Java enabled browsers are highly vulnerable

Oracle has released emergency patches multiple of times in recent months for Java for one after another set of vulnerabilities. About 100 million computers reported to be vulnerable to unauthorized access via different flaw in Java software. Department of Homeland Security's US-CERT already warne...

PT-2013-2171 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.7.9 Description: The issue arises from the xen iret function in arch/x86/xen/xen-asm 32.S, which does not properly handle an invalid value in the DS segment register on 32-bit Xen paravirt ops platforms. This...

Medical Device Security in Need of Major Upgrade

Security researchers and hackers have spent the last 20 years or so tearing apart all manner of software and hardware, looking for vulnerabilities, attack vectors and bugs, and the advent of embedded and implantable devices has now drawn their attention to this new class of targets. Medical...

Increased Exploitation in Web Content Management Systems

US-CERT is aware of recent increases in the exploitation of known vulnerabilities in web content management systems CMSs such as Wordpress and Joomla. Compromised CMS installations can be used to host malicious content. US-CERT recommends that users and administrators ensure that their CMS...

Open Source Web Server Scanner: NIkto

Nikto is an Open Source GPL web server scanner which performs comprehensive tests against web servers for multiple items, including over 6500 potentially dangerous files/CGIs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks for...

CVE-2011-5117

Sophos SafeGuard Enterprise Device Encryption 5.x through 5.50.8.13, Sophos SafeGuard Easy Device Encryption Client 5.50.x, and Sophos Disk Encryption 5.50.x have a delay before removal of 1 out-of-date credentials and 2 invalid credentials, which allows physically proximate attackers to defeat t...

CVE-2012-2459

Unspecified vulnerability in bitcoind and Bitcoin-Qt before 0.4.6, 0.5.x before 0.5.5, 0.6.0.x before 0.6.0.7, and 0.6.x before 0.6.2 allows remote attackers to cause a denial of service block-processing outage and incorrect block count via unknown behavior on a Bitcoin network...

Potential remote code execution due to embedding of old django-piston

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-46819. panel The exposed atlassian api for forummodules found under forummodules/atlassian/api uses an outdated version of...

Potential remote code execution due to embedding of old django-piston

The exposed atlassian api for forummodules found under forummodules/atlassian/api uses an outdated version of django-piston which does not contain the fix for a remote code execution bug due to the use of yaml.load instead of safeload in the emitters.py python scripton line 412. Whilst it appears...

Nine Percent of Websites May be Malicious

Just fewer than 10 percent of websites serve some sort of malicious purpose, with an additional nine percent of sites being characterized as “suspicious” by Zscaler in a new research report. Zscaler ran 27,000 website URLs through a tool they developed to assess the security of websites and give...

Many Mac Users Running Vulnerable Java Versions

Researchers have known for a long time that many users don’t pay much attention to updating the third-party software, browser plugins and extensions, and that lack of care has been to the benefit of attackers for years. Attacks on Flash, Java, QuickTime and various other ubiquitous apps have been...

Default credentials

The Quantum Scalar i500 tape library with firmware before i7.0.3 604G.GS00100, also distributed as the Dell ML6000 tape library with firmware before A20-00 590G.GS00100 and the IBM TS3310 tape library with firmware before R6C 606G.GS001, uses default passwords for unspecified user accounts, which...

Experts Tell Senate: Government Networks Owned, Resistance Is Futile

Network security experts from across the U.S. government told a U.S. Senate Armed Services Subcommittee Tuesday that federal networks have been thoroughly penetrated by foreign spies, and that current perimeter-based defenses that attempt to curb intrusions are outdated and futile. Speaking befor...

Spybot Search & Destroy Signature Update Check

The remote host has an outdated version of the Spybot Search & Destroy detection rule signatures, or it has never been updated. As a result, the remote host might contain malware. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid58343; scriptversion"$Revision: 1.1 $";...

FreeBSD Ports: FreeBSD

The remote host is missing an update to the system as announced in the referenced advisory. VID f56390a4-4638-11e1-9f47-00e0815b8da8 OpenVAS Vulnerability Test $ Description: Auto generated from VID f56390a4-4638-11e1-9f47-00e0815b8da8 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

MySQL < 5.0.54 / 5.1.23 / 6.0.4 Denial of Service

The version of MySQL installed on the remote host is older than 5.0.54, 5.1.23 or 6.0.4. A remote attacker could crash the server by exploiting a flaw in InnoDB code. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17833; scriptversion"1.6"; scriptcvsdate"Date:...

UN Says Old Server, Old Data Exposed In TeamP0ison Hack

In the wake of a highly visible hack of its network infrastructure, a spokeswoman for the United Nations Development Programme UNDP says that hackers from the group TeamP0ison compromised an unpatched server and that e-mail addresses and account passwords exposed in the attack were outdated. Staf...

Lax Security to Blame for NASDAQ Hack

The cyber attack on the NASDAQ OMX Group late last year was the result of shoddy security, according to a new report via Reuters. Computers running NASDAQ’s Director’s Desk, the software that was breached, had faulty firewalls, missing security patches and were running outdated software, like...

UCLA psychology department database hacked by Inj3ctor

UCLA psychology department database hacked by Inj3ctor Inj3ctor team of Hackers take responsibility for the release of information from the psychology department's database which included the names, home addresses and dates of birth of 26 applicants to the university. The attacker also published...

Solaris 10 (x86) : 146672-10

SunOS 5.10x86: ssl patch. Date this patch was last updated by Sun : Aug/07/12 %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on 2013/06/09. C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0;...