OWASP ZAP 2.4.0 - Penetration Testing Tool for Testing Web Applications

ZAP is an OWASP Flagship project, and is currently the most active open source web application security tool. For a quick introduction to the new release see this video: Some of the most significant changes include: ‘Attack’ Mode A new ‘attack’ mode has been added that means that applications tha...

X (Formerly Twitter): Privacy Issue on protected tweets

Hello Twitter Security Team, Problem: Here is a privacy issue that break your privacy for protected tweets. Details: I have two accounts on twitter @dia2diab and @Dia2diabTest , from the first one i changed the settings of Tweet privacy to be "Protect my Tweets" and now if you access one of my...

DEBIAN-CVE-2015-2172

DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API...

UBUNTU-CVE-2015-2172

DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API...

jQuery jui filter rules Plugin 1.0.4 /ajax_create_sql.dist.php 命令执行漏洞

No description provided by source...

Scientific Linux Security Update : ipa on SL7.x x86_64 (20150305)

Two cross-site scripting XSS flaws were found in jQuery, which impacted the Identity Management web administrative interface, and could allow an authenticated user to inject arbitrary HTML or web script into the interface. CVE-2010-5312, CVE-2012-6662 Note: The IdM version provided by this update...

Multiple Cross-Site Scripting Vulnerabilities in pfSense

pfSense is a free, open-source customized version of FreeBSD designed for use as a firewall and router. Multiple cross-site scripting vulnerabilities exist in pfSense. The vulnerabilities are caused by passing the "queue" HTTP GET parameter to the "/firewallshaper.php" script, the "if" and...

CentOS 7 : ipa (CESA-2015:0442)

Updated ipa packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

ipa security update

CentOS Errata and Security Advisory CESA-2015:0442 Updated ipa packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerabilit...

Oracle Linux 7 : ipa (ELSA-2015-0442)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0442 advisory. - CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges 1165774 - CVE-2014-7828 freeipa: password not required when OTP in use 1160877...

damicms绕过防xss规则盲打后台(v4.9)

简要描述： damicms绕过防xss规则盲打后台v4.9 详细说明： 前台留言的地方，使用了getclientip ，代码如下。 使用了 removexss 来做过滤，但是可以这样来绕过 之后就可以弹窗了 漏洞证明：...

kernel: iptables restriction bypass if a protocol handler kernel module not loaded

A flaw was found in the way the Linux kernel's netfilter subsystem handled generic protocol tracking. As demonstrated in the Stream Control Transmission Protocol SCTP case, a remote attacker could use this flaw to bypass intended iptables rule restrictions when the associated connection tracking...

Moderate: Red Hat Security Advisory: ipa security, bug fix, and enhancement update

Updated ipa packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

PT-2015-5644

Name of the Vulnerable Software and Affected Versions DokuWiki versions before 2014-05-05d and before 2014-09-29c Description The issue allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the "XMLRPC API". Recommendations For versions before 2014-05-0...

USN-2516-3: Linux kernel vulnerabilities regression

USN-2516-1 fixed vulnerabilities in the Linux kernel, and the fix in USN-2516-2 was incomplete. There was an unrelated regression in the use of the virtual counter CNTVCT on arm64 architectures. This update fixes the problem. We apologize for the inconvenience. Original advisory details: A flaw w...

Vulnerability warning: the D-Link friends of the perbadanan Router the presence of a remote command injection vulnerability-vulnerability warning-the black bar safety net

Recently security researcher at D-Link friends of the perbadanan on the router discovered a serious security vulnerability, an attacker can remotely obtain device The maximum access to the Root, and hijacking DNS settings or on the device to execute arbitrary commands. As early as last 1 1 month,...

DEBIAN-CVE-2014-8160

net/netfilter/nfconntrackprotogeneric.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with...

Twitter Changes Abuse Reporting Process to Address Doxing

Twitter has revised and simplified its rules and process for reporting abusive behavior on the service, and users now have the ability to report people who are posting their personal information. The change essentially gives Twitter users a method to combat doxing, which is the process of dumping...

Ubuntu 14.10 : linux vulnerabilities (USN-2518-1)

A flaw was discovered in the Kernel Virtual Machine's KVM emulation of the SYSTENTER instruction when the guest OS does not initialize the SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of service of the guest OS crash or potentially gain privileges on the guest OS...

Ubuntu: Security Advisory (USN-2515-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...