Agent-XSS

An XSS Channel is an interactive communication channel between two systems which is opened by an XSS attack. At a technical level, it is a type of AJAX application which can obtain commands, send responses back and is able to talk cross-domain. // Exploit Pack server - Change 127.0.0.1 to your IP...

IBM Capacity Management Analytics Local Information Disclosure Vulnerability

IBM Capacity Management Analytics is a suite of capacity management analytics solutions from IBM USA for managing and predicting the usage of IBM zEnterprise infrastructure mainframe computer resources. A local information disclosure vulnerability exists in IBM Capacity Management Analytics. A...

Umbraco CMS Security Bypass Vulnerability

Umbraco CMS is a Danish Umbraco company using ASP.Net build , Mysql for data storage content management system CMS. The system supports customized templates , manage users , rights definition of content and so on. A security bypass vulnerability exists in Umbraco CMS. The vulnerability allows...

Delicate Hardware Hacks Could Unlock Shooter's iPhone

A researcher at IOActive believes the U.S. intelligence community has the capability to carry out a delicate hardware hack that could unlock the iPhone 5c at the center of the current FBiOS debate. The attack requires considerable financial resources and acumen with an intrusive attack against th...

Why shellcode analysis is difficult-vulnerability warning-the black bar safety net

Shellcode should be safe the areas of the core one of the things. toc We discuss the common shellcode analysis of the difficulty. shellcode is too full of imagination, itself the exploit is very imaginative, the use way is also very imaginative. Get additional resources Many of the shellcode is...

Security Advisory - Privilege Escalation Vulnerability in Huawei Policy Center

Huawei Policy Center dynamically allocates network resources in a unified manner, enabling the network to provide services with more agility. Huawei Policy Center has a privilege escalation vulnerability. An attacker could log in to the device as a low-privilege user, craft a URL that contains...

Google Kubernetes API Server Security Bypass Vulnerability

Google Kubernetes is an open source Docker container cluster management system. The system provides resource scheduling, deployment and operation, service discovery and scaling up and down for containerized applications. Google Kubernetes' API server failed to properly check admission control for...

[SECURITY] Fedora 23 Update: prosody-0.9.10-1.fc23

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

CVE-2015-7546

The identity service in OpenStack Identity Keystone before 2015.1.3 Kilo and 8.0.x before 8.0.2 Liberty and keystonemiddleware formerly python-keystoneclient before 1.5.4 Kilo and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers,...

CVE-2015-7546

The identity service in OpenStack Identity Keystone before 2015.1.3 Kilo and 8.0.x before 8.0.2 Liberty and keystonemiddleware formerly python-keystoneclient before 1.5.4 Kilo and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers,...

PYSEC-2016-20

The identity service in OpenStack Identity Keystone before 2015.1.3 Kilo and 8.0.x before 8.0.2 Liberty and keystonemiddleware formerly python-keystoneclient before 1.5.4 Kilo and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers,...

Design/Logic Flaw

The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object...

Authorization

The identity service in OpenStack Identity Keystone before 2015.1.3 Kilo and 8.0.x before 8.0.2 Liberty and keystonemiddleware formerly python-keystoneclient before 1.5.4 Kilo and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers,...

CVE-2015-7546

The identity service in OpenStack Identity Keystone before 2015.1.3 Kilo and 8.0.x before 8.0.2 Liberty and keystonemiddleware formerly python-keystoneclient before 1.5.4 Kilo and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers,...

CVE-2015-7546

The identity service in OpenStack Identity Keystone before 2015.1.3 Kilo and 8.0.x before 8.0.2 Liberty and keystonemiddleware formerly python-keystoneclient before 1.5.4 Kilo and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers,...

CVE-2016-1905

The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object...

SEE - Sandboxed Execution Environment

Sandboxed Execution Environment SEE is a framework for building test automation in secured Environments. The Sandboxes, provided via libvirt, are customizable allowing high degree of flexibility. Different type of Hypervisors Qemu, VirtualBox, LXC can be employed to run the Test Environments...

Unspecified Vulnerability in Oracle E-Business Suite Oracle Human Resources Person Component

Oracle E-Business Suite is a new generation of e-business suite from Oracle. An unspecified security vulnerability exists in the Oracle E-Business Suite Oracle Human Resources Person component, which allows remote attackers to exploit the vulnerability by submitting a special request to access an...

Unspecified vulnerability in Oracle E-Business Suite Oracle Human Resources General utilities component (CNVD-2016-00620)

Oracle E-Business Suite is a new generation of e-business suite from Oracle. An unspecified security vulnerability exists in the Oracle E-Business Suite Oracle Human Resources General utilities component, which allows remote attackers to exploit the vulnerability to submit special requests to...

Oracle E-Business Suite Oracle Human Resources Self Service - Unspecified Vulnerability in Common Modules Component

Oracle E-Business Suite is a new generation of e-business suite from Oracle. An unspecified security vulnerability exists in the Oracle E-Business Suite Oracle Human Resources Self Service - Common Modules component, which could be exploited by remote attackers to submit a special request to acce...