Information Governance: Get Data Classification Right First

Data classification is one of the most crucial elements of an effective information governance process--yet its also one that many companies fail to implement well. In its simplest terms, data classification is the process of categorizing data based on its level of sensitivity. When done properly...

CVE-2012-6538

The copytouserauth function in net/xfrm/xfrmuser.c in the Linux kernel before 3.6 uses an incorrect C library function for copying a string, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAPNETADMIN capability...

Scientific Linux Security Update : mcstrans on SL5.x i386/x86_64

An algorithmic complexity weakness was found in the way the mcstrans daemon handled ranges of compartments in sensitivity labels. A local user could trigger this flaw causing mctransd to temporarily stop responding to other requests; a partial denial of service. CVE-2007-4570 This update also fix...

Symfony 2 Unauthenticated Information Disclosure

Sense of Security - Security Advisory - SOS-12-002 Release Date. 05-Mar-2012 Last Update. - Vendor Notification Date. 24-Feb-2012 Product. Symfony2 Platform. PHP Affected versions. 2.0.x - 2.0.10 Severity Rating. Medium Impact. Exposure of sensitive information Attack Vector. Remote without...

1024 CMS <= 1.1.0 Beta LFI Vulnerability - Active Check

1024 CMS 1.1.0 Beta is prone to a local file include LFI vulnerability because it fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

WordPress '.php' Files Information Disclosure Vulnerability

WordPress is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Classmates XSS cross-site vulnerabilities-vulnerability warning-the black bar safety net

Vulnerability description: Classmates 1.1.1 design flaws, leading toXSScross-site vulnerability; user can be in a vulnerable application to execute arbitrary JavaScript code. Since the vulnerability exists in“/themes/default/header.inc.php“script is not properly sanitized of user-supplied input t...

CVE-2011-0178

CVE-2011-0178 concerns the CarbonCore FSFindFolder API on Mac OS X prior to 10.6.7. When called with the kTemporaryFolderType flag, FSFindFolder returns a world-readable directory, enabling a local attacker to access potentially sensitive information via this directory. The core issue is an infor...

Debian DSA-2113-1 : drupal6 - several vulnerabilities

Several vulnerabilities have been discovered in Drupal 6 a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-3091 Several issues have been discovered in the OpenID module that allows malicious access to use...

DSA-2113-1 drupal6 - several vulnerabilities

Bulletin has no description...

Joomla Zoom Portfolio SQL Injection

--------------------------------------------------------------------------------- Joomla Component Zoom Portfolio id Remote Sql Injection --------------------------------------------------------------------------------- Author : Chip D3 Bi0s Group : LatinHackTeam Email & msn : [email protected]...

Статические анализаторы php. Мини-обзор

С течение времени мы все чаще и чаще можем видеть появление новых систем управления контентом CMS: форумов, блогов, шопов, социальных сетей, и т.д. и т.п. Многие из них, в силу некомпетентности или недостаточного уровня профессионализма их разработчиков, имеют в коде уязвимые места, позволяющие...

SA-CORE-2010-002 - Drupal core - Multiple vulnerabilities

Multiple vulnerabilities and weaknesses were discovered in Drupal. OpenID authentication bypass The OpenID module provides users the ability to login to sites using an OpenID account. The OpenID module doesn't implement all the required verifications from the OpenID 2.0 protocol and is vulnerable...

RedHat Update for nss_db RHSA-2010:0347-01

Check for the Version of nssdb OpenVAS Vulnerability Test RedHat Update for nssdb RHSA-2010:0347-01 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

Signing in with username with different case creates new user

We currently utilize LDAP for our user repository and allow users to be automatically added to crucible if they can successfully authenticate. We have recently received complaints from users that their names were showing up two times in reviews. After some analysis we saw that there were 2...

CVE-2009-4144

NetworkManager NM 0.7.2 does not ensure that the configured Certification Authority CA certificate file for a 1 WPA Enterprise or 2 802.1x network remains present upon a connection attempt, which might allow remote attackers to obtain sensitive information or cause a denial of service connectivit...

Cherokee Directory Traversal Vulnerability

Cherokee is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks. Cherokee 0.5.4 and prior versions are vulnerable...

Joomla! Component com_foobla_suggestions (idea_id) 1.5.11 - SQL Injection

----------------------------------------------------------------------------------------- joomla component comfooblasuggestions ideaid SQL Injection Vulnerability ----------------------------------------------------------------------------------------- Author : Chip D3 Bi0s Email :...

CVE-2008-4207

Attachmax Dolphin 2.1.0 and earlier does not properly protect info.php in the main folder, which allows remote attackers to obtain sensitive information via a direct request, which invokes the phpinfo function. NOTE: some of these details are obtained from third party information...

CVE-2008-1199

Dovecot before 1.0.11, when configured to use mailextragroups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack...