CVE-2011-4552: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in One Click Orgs before 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the description field of 1 a new vote or 2 the eject member proposal feature...

Google Researchers Propose New Plan to Shore Up CA System

The security industry has no shortage of hard problems to solve, but the one that’s getting the most attention right now is finding a way to improve, or ideally, replace, the CA infrastructure. The latest in what has become a series of recent proposals to help shore up the certificate authority...

Universal Computer Authentication to Fight Spam

Spam has been a scourge on the Internet for more than 15 years now, and many plans and technologies have emerged to try and fight it. Some have worked well, others have failed miserably. In this video, MIchael Kaplan presents a proposal for authenticating every mail transfer agent on the Web as a...

White House Unveils Cybersecurity Legislative Agenda

The White House proposed Thursday reforming the Federal Information Security Management Act by formalizing the Department of Homeland Security role in managing cybersecurity for the federal government's civilian computers and networks. What the Obama administration does not propose is the...

Microsoft Submits Tracking Protection Proposal to W3C

Microsoft has submitted its proposal for web tracking protection to the W3C for consideration as a standard, hoping to get the organization’s stamp of approval for its browser privacy technology. The proposal is in the earliest stages of the process and has not been approved, a process that can...

Cybersecurity bill tries to standardize software security

From Educated Guesswork Eric Rescorla The received wisdom in the security industry is that trying to qualitatively assess the security of a given piece of software is an incredibly difficult task. Some of the sharpest minds in software security–Gary McGraw, Brian Chess and Michael Howard among...

GLSA-200812-03 : IPsec-Tools: racoon Denial of Service

The remote host is affected by the vulnerability described in GLSA-200812-03 IPsec-Tools: racoon Denial of Service Two Denial of Service vulnerabilities have been reported in racoon: The vendor reported a memory leak in racoon/proposal.c that can be triggered via invalid proposals CVE-2008-3651...

ipsec-tools: racoon memory leak caused by invalid proposals

Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools before 0.7.1 allows remote authenticated users to cause a denial of service memory consumption via invalid proposals...

Seperate label permissions from edit issue permission

In 3.11 the labels plugin changed so that manipulating labels required the "Edit Issue" permission. This drastically impacted our organizations workflow, as we'd just introduced labels in our previous upgrade, and we don't give "edit issues" to all users, but we do want all authenticated users to...

Linux news 14.07.00

Linux Kernel pre-patch 2.4.0 test4-pre6 Вышел очередной, шестой по счету, пререлиз четвертого тестового ядра Linux Kernel 2.4.0. Подробнее: ftp://ftp.funet.fi/pub/linux/kernel/testing Домен .GNU По сообщению http://Wired.com, Free Software Foundation послали предложение в ICANN на регистрацию...