UBUNTU-CVE-2014-2893

The GetHTMLRunDir function in the scan-build utility in Clang 3.5 and earlier allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names...

DEBIAN-CVE-2012-0871

The sessionlinkx11socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/...

java-1.7.0-openjdk security update

1.7.0.55-2.4.7.1.0.1.el510 - Add oracle-enterprise.patch - Fix DISTRONAME to 'Enterprise Linux' 1.7.0.55-2.4.7.1.el5 - regenerated sources to fix TCK failure - Resolves: rhbz1085000 1.7.0.55-2.4.7.0.el5 - bumped to future icedtea-forest 2.4.7 - updatever set to 55, buildver se to 13, release rese...

Beware of Zeus Banking Trojan Signed With Valid Digital Signature

A new dangerous variant of ZeuS Banking Trojan has been identified by Comodo AV labs which is signed by stolen Digital Certificate which belongs to Microsoft Developer to avoid detection from Web browsers and anti-virus systems. Every Windows PC in the world is set to accept software "signed" wit...

Over 20Gbps DDoS attacks Now Become Common for Hackers

The Distributed Denial of Service DDoS attack has become more sophisticated and complex and therefore has become one of the favorite weapon for the cyber criminals to temporarily suspend the services of any host connected to the Internet and till now nearly every big site had been a victim of thi...

initramfs-tools未明安全漏洞

Bugtraq ID:66414 initramfs-tools是一款linux下生成initramfs的工具。 initramfs-tools没有用noexec选项不正确安装/run，可导致不明漏洞。 0 initramfs-tools Ubuntu linux用户可参考如下厂商提供的安全公告获得补丁信息： http://www.ubuntu.com/usn/usn-2153-1/...

Ubuntu: Security Advisory (USN-2153-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

initramfs-tools weak permissions

/run is mounted withour noexec option...

Kemana Directory 1.5.6 (run param) Local File Inclusion Vulnerability

Summary Experience the ultimate directory script solution with Kemana. Create your own Yahoo or Dmoz easily with Kemana. Unique Kemana's features including: CMS engine based on our qEngine, multiple directories support, user friendly administration control panel, easy to use custom fields,...

USN-2153-1: initramfs-tools vulnerability

Kees Cook discovered that initramfs-tools incorrectly mounted /run without the noexec option, contrary to expected behaviour...

UBUNTU-CVE-2013-4433

Cross-site scripting XSS vulnerability in XHProf before 0.9.4 allows remote attackers to inject arbitrary web script or HTML via the run parameter...

CVE-2013-4433

Cross-site scripting XSS vulnerability in XHProf before 0.9.4 allows remote attackers to inject arbitrary web script or HTML via the run parameter...

Safari User-Assisted Download and Run Attack

This module abuses some Safari functionality to force the download of a zipped .app OSX application containing our payload. The app is then invoked using a custom URL scheme. At this point, the user is presented with Gatekeeper's prompt: "APPNAME" is an application downloaded from the internet. A...

Stable Channel Update for Chrome OS

Update: Samsung Chromebook has been updated to 33.0.1750.124 Platform version: 5116.88.2 The Stable channel has been updated to 33.0.1750.124 Platform version: 5116.88.0 for all Chrome OS devices except Samsung Chromebook. This build contains a number of bug fixes, security updates and feature...

JGroups: Authentication via cached credentials

The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information diagnostic information and execute arbitrary code by reusing valid credentials...

Android 4.3 Superuser Root Privilege Escalation Vulnerability

The Superuser package for Android 4.3 allows a user to spawn /system/xbin/su with manipulated environment variables to execute code as root. Current releases of the CyanogenMod/ClockWorkMod/Koush Superuser package may allow restricted local users to execute arbitrary commands as root in certain,...

Threat Outbreak Alert: Fake Payroll Alert Notification Email Messages on October 30, 2013

Medium Alert ID: 31567 First Published: 2013 October 30 19:00 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payroll alert notification for the recipient. The text in the email message attempts to convince the recipie...

[Web-Sorrow v1.5] Versatile security scanner for the information disclosure and fingerprinting phases of pentesting

Web-Sorrow is a perl based tool for misconfiguration, version detection, enumeration, and server information scanning. It's entirely focused on Enumeration and collecting Info on the target server. Web-Sorrow is a "safe to run" program, meaning it is not designed to be an exploit or perform any...

DEBIAN-CVE-2013-4112

The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information diagnostic information and execute arbitrary code by reusing valid credentials...

Windows Gather Prefetch File Information

This module gathers prefetch file information from WinXP, Win2k3 and Win7 systems and current values of related registry keys. From each prefetch file we'll collect filetime converted to utc of the last execution, file path hash, run count, filename and the execution path. This module requires...