CVE-2014-8834

UserAccountUpdater in Apple OS X 10.10 before 10.10.2 stores a PDF document's password in a printing preference file, which allows local users to obtain sensitive information by reading a file...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for requests that set a tracking preference within 1...

IBM Business Process Manager - User Account Reconfiguration

No description provided by source. Exploit Title: IBM BMPS BPM User account reconfiguration/Privilege Escalation/Information Disclosure Date: 31.01.14 Exploit Author: 0in Software link: http://www-03.ibm.com/software/products/en/business-process-manager-family/ Version: 8.0.1.1 newest versions ca...

Facebook Set to Let Users Edit Own Advertising Info

Facebook announced today it will soon be rolling out a new feature to give users more control when it comes to the types of advertisements they see on the site. If users are tired of getting barraged with ads for shoes, video games or discount plane tickets, they’ll not only be able to stop the...

Windows Gather Group Policy Preference Saved Passwords

This module enumerates the victim machine's domain controller and connects to it via SMB. It then looks for Group Policy Preference XML files containing local user accounts and passwords and decrypts them using Microsofts public AES key. Cached Group Policy files may be found on end-user devices ...

[Nessus 5.2] Nessus Vulnerability Scanner

New release of the Nessus vulnerability scanner! This is a major release moving from 5.0.3 to 5.2.0 and includes several new features and enhancements, including: IPv6 is now supported on all platforms including Windows Nessus server support for Windows 8 and Windows 2012 Add attachments within...

Apple Mac OS X 本地安全绕过漏洞

BUGTRAQ ID: 58512 CVECAN ID: CVE-2013-0969 Apple Mac OS X是苹果电脑操作系统软件。 Apple Mac OS X 10.8.3之前版本的登录窗口没有阻止应用用VoiceOver功能启动，允许物理位置接近的攻击者绕过身份验证并通过键盘更改系统首选项。 0 Apple Mac OS X 10.7.4 Apple Mac OS X 10.7.3 Apple Mac OS X 10.7.2 Apple Mac OS X 10.7.1 Apple Mac OS X Server 10.7.4 Apple Mac OS X Server...

CVE-2013-0969

Login Window in Apple Mac OS X before 10.8.3 does not prevent application launching with the VoiceOver feature, which allows physically proximate attackers to bypass authentication and make arbitrary System Preferences changes via unspecified use of the keyboard...

CentOS 6 : vino (CESA-2013:0169)

An updated vino package that fixes several security issues is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

squirrelmail: not fixed in RHSA-2012:0103

functions/imapgeneral.php in SquirrelMail, as used in Red Hat Enterprise Linux RHEL 4 and 5, does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service disk consumption by making many IMAP login attempts with different usernames, leading to...

PT-2013-1543 · Squirrelmail +1 · Squirrelmail +1

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions affected versions not specified Description: The issue is related to the handling of 8-bit characters in passwords by the functions/imap general.php file in SquirrelMail. This can be exploited by remote attackers to caus...

Leave information on scanned hosts

This routine stores information about the scan on the scanned host, provided it is a unixoid system offering ssh access with a standard shell. The information cover hostname, scan start time and scan end time. No details about the actual scan results are stored on the scanned host. By default, th...

Calling Foul on the Political Football That is Do Not Track

It looks like it’s time for a do-over for DNT. The oft-maligned specification has become—like many other standards efforts before it—a political football. Parties with interests on both sides of the issue have their own agendas, cannot agree on semantics and ignore, in this case, what should be t...

Firefox 17 Beta Released with Click-to-Play Plugins for blocking vulnerable Plugins

Last week, Mozilla announced it will prompt Firefox users on Windows with old versions of Adobe Reader, Adobe Flash, and Microsoft Silverlight, but refused to detail how the system will work. Finally today Firefox 17 is now in beta and with it is a very cool feature, click-to-play plugins. When a...

CVE-2012-5385

install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference...

CVE-2012-1367

The MallocLite implementation in Cisco IOS 12.0, 12.2, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service Route Processor crash via a BGP UPDATE message with a modified local-preference aka LOCALPREF attribute length, aka Bug ID CSCtq06538...

DEBIAN-CVE-2012-2054

Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the 1 Comment, 2 Document, 3 IssueCategory, 4 MembersController, 5 Message, 6 News, 7 TimeEntry, 8 Version, 9 Wiki, 10 UserPreference, o...

The Value Of Data Privacy To Consumers? About 65 Cents.

What is the value of data privacy to online shoppers? About 65 cents, according to a new study of by researchers in Britain and Germany. The report: “Study on Monetising Privacy: An Economic Model for Pricing Personal Information” was released in February and presents the results of work by...

thunderbird security update

1.5.0.12-46.0.1.el4 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Replaced clean.gif in tarball 1.5.0.12-46 - Added fixes from 1.9.2.26...

W3C Publishes Do Not Track Proposal

The W3C has proposed a standard for implementing the Do Not Track mechanism for both users and site owners, wading into what has become a contentious and fractious debate. The proposed standard, known as the Tracking Preference Expression, is designed to give users the ability to tell sites what...