Tech Giants Update Transparency Reports with FISA Requests

Google, Microsoft, Facebook, Yahoo and LinkedIn wasted little time in disclosing what they could about requests for customer data made under the secret Foreign Intelligence Surveillance Act. One week after the Justice Department eased a gag order on reporting of FISA requests, the five tech giant...

Oracle Forms and Reports Database Vulnerability

Oracle Forms and Reports Database Vulnerability SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-3000

Summary: CVE-2012-3000 is an SQL injection vulnerability affecting multiple BIG-IP components (APM WebGUI, AVR WebGUI, and related WebGUIs) on BIG-IP LTM, GTM, ASM, Link Controller, PSM, Edge Gateway, Analytics, WebAccelerator, and WOM up to 11.2.x with specific HF3 fixes. Affected path/trigger: ...

Oracle Forms and Reports 11.1 - Arbitrary Code Execution

!/usr/bin/env ruby Exploit Title: Oracle Reports 11.1 About: Automated exploit for CVE-2012-3153/CVE-2012-3152 Google Dork: inurl:/reports/rwservlet/ Date: 01/28/2014 Exploit Author: Mekanismen Credits to: @misssudo for initial disclosure Reference: http://netinfiltration.com/ Vendor Homepage:...

Oracle Forms and Reports 11.1 - Arbitrary Code Execution

Oracle Forms and Reports 11.1 - Arbitrary Code Execution...

Oracle Forms and Reports 11.1 - Remote Exploit

Exploit for jsp platform in category remote exploits require 'uri' require 'open-uri' require 'openssl' OpenSSL::SSL::VERIFYPEER = OpenSSL::SSL::VERIFYNONE def uploadpayloaddest url =...

Oracle Reports Developer Version Release 9i to 10gr2 Database Disclosure

An undocumented PARSEQUERY function in Oracle Forms and Reports allows dumping database username and passwords unauthenticated. The patch / workaround just appears to obfuscate the issue but not actually address it. Affected systems include versions 9iAS, 9iDS, 10G DS and AS, and 10G AS...

Oracle Forms And Reports Database Disclosure

PARSEQUERY http://docs.oracle.com/cd/E1676401/bi.1111/b32121/pbrcla007.htmi640592 Description Use PARSEQUERY to parse an rwservlet query and display the constructed Reports Server command line. Syntax http://yourwebserver/reports/rwservlet/parsequery?server=servername&authid=username/password...

Syrian Electronic Army Hits CNN, Microsoft

Just like it’s done time and time before, the Syrian Electronic Army SEA broke into yet another media outlet late last week, hacking a handful of social media accounts belonging to CNN, including seven Twitter accounts and two Facebook accounts. CNN admitted the accounts were compromised in a pos...

[Autopsy] Digital Investigation Analysis

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory...

Moderate: Red Hat Security Advisory: jasperreports-server-pro security, bug fix, and enhancement update

An updated jasperreports-server-pro package that fixes two security issues, several bugs, and adds various enhancements is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CVE-2013-2594

The CVE-2013-2594 issue is a SQL injection in Hornbill Supportworks ITSM, affecting the reports/calldiary.php endpoint. Exploitation via the callref parameter could allow remote attackers to inject arbitrary SQL and, per multiple sources, may lead to full control of the host (e.g., writing a webs...

CVE-2013-5785

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.6, 11.1.1.7, and 11.1.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security and Authentication...

Authentication flaw

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.6, 11.1.1.7, and 11.1.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security and Authentication...

CVE-2013-5785

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.6, 11.1.1.7, and 11.1.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security and Authentication...

Oracle Forms and Reports Remote Code Execution

This module uses two vulnerabilities in Oracle Forms and Reports to get remote code execution on the host. The showenv url can be used to disclose information about a server. A second vulnerability that allows arbitrary reading and writing to the host filesystem can then be used to write a shell...

linux-flashplugin -- multiple vulnerabilities

Adobe reports: These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system...

How do I get my data out of Nexpose? Answer: SQL Query Export

Do any of these these questions sound familiar? "Printable reports are really valuable and I use them on a daily basis. However, is there a section that I can add to show a summary by asset group or site?" "I really like the XML format, but its a little hard to process and I have to write code to...

EMC NetWorker information leakage

Cleartext password in audit reports...

ESA-2013-072: EMC NetWorker Information Disclosure Vulnerability

ESA-2013-072.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-072: EMC NetWorker Information Disclosure Vulnerability EMC Identifier: ESA-2013-072 EMC Identifier: NW152441 CVE Identifier: CVE-2013-3285 Severity Rating: CVSS v2 Base Score: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C Affected products...