The Tor Project to Beef Up Privacy with Next-Generation of Onion Services

The Tor Project has made some significant changes to its infrastructure by improving the way the 'onion' network protects its users' privacy and security. Since the beginning, the largest free online anonymity network has been helping users browse the web anonymously, and its onion service provid...

Connected Medicine and Its Diagnosis

Medical data is slowly but surely migrating from paper mediums to the digital infrastructure of medical institutions. Today, the data is "scattered" across databases, portals, medical equipment, etc. In some cases, the security of the network infrastructure of such organizations is neglected, and...

Avaya Patches Remote Code Execution Flaw in Aura

Internet telephony company Avaya has patched a high-severity vulnerability in its Aura Application Enablement Services product that put phone call and API data running through the server at risk for interception. Researchers at Digital Defense found a vulnerability where an attacker could, withou...

CVE-2016-0382

The IBM Tealeaf Consumer Experience 8.7, 8.8, and 9.0 portal exposes some of its operational state in a form that may be accidentally captured and exposed by network infrastructure components such as IIS. IBM X-Force ID: 112356...

CVE-2016-0382

The IBM Tealeaf Consumer Experience 8.7, 8.8, and 9.0 portal exposes some of its operational state in a form that may be accidentally captured and exposed by network infrastructure components such as IIS. IBM X-Force ID: 112356...

CVE-2016-0382

The IBM Tealeaf Consumer Experience 8.7, 8.8, and 9.0 portal exposes some of its operational state in a form that may be accidentally captured and exposed by network infrastructure components such as IIS. IBM X-Force ID: 112356...

CVE-2016-0382

The CVE-2016-0382 entry applies to IBM Tealeaf Customer Experience (Consumer Experience) versions 8.7 through 9.0.2, where the portal exposes some of its operational state in a form that may be accidentally captured and exposed by network infrastructure components such as IIS. The root cause is i...

Troubleshooting Retries on Provisioned Virtual Machines

What is a retry? When a target streams a vDisk image, it does so by requesting blocks of data from the PVS server, which in turn replies with the requested data. This data is broken down into several packets called fragments. A retry occurs when a target device requests data from the PVS server a...

SPARTA - Network Infrastructure Penetration Testing Tool

SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenien...

Reflected Cross-Site Scripting (XSS) in iTop

Advisory ID: HTB23268 Product: iTop Vendor: Combodo SARL Vulnerable Versions: 2.1.0-2127 and probably prior Tested Version: 2.1.0-2127 Advisory Publication: July 29, 2015 without technical details Vendor Notification: July 29, 2015 Vendor Patch: July 30, 2015 Public Disclosure: September 23, 2015...

Penn State Offline Following Advanced Two-Year Cyberattack

Penn State University President Eric J. Barron announced Friday that the university disconnected its networks from the public Internet after sustaining an intrusion into the College of Engineering that had lasted longer than two years. It will be a matter of days before Penn State brings its...

DNS Enumeration Script: DNSRecon

DNS reconnaissance is part of the information gathering stage on a penetration test engagement. When a penetration tester is performing a DNS reconnaissance he is trying to obtain as much information as he can regarding the DNS servers and their records. The information that can be gathered can...

Mozilla Deploying High-capacity Tor Middle Relays

Back in November, Mozilla teamed-up with Tor Project under a new initiative called Polaris, in order to help reduce finite number of Tor connections occurring at the same time by adding high-capacity Tor middle relays to the Tor network, and now the company is ready with its first Tor Middle...

SPARTA - Network Infrastructure Penetration Testing Tool

SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenien...

VoIP Penetration Testing Kit: Viproy

Viproy Voip Pen-Test Kit provides penetration testing modules for VoIP networks. It supports signalling analysis for SIP and Skinny protocols, IP phone services and network infrastructure. Viproy 2.0 is released at Blackhat Arsenal USA 2014 with TCP/TLS support for SIP, vendor extentions support,...

Lucent 8.x VitalNet Password Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3784/info VitalNet is part of Lucent's VitalSuite SP product family. VitalNet allows users to monitor, analyze, manage and predict the performance of their network infrastructure. The implementation of VitalNet's...

Nortel CVX 1800 Multi-Service Access Switch Default SNMP Community Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4507/info Nortel CVX 1800 Multi-Service Access Switch is a hardware modem bank. The device contains a default SNMP community string of public, which may allow enable a remote attacker to gain access to sensitive informati...

[musl] Security advisory for musl libc - remote stack-based buffer overflow in DNS response parsing [CVE-2014-3484]

A remote stack-based buffer overflow has been found in musl libc's dns response parsing code. The overflow can be triggered in programs linked against musl libc and making dns queries via one of the standard interfaces getaddrinfo, getnameinfo, gethostbyname, gethostbyaddr, etc. if one of the...

Points of Sale Poorly Secured, Facing Sophisticated Attacks

The point-of-sale PoS systems on which financial transactions are conducted at nearly every physical retail location in the U.S. and and beyond are fast becoming a favorite target for sophisticated criminal organizations as well as standalone attackers. The emergence of this trend is unsurprising...

Skybox Security 6.3.x - 6.4.x - Multiple Information Disclosure

Exploit for hardware platform in category web applications Exploit Title: SKYBOX Security – Multiple Information Disclosure Date: 22-Jan-2014 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.skyboxsecurity.com Version: Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.14,...