CVE-2012-4528: Undefined Security Weakness

The modsecurity2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data...

PT-2012-5461

Name of the Vulnerable Software and Affected Versions mod security2 versions prior to 2.7.0 Description The issue allows remote attackers to bypass rules and deliver arbitrary POST data to a PHP application via a multipart request where an invalid part precedes the crafted data. This can be...

University of Michigan Health Systems Admits Patient Data Stolen

UPDATE – Some 4,000 University of Michigan Health Systems patients had their medical data compromised last month when a vendor’s laptop containing medication log files was stolen from a vehicle. That medication management provider, Mountain View, Calif.-based Omnicell, admits it violated both its...

Fedora 17 : openvswitch-1.4.2-5.fc17 (2012-17477)

Don't create world-writable pki//incoming directory Don't add iptables accept rule for -p GRE as GRE tunneling is unsupported Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean a...

[360-FAAR] Firewall Analysis Audit And Repair 0.3.6

360-FAAR Firewall Analysis Audit and Repair is an offline, command line, Perl firewall policy manipulation tool to filter, compare to logs, merge, translate and output firewall commands for new policies, in Checkpoint dbedit, Cisco ASA or ScreenOS commands, and its one file! Read Policy and Logs...

ModSecurity 2.6.8 Bypass

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: ModSecurity multipart/invalid part ruleset bypass product: ModSecurity vulnerable version: = 2.6.8 fixed version: 2.7.0 CVE number: - impact: Depends what you use it for...

Arbitrary resource file download in urlrewrite.xml

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-26888. panel There is an arbitrary resource file download vulnerability triggered by a third party library...

Asterisk Peer IAX2 Call Handling ACL Rule Bypass (AST-2012-013)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a vulnerability that could allow a remote, authenticated attacker to bypass access controls on out-bound calls. Inter-Asterisk eXchange IAX2 out-bound call restrictions can be...

PT-2012-5564

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.8.x through 1.8.15.0 Asterisk Open Source version 10.x through 10.7.0 Certified Asterisk versions 1.8.11 through 1.8.11-cert6 Asterisk Digiumphones versions 10.x.x-digiumphones through 10.7.0-digiumphones Asteri...

owasp-modsecurity-crs

!Travis build v3.3/devhttps://img.shields.io/travis/spiderlab...

Senator Seeks to Strengthen SEC-Required Cybercrime Reporting

U.S. Sen. Jay Rockefeller wants to strengthen SEC legislation that requires publicly traded companies disclose significant digital security breaches, mainly because most aren’t. The chairman of the Senate Commerce, Science and Transportation Committee last week added a provision to cybersecurity...

CVE-2011-0006: Undefined Security Weakness

The imalsmruleinit function in security/integrity/ima/imapolicy.c in the Linux kernel before 2.6.37, when the Linux Security Modules LSM framework is disabled, allows local users to bypass Integrity Measurement Architecture IMA rules in opportunistic circumstances by leveraging an administrator's...

MDVA-2012:044 : timezone

Timezone is a package that contains data files with rules for various timezones around the world. This update addresses the following changes: - Fiji adopts DST for 2011 effective Oct 23rd, 2011 - West Bank changes date for DST end in 2011 to Sep 30th - Fix DST for: Pridnestrovian Moldavian...

PHP-CGI query string parameter vulnerability

Overview PHP-CGI-based setups contain a vulnerability when parsing query string parameters from php files. Description According to PHP's website, "PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML." When PHP is use...

PT-2012-1249 · Netfilter +3 · Iptables +3

Name of the Vulnerable Software and Affected Versions: iptables versions through 1.4.21 Description: The issue is related to insufficient input validation in the extensions/libxt tcp.c component of the iptables interface, which could allow a remote attacker to access confidential data, compromise...

httpd: http 0.9 request bypass of the reverse proxy vulnerability CVE-2011-3368 fix

The modproxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of 1 RewriteRule and 2 ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to...

Joomla Rule Local File Inclusion

Joomla Component comrule LFI Vulnerability x Author : thecybernuxbie x Home : www.thecybernuxbie.com x E-mail : [email protected] x Found : 24 January 2012. x Tested : Windows 7 Ultimate. x Dork : inurl:"/index.php?option=comrule" x Vuln Exploit Report:...

PT-2011-5168 · Php · Phpids

Name of the Vulnerable Software and Affected Versions: PHPIDS versions prior to 0.7 Description: The issue allows remote attackers to bypass rulesets and add PHP sequences to a file due to improper implementation of Regular Expression Denial of Service ReDoS filters. Recommendations: For versions...

DEBIAN-CVE-2011-4317

The modproxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of 1 RewriteRule and 2 ProxyPassMatch pattern matches for configuration of a reverse proxy, which...

CVE-2011-1371

Cross-site scripting XSS vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an Unknown Error document, a different vulnerability than CVE-2011-4171...