kernel: /proc/PID/io infoleak

fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc//io files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by discovering the length of another user's password...

Android Passwords are stored in plain text on Disk

Android Passwords are stored in plain text on Disk A Android user complain that , All passwords are stored in plane text on Disk via a message on discussion board of Android. He said "The password for email accounts is stored into the SQLite DB which in turn stores it on the phone's file system i...

Anonymous leaks PSN SSH Logs, Sony is responsible for Data Theft ?

Anonymous leaks PSN SSH Logs, Sony is responsible for Data Theft ? 1. On the Sony servers running the highly outdated Open SSH version 4.4. 2. Current version is 5.7. For those of Sony for encrypted version are used for more than five years several known security holes. 3. Sony server running in...

National Nuclear Lab IT Systems at Risk

Confidential Information about the nation’s nuclear stockpile could be at risk according to an audit of Lawrence Livermore National Laboratory issued by the Department of Energy DOE earlier this week. The audit .PDF found the government-funded Bay Area-lab failed to effectively implement its...

Debian: Security Advisory (DSA-2180-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DHS Needs to Change Rules to Recruit Hackers into U.S. Security Agencies !

Members of the hacker community are leery of working with the government and sharing their skills, if it means navigating through outdated regulations and being viewed as potential security risks. Hackers and other computer experts willing to collaborate with the Department of Homeland Security t...

kernel: heap contents leak for CAP_NET_ADMIN via ethtool ioctl

net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the CAPNETADMIN capability for an ethtool ioctl call...

JDK unspecified vulnerability in Install component

Unspecified vulnerability in the Java Runtime Environment JRE in Oracle Java SE and Java for Business 6 Update 23 and earlier for Windows, when using Java Update, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install...

Android < 2.3 Multiple Vulnerabilities

Binary data 5737.prm...

Microsoft .NET Framework Service Pack Out of Date

The remote system has Microsoft .NET Framework installed. The installed version either has no service pack installed or the installed service pack version is out of date. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid51352; scriptversion"1.10";...

New Google service could be a godsend to scammers !

The Instant Previews service that Google launched last week allows users to click on the magnifying glass icon next to a result's title or on its background in order to see a preview of that result. There is no doubt that this feature is very helpful when it comes to skimming through legitimate...

FreeBSD Ports: FreeBSD

The remote host is missing an update to the system as announced in the referenced advisory. VID 97f09f2f-ca3f-11df-aade-0050568f000c OpenVAS Vulnerability Test $ Description: Auto generated from VID 97f09f2f-ca3f-11df-aade-0050568f000c Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

MDVA-2010:160-1 : heartbeat

The heartbeat package in the 2010.0 release had wrong permissions and ownership for /usr/bin/clstatus this prevented it from working correctly. Also when peers were outdated heartbeat didn't failover gracefully. This update fixes both these issues. Update: Packages for 2009.0 and MES5 were missin...

Cisco WRV210 null pointer dereference

Exploit for windows platform in category dos / poc ===================================== Cisco WRV210 null pointer dereference ===================================== / 2010-09-24 by Paolo j5r9pn3lka yahoo dot com Product: Cisco WRV210 Wireless-G VPN Router - RangeBooster Type: denial of service...

MDVA-2010:160 : heartbeat

The heartbeat package in the 2010.0 release had wrong permissions and ownership for /usr/bin/clstatus this prevented it from working correctly. Also when peers were outdated heartbeat didn't failover gracefully. This update fixes both these issues. %NASLMINLEVEL 70300 @DEPRECATED@ This script has...

Немец выпустил «самую уязвимую ОС» на базе Linux

Торстен Шнайдер, преподаватель с факультета технологий Университета Билефельда, что находится в Германии, выпустил Damn Vulnerable Linux — специальный дистрибутив, который вобрал «все, чего не должно быть в хорошей Linux-системе». В составе Damn Vulnerable Linux — «ориентированное на взлом»...

Nuance OmniPage multiple security vulnerabilities

Current versions of Microsoft Windows libraries are replaces with outdated ones during installation process...

Research: 1.3 Million Malicious Ads Viewed Daily

The true extent of the malvertizing scourge became much clearer this week with the release of new research by Dasient which shows that about 1.3 million malicious ads are being viewed online everyday, most pushing drive-by downloads and fake security software. Dancho Danchev sums up the findings...

RSA SecurID Cross Site Scripting

Title: RSA SecurID XSS Discovered 12-11-2008 Discovered By: s4squatch of SecureState R&D Team www.securestate.com Vendor Notified: 10-07-2009 Vendor Response: 10-08-2009 Version: Unknown -- DLL does not contain version, therefore vendor says it is outdated and not supported. POC:...

RSA SecurID XSS Vulnerability

No description provided by source. view source print? Discovered 12-11-2008 Discovered By: s4squatch of SecureState R&D Team www.securestate.com Vendor Notified: 10-07-2009 Vendor Response: 10-08-2009 Version: Unknown -- DLL does not contain version, therefore vendor says it is outdated and not...