Hardware Vendor Offers Backdoor with Every Product

IT administrators know there’s nothing more frustrating than losing administrative access to your network equipment. But Allied Telesis, a Japan-based maker of switches, routers and other networking devices, has a fix: guaranteed backdoors for every product. That revelation comes after a support...

Phony SSL Certificates issued for Google, Yahoo, Skype, Others

UPDATED: A major issuer of secure socket layer SSL certificates acknowledged on Wednesday that it had issued 9 fraudulent SSL certificates to seven Web domains, including those for Google.com, Yahoo.com and Skype.com following a security compromise at an affiliate firm. The attack originated from...

HTB22822: XSS vulnerability in RunCMS

Vulnerability ID: HTB22822 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinruncms.html Product: RunCMS Vendor: http://www.runcms.org/ http://www.runcms.org/ Vulnerable Version: 2.2.2 Vendor Notification: 27 January 2011 Vulnerability Type: XSS Cross Site Scripting Risk level: Medium...

3 Websites hacked by Cyber pr3dat0r (Team StuXnet)

3 Websites hacked by Cyber pr3dat0r Team StuXnet Hacked Links : News Source : Cyber pr3dat0r Team StuXnet | Via Message...

Flaw in Microsoft Windows SAM Processing Allows Continued Administrative Access Using Hidden Regular User Masquerading After Compromise (2010-M$-001)

---------------------------------------------------------- www.ExploitDevelopment.com 2010-M$-001 ---------------------------------------------------------- TITLE: Flaw in Microsoft Windows SAM Processing Allows Continued Administrative Access Using Hidden Regular User Masquerading After Compromi...

New Password Not Enough to Secure Hacked E-mail Account

HED: New Passwords Not Enough to Secure Hacked E-mail Account DEK: Google’s Advice to Owners of Compromised Accounts Woefully Inadequate, Says Web Security Expert BY CALEB SIMA, CEO, Armorize Technologies Threatpost reported recently on a wave of warnings about Gmail account compromises linked to...

Autodesk AutoCAD 2007 - color.dll DLL Hijacking

Autodesk AutoCAD 2007 - color.dll DLL Hijacking / Description: A vulnerability exists in windows that allows other applications dynamic link libraries to execute malicious code without the users consent, in the privelage context of the targeted application. Title: Autocad 2007 Professional dll...

Hack Puts Spotlight on Malware's Long Tail: Parked Domains

They’re the dusty corners of the Web: so-called “parked” domains. But these little trafficked sites are attracting the attention of security experts, who say that it’s time for hosting firms and others that profit from them to clean up malware infections that may be exposing millions of Web users...

McAfee Email Gateway systemWebAdminConfig.do不安全访问控制漏洞

BUGTRAQ ID: 40255 McAfee Email Gateway之前名为IronMail，是企业级的硬件邮件网关和管理平台。 McAfee Email Gateway的systemWebAdminConfig.do配置文件没有执行正确的权限检查，拥有只读权限的Web Access用户可以通过在服务器响应的Form字段中添加HTML代码或发送特制POST请求执行写权限操作。 0 McAfee Email Gateway 6.7.1 厂商补丁： McAfee ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

AST-2010-003: Invalid parsing of ACL rules can compromise security

Asterisk Project Security Advisory - AST-2010-003 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | Invalid parsing of ACL rules can compromise | | | security |...

Man in the Browser: Inside the Zeus Trojan

Man in the Browser a.k.a MITB is a new breed of attacks whose primary objective is to spy on browser sessions mostly banking and in that process intercept and modify the web page contents transparently in the background. In a classic MITB attack, it’s very likely that what the user is seeing on...

deremate-xssrfi.txt

www.nullcode.com.ar +==========================================================================+ + Deremate.com security compromised with XSS/ RFI flaw + +==========================================================================+ Authors: Ivan Sanchez Product:deremate.com...

raidsonic-disclose.txt

Manufacturer: RaidSonic www.raidsonic.de Device: NAS-4220-B Firmware: 2.6.0-n2007-10-11 Device Type: end user grade NAS box OS: Linux 2.6.15 Architecture: ARM Designed by: Storm Semiconductor Inc www.storlinksemi.com Problem: Hard disk encryption key stored in plain on unencrypted partition. Time...

HP Software Update Client 3.0.8.4 - Multiple Vulnerabilities

Advisory: ///////// There is another remotely exploitable flaw within software preinstalled in HP notebook machines. This time, the culprit is automatic software update tool provided by the vendor.The Potential exploitation may lead to user files loss or altering vital system files e.g. kernel,...

Generic Software Wrappers Toolkit 1.6.3 (GSWTK) - Race Condition Privilege Escalation

Generic Software Wrappers Toolkit 1.6.3 GSWTK - Race Condition Privilege Escalation / source: https://www.securityfocus.com/bid/25251/info GSWKT Generic Software Wrappers Toolkit is prone to multiple concurrency vulnerabilities because of its implementation of system call wrappers. This problem c...

lmmhi-xss.txt

Login Manager Multiple HTML Injections Login Manager is a powerful, robust system that enables web administrators to manage website user accounts easily, create membership protected areas, and effortlessly prevent unauthorized user access to secured areas. Login Manager 3 “LM3” uses PHP and MySQL...

CVE-2006-5664

The installation script in IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit CSDK 2.90, and Informix I-Connect 2.90 allows local users to "compromise security" via a symlink attack on temporary files...

CVE-2006-5664

CVE-2006-5664 describes a local vulnerability in IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit (CSDK) 2.90, and Informix I-Connect 2.90 where a symlink attack on temporary files could allow local users to compromise security. The report notes a local-access impact an...

[NT] Microsoft Internet Explorer Drag-and-Drop Redeux

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

Format string on URI

The remote web server seems to be vulnerable to a format string attack on the URI. An attacker might use this flaw to make it crash or even execute arbitrary code on this host. SPDX-FileCopyrightText: 2004 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are...