Design/Logic Flaw

IBM WebSphere Portal 7.0.0.x before 7.0.0.2 CF26 and 8.0.0.x before 8.0.0.1 CF09 does not properly handle content-selection changes during Taxonomy component rendering, which allows remote attackers to obtain sensitive property information in opportunistic circumstances by leveraging an error in ...

CVE-2013-6316

Technical details about CVE-2013-6316 are not publicly provided in the supplied documents; no concrete exploit data or affected product specifics beyond the generic description. Monitor for updates.

Preparing for Managed Security Services

Wade Woolwine Presents at MIRcon® 2013 As a complement to my MIRcon® 2013 presentation titled "Getting the Best Bang for the Buck with Managed Security Providers" and to address some questions I received from the audience, I have prepared a quick summary of my presentation. Many businesses consid...

evolution: incorrect selection of recipient gpg public key for encrypted mail

The gpgctxaddrecipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and allow remote attackers...

[ipset_list] ipset set listing wrapper script

Features: Calculate sum of set members and match on that count. List only members of a specified set. Choose a delimiter character for separating members. Show only sets containing a specific glob matching header. Arithmetic comparison on headers with an integer value. Match members using a...

PT-2013-5730

Name of the Vulnerable Software and Affected Versions Opsview versions prior to 4.4.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the service selection parameter in the "status/service/acknowledge" endpoint. Recommendations For versions...

[jSQL Injection v0.5] Java tool for automatic database injection

jSQL Injection is a lightweight application used to find database information from a distant server. jSQL is free, open source and cross-platform Windows, Linux, Mac OS X, Solaris. jSQL Injection change log - version 0.5 0.5 SQL shell Uploader 0.4 Admin page checker and preview Brute forcer md5...

Windows 8 Picture Gesture Authentication Research

Typing on a smartphone or tablet keyboard lends itself to a lot of fat-fingered mistakes. Recent updates to mobile operating systems and desktop OSes such as Windows 8, however, have tried to better leverage the touch screen for things such as authentication. Users, for example, have the option o...

ISC BIND 9 SRTT算法授权服务器选择安全漏洞

BUGTRAQ ID: 61774 BIND是一个应用非常广泛的DNS协议的实现。 ISC BIND 9内的SRTT算法实现中存在漏洞，理论上此漏洞可使攻击者手动降低递归服务器与授权服务器相关联的SRTT值，从而影响特定授权服务器从NS资源记录集值内确定要查询的域服务器。SRTT选择不仅影响授权服务器，也影响递归或授权混合服务器。攻击者可利用此漏洞执行DNS相关的攻击，例如DNS缓存投毒。 0 ISC BIND 9.x 厂商补丁： ISC --- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Experts Urge ECC crytpo over RSA algorithm

LAS VEGAS – Cryptographic breakthroughs have accelerated in the past six months in areas such as discrete logarithm computations that lead experts to believe that breaking the stalwart RSA algorithm may be in the not-too-distant future. A team of crypto experts today at Black Hat USA 2013 present...

SuSE 11.3 Security Update : icedtea-web (SAT Patch Number 7981)

This update to IcedTea-Web 1.4 provides the following fixes and enhancements : - Security updates - RH916774: Class-loader incorrectly shared for applets with same relative-path. CVE-2013-1926 - RH884705: fixed gifar vulnerabilit. CVE-2013-1927 - RH840592: Potential read from an uninitialized...

Microsoft Internet Explorer CSelectedControlAdorner Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

DEBIAN-CVE-2013-2005

X.org libXt 1.1.3 and earlier does not check the return value of the XGetWindowProperty function, which allows X servers to trigger use of an uninitialized pointer and memory corruption via vectors related to the 1 ReqCleanup, 2 HandleSelectionEvents, 3 ReqTimedOut, 4 HandleNormal, and 5...

CVE-2013-1676

The SelectionIterator::GetNextSegment function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service out-of-bounds read via unspecified vector...

DEBIAN-CVE-2012-3519

routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack...

CVE-2012-3519

CVE-2012-3519 affects Tor; routerlist.c in Tor before 0.2.2.38 uses different timing for relay-list iteration, enabling a timing side-channel to leak information about relay selection. Public discussion items in Debian/OSS advisories confirm the vulnerability and that the OpenBSD/OpenSSL-style fi...

CVE-2012-3519

routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack...

CVE-2012-3519

routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack...

PT-2012-4783

Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.2.2.38 Description The issue allows remote attackers to potentially obtain sensitive information about relay selection via a timing side-channel attack. This is due to the different amount of time used for relay-list...

Scientific Linux Security Update : openssh on SL5.x

Problem description : A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. CVE-2007-3102 A flaw was found in the way the OpenSSH...