an attacke...

ResolveURLServlet pre-auth arbitrary file download vulnerability

The ResolveURLServlet Servlet is vulnerable to an arbitrary file download attack. As the Servlet doesn’t implement its own authorization checks, this can be exploited anonymously. By taking an attacker controlled url parameter and using this in a call to URLConnection.openConnection, an attacker...

BigAnt Server 2.97 - DDNF 'Username' Remote Buffer Overflow

!/usr/bin/python Title: BigAnt Server 2.97 DDNF Username Buffer Overflow Author: Craig Freyman @cd1zz http://pwnag3.com Tested on: Windows 7 64 bit DEP/ASLR Bypass Similar Exploits: http://www.exploit-db.com/exploits/24528/ http://www.exploit-db.com/exploits/24527/...

Glance: Backend credentials leak in Glance v1 API

The v1 API in OpenStack Glance Essex 2012.1, Folsom 2012.2, and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image...

Malware Arsenal Targets Tibetan Activists

Tibetan activists in China as well as those living in exile around the world are being targeted by dangerous malware that not only steals data from infected computers, but also has graduated to reporting location data from mobile devices for surveillance purposes. In addition, a grassroots campai...

PYSEC-2013-46

The v1 API in OpenStack Glance Essex 2012.1, Folsom 2012.2, and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image...

DEBIAN-CVE-2013-1840

The v1 API in OpenStack Glance Essex 2012.1, Folsom 2012.2, and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image...

PYSEC-2013-46

The v1 API in OpenStack Glance Essex 2012.1, Folsom 2012.2, and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image...

How To: Chrome Browser Privacy Settings

youtube http://www.youtube.com/watch?v=YY9hbsfEbaw The Web browser is the primary portal through which the vast majority of connected users access and interact with the Internet. Each browser has its own security and privacy settings and those settings have an enormous impact on the nature of the...

Nuance PDF Reader Detection (Windows SMB Login)

Detects the installed version of Nuance PDF Reader on Windows. The script logs in via smb, searches for Nuance PDF Reader in the registry and gets the version from registry SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

SuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 7447)

Mozilla Firefox has been updated to the 17.0.3ESR release. Important: due to compatibility issues, the Beagle plug-in for MozillaFirefox is temporarily disabled by this update. Besides the major version update from the 10ESR stable release line to the 17ESR stable release line, this update brings...

AZL-44421 CVE-2011-4969 affecting package python-genshi 0.7.9-1

Cross-site scripting XSS vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag...

Two Texas Bills Could Shape Mobile Privacy

Two bills introduced in Texas this week could refine mobile privacy in the state and tweak how law enforcement can request sensitive information from cell phones going forward. A press release from the Texas Electronic Privacy Coalition TxEPC credits Bryan Hughes, a Republican from the town of...

CVE-2013-2488

The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of service application crash via a large offset value that triggers write access to an...

Android platform and exposure feel free to turn on and turn off the phone wifi function vulnerability-vulnerability warning-the black bar safety net

Disclosure of status: 2013-03-05: positive contact vendors and wait for manufacturers to claim, details not open to the public 2013-03-05: vendor has been active ignored vulnerabilities, the details disclosed to the public Brief description: The Settings application contains com. android. setting...

How Much Does A Botnet Cost?

The cost of a botnet is contingent largely upon the physical location of the malware-infected computers inside of it. Therefore, a botnet containing only American or European machines is worth more than one with machines from less prosperous nations. Security researcher Dancho Danchev recently...

CPOs Challenged with Meeting Privacy Expectations and Maintaining Full User Experience

SAN FRANCISCO – People who interact with online services have mounting privacy expectations that run in parallel with their need for a full experience with the functionality central to those services. But can users have their privacy cake and eat it too? That’s the challenging question facing...

ABC hacked after anti-Islam politician Interview

The Australian Broadcasting Corporation ABC is investigating data breach after Lateline interviewed Dutch anti-Islam politician Geert Wilders. A hacker going by the handle "Phr0zenMyst" has claimed to have hacked a web site associated with the ABC television program Making Australia Happy, leakin...

Ubuntu Update for firefox USN-1729-1

Check for the Version of firefox OpenVAS Vulnerability Test $Id: gbubuntuUSN17291.nasl 8483 2018-01-22 06:58:04Z teissa $ Ubuntu Update for firefox USN-1729-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free softwar...

Ubuntu: Security Advisory (USN-1729-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...