Debian DSA-2267-1 : perl - restriction bypass

It was discovered that Perl's Safe module - a module to compile and execute code in restricted compartments - could be bypassed. Please note that this update is known to break Petal, an XML-based templating engine shipped with Debian 6.0/Squeeze in the package libpetal-perl, see bug 582805 for...

[SECURITY] [DSA 2267-1] perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2267-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 01, 2011 http://www.debian.org/security/faq -...

DSA-2267-1 perl - restriction bypass

Bulletin has no description...

CVE-2011-2197

The cross-site scripting XSS prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a...

CVE-2011-2197

The cross-site scripting XSS prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a...

CVE-2011-2197

The cross-site scripting XSS prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a...

Fedora 15 : rubygem-activesupport-3.0.5-3.fc15 (2011-8494)

This update fixes : - Bug 713692 - CVE-2011-2197 rubygem-activesupport: XSS due improper management of safe buffers Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format ...

PT-2011-3677

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 2.x through 2.3.11 Ruby on Rails versions 3.0.x through 3.0.7 Ruby on Rails versions 3.1.x through 3.1.0.rc1 Description The issue is related to the cross-site scripting XSS prevention feature, which does not properly...

CVE-2011-2197: Improper Neutralization of Input During Web Page Generation

The cross-site scripting XSS prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a...

Indian shopping website Groupon leaks Email/Passwords of 300,000 Users

Indian shopping website Groupon leaks Email/Passwords of 300,000 Users Groupon subsidary – Sosata.com leak the e-mail addresses and plain-text passwords for 300,000 users and also the sql file is index on Google. SoSasta.com offers its services in 11 cities - Kolkata, Hyderabad, Pune, Ahmedabad,...

Ruby: Untrusted codes able to modify arbitrary strings

The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exceptiontos method, as demonstrated by changing an intended pathname...

Ruby: Untrusted codes able to modify arbitrary strings

The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exceptiontos method, as demonstrated by changing an intended pathname...

Sega Pass customer datails hacked, LulzSec wants to Help Sega !

Sega Pass customer datails hacked, LulzSec wants to Help Sega ! Sega has told gamers that some of their personal information may have been stolen following an attack on its systems. E-mail addresses and dates of birth stored on the Sega Pass database were accessed by hackers. But payment...

Ubuntu 10.04 LTS / 10.10 / 11.04 : libvirt vulnerabilities (USN-1152-1)

It was discovered that libvirt did not use thread-safe error reporting. A remote attacker could exploit this to cause a denial of service via application crash. CVE-2011-1486 Eric Blake discovered that libvirt had an off-by-one error which could be used to reopen disk probing and bypass the fix f...

Congressmen, Witnesses Question Data Breach Bill's Specifics

In an initial hearing to discuss a proposed national data-breach notification bill on Wednesday, representatives and witnesses dissected the SAFE Data Act proposed by Rep. Mary Bono Mack and said that the legislation had a long way to go to be ready for prime time. The hearing, which is just the...

Google Fixes 15 Bugs in Chrome, Gives Users Ability to Delete Flash Cookies

Google has fixed more than a dozen security bugs in its Chrome browser, including five high-severity vulnerabilities and one that qualified for the company’s highest bug bounty, a $3133.7 reward. The new version of Chrome has fixes for 15 separate security vulnerabilities, the most critical of...

Chrome Stable Release

The Google Chrome team is happy to announce the release of Chrome 12 to the Stable Channel for all platforms. Chrome 12.0.742.91 includes a number of new features and updates, including: Hardware accelerated 3D CSS New Safe Browsing protection against downloading malicious files Ability to delete...

PT-2011-3492

Name of the Vulnerable Software and Affected Versions Plone versions 2.1 through 4.1 Description A cross-site scripting XSS issue exists in the safe html filter in Products.PortalTransforms, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Mandriva Update for ruby MDVSA-2011:097 (ruby)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Mandriva Update for ruby MDVSA-2011:097 (ruby)

Check for the Version of ruby OpenVAS Vulnerability Test Mandriva Update for ruby MDVSA-2011:097 ruby Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...