830 matches found
WordPress Bad Behavior Cross Site Scripting
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Wordpress Security audit bad-behavior plugin 1. Cross-site scripting reflected 1.1. http://127.0.0.1/wp-admin/options-general.php %3Cscript%3Ealert1%3C/script%3E parameter 1.2. http://127.0.0.1/wp-admin/options-general.php httpblkey parameter 1.3...
[SECURITY] Fedora 16 Update: sectool-0.9.5-7.fc16
sectool is a security tool that can be used both as a security audit and intrusion detection system. It consists of set of tests, library and command line interface tool. Tests are sorted into groups and security levels. Admins can run certain tests, groups or whole security levels. The library a...
ME Firewall Analyzer v7.2 - Cross Site Vulnerabilities
Document Title: =============== ME Firewall Analyzer v7.2 - Cross Site Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=437 Release Date: ============= 2012-03-31 Vulnerability Laboratory ID VL-ID: ==================================== 437...
YVS Image Gallery - SQL Injection
YVS Image Gallery - SQL Injection -=+ Application: YVS Image Gallery -=+ Version: 0.0.0.1 -=+ Vendor's URL: http://yvs.vacau.com/gallery.html -=+ Platform: Windows\Linux\Unix -=+ Bug type: Sql INJECTIONS -=+ Exploitation: Remote -=- -=+ Author: Corrado Liotta Aka CorryL corryl80atgmaildotcom -=+...
php source code audit of the cookies spoofing-vulnerability warning-the black bar safety net
ebycms is a mobile music cms system Direct codes admin 目录 下 的 in.php Judgment$AdminCookies is empty if not empty on landing into $AdminCookies the value of the source cookies adminnamevalue Modify cookies to bypass authentication ! !...
Security audits
A presentation on Project Basecamp was a highlight of the conference. The talk presented the findings of a volunteer-led security audit of leading programmable logic controllers PLCs. The audit found that decrepit hardware, buggy software and pitiful or nonexistent security features make thousand...
HP Facing Class Action Suit For Not Disclosing Printer Vulnerability
A class action lawsuit filed in U.S. District Court in California against Hewlett-Packard could have wide ranging implications for software makers, should the court agree with the plaintiff’s claim that the company violated the state’s consumer protection laws by failing to disclose a serious...
Issue key can be enumerated - Resolve Issue Feature
Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that the application is succeptible to horizontal privilege elevation attacks within the Resolve Issue feature, accessible through the given address:...
Another Dutch CA, KPN, Stops Issuing Certificates After Finding DDoS Tool On Server
Another Dutch certificate authority, KPN, has stopped issuing digital certificates after finding attack tools on a server in its Web infrastructures. The CA said that while it doesn’t have evidence right now that it’s CA infrastructure was compromised, it is taking the actions as a precaution. Th...
Mozilla Asks Firefox CAs to Audit Security Systems in Wake of DigiNotar Hack
Already having revoked trust in the root certificates issued by DigiNotar, Mozilla is taking steps to avoid having to repeat that process with any other certificate authority trusted by Firefox, asking all of the CAs involved in the root program to conduct audits of their PKIs and verify that...
Audit Report Shows Many Cracks in DigiNotar Security
A new report on the security of DigiNotar paints an ugly picture of the certificate authority’s safeguards and network infrastructure, showing that the company had all of its CA servers on one Windows domain and likely failed to separate the critical components on its network, making it easy for...
ME Firewall Analyzer v7.1 - Multiple Web Vulnerabilities
Document Title: =============== ME Firewall Analyzer v7.1 - Multiple Web Vulnerabilities Release Date: ============= 2011-09-06 Vulnerability Laboratory ID VL-ID: ==================================== 264 Product & Service Introduction: =============================== ManageEngine Firewall Analyze...
FreeBSD : nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl (aa5bc971-d635-11e0-b3cf-080027ef73ec)
Heather Adkins, Google's Information Security Manager, reported that Google received ... reports of attempted SSL man-in-the-middle MITM attacks against Google users, whereby someone tried to get between them and encrypted Google services. The people affected were primarily located in Iran. The...
Comodo, DigiNotar Attacks Expose Crumbling Foundation of CA System
There are a lot of things in the security world that are broken and there isn’t room to list them all, even on the Internet. But if the events of the last few days have shown us anything, it’s that the certificate authority infrastructure is beyond broken and there’s no quick fix looming on the...
DigiNotar Says Its CA Infrastructure Was Compromised
VASCO, the parent company of DigiNotar, says that the fraudulent certificate for Google’s domains that the certificate authority issued was just one of many such bogus certificates it handed out in recent months, and blamed the growing scandal on an attack on its CA infrastructure. In a statement...
Oracle AS Portal 10.1.2 Cross Site Scripting
============================================= INTERNET SECURITY AUDITORS ALERT 2010-007 - Original release date: August 11th, 2010 - Last revised: May 1st, 2011 - Discovered by: Vicente Aguilera Diaz - Severity: 5.0/10 CVSS Base Scored ============================================= I. VULNERABILIT...
rt -- multiple vulnerabilities
Best Practical reports: In the process of preparing the release of RT 4.0.0, we performed an extensive security audit of RT's source code. During this audit, several vulnerabilities were found which affect earlier releases of RT...
ClassicCars.com hacked by Indonesian hackers !
Late yesterday evening website classiccars.com had been defaced. While it's not shocking news that another site of the millions on the internet has been hacked, this one was unusual in that the defacement seemed to be nothing more than an advertisement for the hackers. Ten years ago hacking for...
Debian DSA-2148-1 : tor - several vulnerabilities
The developers of Tor, an anonymizing overlay network for TCP, found three security issues during a security audit. A heap overflow allowed the execution of arbitrary code CVE-2011-0427 , a denial of service vulnerability was found in the zlib compression handling and some key memory was...
