CVE-2012-2451

The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack. NOTE: some of these details are obtained from third party information. NOTE: it has been reported that this might only be...

USN-1475-1: APT update

Georgi Guninski discovered that APT relied on GnuPG argument order and did not check GPG subkeys when validating imported keyrings via apt-key net-update. While it appears that a machine-in-the-middle attacker cannot exploit this, as a hardening measure this update adjusts apt-key to validate all...

Android.Bmaster Exploits root access to connect to Botnet

Android.Bmaster Exploits root access to connect to Botnet A new piece of Android malware named Android.Bmaster, first highlighted by researcher Xuxian Jiang at North Carolina State University, was uncovered on a third-party marketplace and is bundled with a legitimate application for configuring...

IT-Grundschutz M4.040: Verhinderung der unautorisierten Nutzung des Rechnermikrofons

IT-Grundschutz M4.040: Verhinderung der unautorisierten Nutzung des Rechnermikrofons. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94203 Diese Prüfung bezieht sich a...

Another Dutch CA, KPN, Stops Issuing Certificates After Finding DDoS Tool On Server

Another Dutch certificate authority, KPN, has stopped issuing digital certificates after finding attack tools on a server in its Web infrastructures. The CA said that while it doesn’t have evidence right now that it’s CA infrastructure was compromised, it is taking the actions as a precaution. Th...

Nokia developer forum Hacked by pr0tect0r AKA mrNRG

Nokia website Hacked by pr0tect0r AKA mrNRG NOKIA , One of the biggest Telecommunications Internet Computer software Company Website hacked by Indian Hacker "pr0tect0r AKA mrNRG" . He Deface the developer.nokia.com sub-domain of NOKIA and also Redirect Another page to Custom Created Page. Hacker...

PHPBoost 3.0 Remote Download Backup Vulnerability

Exploit for php platform in category web applications Title : PHPBoost 3.0 Remote Download Backup Vulnerability Author : KedAns-Dz E-mail : email protected Home : HMD/AM 30008/04300 - Algeria -00213555248701 Twitter page : twitter.com/kedans platform : php Impact : Download Backup Database .sql...

IT-Grundschutz M4.036: Sperren bestimmter Faxempfänger-Rufnummerne

IT-Grundschutz M4.036: Sperren bestimmter Faxempfänger-Rufnummerne. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94201 Diese Prüfung bezieht sich auf die 10...

IT-Grundschutz M4.093: Regelmäßige Integritätsprüfung

IT-Grundschutz M4.093: Regelmäßige Integritätsprüfung ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94209 Diese Prüfung bezieht sich auf die 11. Ergänzungslieferung 1...

IT-Grundschutz M4.186: Entfernen von Beispieldateien und Administrations-Scripts des IIS (Windows)

IT-Grundschutz M4.186: Entfernen von Beispieldateien und Administrations-Scripts des IIS Windows ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde zudem in neueren EL gestrichen. Diese Prüfung bezieht sich auf die 10. Ergänzungslieferung 10. EL des IT- Grundschutz. Die detaillierte...

New BIOS available for Intel® Desktop Board products BIOS to prevent unauthorized downgrading to a previous BIOS version.

Summary: New BIOS is available for Intel® Desktop Board products BIOS to prevent downgrading to a previous BIOS version without supervisor/admin permission. Description: To prevent an unauthorized user from flashing Intel® Desktop Board products to a previous BIOS version without an explicit...

Tandberg MXP F7.0 (USER) Remote Buffer Overflow PoC

No description provided by source. TANDBERG BoF v0.1 - Tandberg MXP F7.0 Buffer Overflow Vulnerability PoC By otokoyama + We crash the process FtpCt00 by sending a 251 char string of /x20 commonly known as a blank space.very simple + The BOF happens due to the system passing all usernames:passwor...

Tandberg MXP F7.0 - USER Remote Buffer Overflow (PoC)

Tandberg MXP F7.0 - USER Remote Buffer Overflow PoC TANDBERG BoF v0.1 - Tandberg MXP F7.0 Buffer Overflow Vulnerability PoC By otokoyama + We crash the process FtpCt00 by sending a 251 char string of /x20 commonly known as a blank space.very simple + The BOF happens due to the system passing all...

Tandberg MXP F7.0 - 'USER' Remote Buffer Overflow (PoC)

TANDBERG BoF v0.1 - Tandberg MXP F7.0 Buffer Overflow Vulnerability PoC By otokoyama + We crash the process FtpCt00 by sending a 251 char string of /x20 commonly known as a blank space.very simple + The BOF happens due to the system passing all usernames:passwords to a log file. + Vendor has fixe...

Microsoft IE对象处理内存破坏漏洞

Internet Explorer是微软公司开发的广为流行的网络浏览器。 IE在处理畸形格式的网页标记时存在内存对象处理错误，远程攻击者可能利用此漏洞通过精心构造恶意标记数据导致IE处理时执行攻击者指定的任意指令。 此漏洞目前被挂马攻击者积极利用来向用户系统植入恶意软件，而且微软还未发布针对此漏洞的补丁。 Microsoft Internet Explorer 7.0 临时解决方法： 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 暂时不要使用IE 7浏览网页，可以使用Opera或Firefox。...

drupal -- multiple vulnerabilities

The Drupal Project reports: A logic error in the core upload module validation allowed unprivileged users to attach files to content. Users can view files attached to content which they do not otherwise have access to. If the core upload module is not enabled, your site will not be affected. A...

CVE-2008-2019

Simple Machines Forum SMF, probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file aka audio CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated attack that considers Hamming distances. NOTE: this issue reportedly exists...

HTTP content scanning systems full-width/half-width Unicode encoding bypass

Overview Various HTTP content scanning systems fail to properly scan full-width/half-width Unicode encoded traffic. This may allow malicious HTTP traffic to bypass content scanning systems. Description Full-width and half-width encoding is a technique for encoding Unicode characters. Various HTTP...

IM+本地明文用户名口令泄露漏洞

IM+是一款即时消息软件，允许用户同时连接到多个即时消息帐号。 IM+在处理存储用户名口令时存在漏洞，本地攻击者可能利用此漏洞轻易获取认证信息。 IM+没有使用任何安全措施或加密保护即时消息帐号的用户名和口令。恶意用户可以在\Program Files\IMPlus目录下获得implus.cfg文件，然后使用文本编辑器打开该文件，浏览所有帐号信息，包括明文的用户名和口令。 SHAPE Services IM+ v3.10 for Pocket PC 我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Mail Multiple Information Disclosure — Mozilla

As a privacy measure to prevent senders primarily spammers from tracking when e-mail is read Thunderbird does not load remote content referenced from an HTML mail message until a user tells it to do so. This normally includes the content of frames and CSS files, but CrashFr showed it was possible...