CollabNet Subversion Edge Management 4.0.11 - Local File Inclusion

CollabNet Subversion Edge Management 4.0.11 - Local File Inclusion Vuln Title: Local file inclusion in CollabNet Subversion Edge Management Frontend via logfile "fileName" parameter of the "tail" action Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge...

CollabNet Subversion Edge Management Show LFI

Vuln Title: Local file inclusion in CollabNet Subversion Edge Management Frontend via "fileName" parameter of the show action Date: 10.10.2014 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: Local file...

Threat Outbreak Alert RuleID14705: Email Messages Distributing Malicious Software on April 15, 2015

Medium Alert ID: 38405 First Published: 2015 April 15 22:12 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14705 and RuleID14705KVR may contain the followi...

House Takes First Steps on Federal Data Breach Law

The House Subcommittee on Commerce, Manufacturing and Trade today held its first hearing of the 114th Congress in order to begin work on developing federal data breach legislation. Pre-hearing memos suggested that any data breach notification law would be primarily concerned with protecting...

NSA Surveillance Reform Demonstrate Need for Public Scrutiny

The Snowden leaks and the ensuing critical spotlight shone on the National Security Agency’s surveillance programs have nudged many technologists, privacy hounds and politicians away from their desks and onto the front lines calling for reforms. Two nights ago, the New York Times reported that...

White House Proposal Would End NSA Metadata Program

Privacy advocates are cautiously applauding the reports that the Obama administration will unveil a legislative proposal to end the National Security Agency’s collection of Americans’ bulk phone records, but are concerned what the fine print on that proposal might hold. “Given all the various way...

Bangladeshi Hackers defaced BCCI website after Board approves ICC takeover proposal

Apart from various Government websites falling victim to Hacking attacks, the latest to be targeted by hackers belongs to the world's richest cricket Board, the Board of Control for Cricket in India BCCI. Late night on 26th January 65th Republic Day of India, the official website of Indian...

CSRF in gadgets plugin

The affected methods are: AddOrRemoveGadgetSpecAction, doAdd AddOrRemoveGadgetSpecAction, doRemove AddOrRemoveGadgetFeedAction, doAddGadgetFeed AddOrRemoveGadgetFeedAction, doRemoveGadgetFeed WhitelistAdminAction, doAddWhitelistUrl WhitelistAdminAction, doRemoveWhitelistUrl RevokeOAuthTokensActio...

Threat Outbreak Alert: Fake Online Business Proposal Email Messages on July 4, 2013

Medium Alert ID: 29952 First Published: 2013 July 5 12:55 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a business proposal for the recipient. The text in the email message attempts to convince the recipient to open th...

IETF Approves HSTS as Proposed Standard

One of the things that makes attackers dance around their basement lairs is finding unencrypted Web sessions. Sites that don’t give users the option to use HTTPS make life that much easier for attackers trying to hijack users’ Web sessions or eavesdrop on them. The IETF has taken a big step towar...

Moxie Marlinspike on TACK, Convergence and Trust Agility

Dennis Fisher talks with Moxie Marlinspike about his new IETF proposal, TACK, which lays out a way for sites to assert the authenticity of their public keys. They also discuss the Convergence system for replacing the CA infrastructure and the ways in which browser vendors can help enable better...

CVE-2011-4552

Multiple cross-site scripting XSS vulnerabilities in One Click Orgs before 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the description field of 1 a new vote or 2 the eject member proposal feature...

CVE-2011-4552

Multiple cross-site scripting XSS vulnerabilities in One Click Orgs before 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the description field of 1 a new vote or 2 the eject member proposal feature...

Google Researchers Propose New Plan to Shore Up CA System

The security industry has no shortage of hard problems to solve, but the one that’s getting the most attention right now is finding a way to improve, or ideally, replace, the CA infrastructure. The latest in what has become a series of recent proposals to help shore up the certificate authority...

Universal Computer Authentication to Fight Spam

Spam has been a scourge on the Internet for more than 15 years now, and many plans and technologies have emerged to try and fight it. Some have worked well, others have failed miserably. In this video, MIchael Kaplan presents a proposal for authenticating every mail transfer agent on the Web as a...

White House Unveils Cybersecurity Legislative Agenda

The White House proposed Thursday reforming the Federal Information Security Management Act by formalizing the Department of Homeland Security role in managing cybersecurity for the federal government's civilian computers and networks. What the Obama administration does not propose is the...

Microsoft Submits Tracking Protection Proposal to W3C

Microsoft has submitted its proposal for web tracking protection to the W3C for consideration as a standard, hoping to get the organization’s stamp of approval for its browser privacy technology. The proposal is in the earliest stages of the process and has not been approved, a process that can...

Cybersecurity bill tries to standardize software security

From Educated Guesswork Eric Rescorla The received wisdom in the security industry is that trying to qualitatively assess the security of a given piece of software is an incredibly difficult task. Some of the sharpest minds in software security–Gary McGraw, Brian Chess and Michael Howard among...

GLSA-200812-03 : IPsec-Tools: racoon Denial of Service

The remote host is affected by the vulnerability described in GLSA-200812-03 IPsec-Tools: racoon Denial of Service Two Denial of Service vulnerabilities have been reported in racoon: The vendor reported a memory leak in racoon/proposal.c that can be triggered via invalid proposals CVE-2008-3651...

ipsec-tools: racoon memory leak caused by invalid proposals

Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools before 0.7.1 allows remote authenticated users to cause a denial of service memory consumption via invalid proposals...