openssl: DoS due to improper handling of OCSP response verification

OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service NULL pointer dereference and application crash via an invalid key...

mysql: unspecified DoS related to Information Schema (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Information Schema...

KindEditor (v.3.x->4.1.5) <= Multiple File/Shell Upload Vulnerability

This bug in KindEditor you can upload remote files .txt .html ...etc with multiple JSON upload langs type PHP / ASP / JSP / ASP.NET this bug found in old versions by some author , but is still work is latest version . - Latest V. is 4.1.5 , Released on Jan 19, 2013...

ruby: safe level bypass via name_err_mesg_to_str()

Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the nameerrmesgtostr API function, which marks the string as tainted, a different vulnerability than...

ASPCMS old version spike get SHELL-vulnerability warning-the black bar safety net

/admin/system/AspCmsSiteSetting. asp? action=saves Direct POST: runMode=1&siteMode=1&siteHelp=%B1%BE%CD%F8%D5%BE%D2%F2%B3%CC%D0%F2%C9%FD%BC%B6%B9%D8%B1%D5%D6%D0&SwitchComments=1&SwitchCommentsStatus=1&switchFaq=0:Y=requestchr3...

Authentication flaw

The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2 on UNIX and Linux, when old-style password authentication is enabled, allows remote attackers to bypass authentication via a crafted session...

MySQL - Remote User Enumeration

MySQL User Account Enumeration Utility When an attacker authenticates using an incorrect password with the old authentication mechanism from mysql 4.x and below to a mysql 5.x server the mysql server will respond with a different message than Access Denied, what makes User Account Enumeration...

NGS000267 Technical Advisory: Symantec Messaging Gateway SSH with backdoor user account plus privilege escalation to root due to very old Kernel

======= Summary ======= Name: Symantec Messaging Gateway - SSH with backdoor user account + privilege escalation to root due to very old Kernel Release Date: 30 November 2012 Reference: NGS00267 Discoverer: Ben Williams [email protected] Vendor: Symantec Vendor Reference: Systems Affecte...

JDK: unspecified vulnerability (Deployment)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than...

Skype Illegally handed over data of alleged Anonymous Paypal Hacker

Dutch media report Skype has Illegally without court order distributed a 16 years old user's personal information including user name, real name, email addresses and the home address used for payment to a private company consistently a police investigation into Anonymous-sanctioned cyber attacks ...

Android, Symbian Malware on the Rise

Yes. You read that headline correctly. F-Secure is talking about the beleaguered and nearly defunct Symbian operating system, upon which Nokia halted nearly all development in February before announcing that it had been put in maintenance mode in September. Despite a nearly 63 percent drop in...

OpenJDK: SecureRandom mulitple seeders information disclosure (Security, 7167656)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.238 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Security...

OpenJDK: JSSE denial of service (JSSE, 7186286)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.238 and earlier allows remote attackers to affect availability, related to JSSE...

BlackHole Exploit Kit 2.0 released with more latest Exploits

According to release announcement on Pastebin by unknown developers in a Russian-language BlackHole Exploit Kit 2.0 released with more latest Exploits. BlackHole is one of the most dominant exploit toolkits currently available in the underground market. It enables attackers to exploit security...

OpenJDK: insufficient field accessibility checks (HotSpot, 7152811)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.237 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to...

IBM WebSphere Application Server 7.0 < Fix Pack 21 Multiple Vulnerabilities

IBM WebSphere Application Server 7.0 before Fix Pack 21 appears to be running on the remote host. As such, it is potentially affected by the following vulnerabilities : - An unspecified cross-site scripting issue exists related to the 'Web 2.0 Messaging service'. PM37840 - A security exposure whe...

[SECURITY] Fedora 17 Update: libpng10-1.0.57-1.fc17

The libpng10 package contains an old version of libpng, a library of functi ons for creating and manipulating PNG Portable Network Graphics image format files. This package is needed if you want to run binaries that were linked dynamic ally with libpng 1.0.x...

Saudi hacker target Israeli stock exchange and National air carrier

Saudi hacker target Israeli stock exchange and National air carrier Saudi cyber Hacker OxOmar struck again on Monday. This time disrupted the websites of Israel's stock exchange and National air carrier. Last week he had leaked private information about more than 400,000 Israelis. Credit card...

kernel: incomplete fix for CVE-2011-2482

Race condition in the sctprcv function in net/sctp/input.c in the Linux kernel before 2.6.29 allows remote attackers to cause a denial of service system hang via SCTP packets. NOTE: in some environments, this issue exists because of an incomplete fix for CVE-2011-2482...

DEBIAN-CVE-2011-5025

Multiple cross-site scripting XSS vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via 1 the tag parameter to editTag.yaws, 2 the index parameter to showOldPage.yaws, 3 the node parameter to allRefsToMe.yaws, or 4 the text paramete...