Report: Reused, Third Party Code Major Sources of Insecurity

A new report out from security testing firm Veracode suggests that reused and third party code is a big source of application insecurity. Application security is a sore spot for many organizations, as attackers shift the battlefield from operating system and network attacks to application specifi...

Microsoft Releases New Version of EMET Exploit Mitigation Toolkit

Mitigation has become the word of the moment at Microsoft, and the company on Thursday continued its recent flow of tools designed to lessen the effectiveness of certain attacks with the release of version 2.0 of its Enhanced Mitigation Experience Toolkit. The new version of the toolkit includes ...

Google Complains and IBM Revises Vulnerability Stats

Search giant Google cried foul after an IBM X-Force report labeled it the vendor with the highest percentage of unpatched, critical security holes, prompting a correction by IBM. HED: Google complains, IBM revises vulnerability stats DEK: In the face of complaints from GOogle, IBM has admitted th...

Google Joins List of Companies with Most Software Holes

With Web based software vulnerabilities on the rise, Google displaces HP on the list of vendors with the most reported software holes in the first half of 2010. software vulnerabilities. Editor’s Note: IBM has revised its X-Force 2010 Mid-Year Trend and Risk Report to correct inaccuracies in the...

A Closer Look at Crimepack's Exploit Stats

One of the best-selling exploit packs on the market today is called Crimepack. Here is a closer look at the “exploit stats” sections of a few working Crimepack installations to get a better sense of which software vulnerabilities are most productive for Crimepack customers. Read the full article...

Researchers Show Weaknesses of Vehicle Software Systems

A new paper by a group of academic researchers has exposed a set of serious weaknesses in the software systems that control many modern cars, giving them the ability to lock passengers inside the car, cut the car’s brakes and perform other interesting tricks. The work, done by researchers at the...

[Wintercore Research] Consona Products - Multiple vulnerabilities

Affected products: Consona Live Assistance Consona Dynamic Agent Consona Subscriber Assistance Vulnerabilities: -XSS -Remote Code Execution -Buffer Overflow -Privilege escalation Executive summary: Consona products uses a propietary ActiveX site-lock mechanism that can be defeated through XSS...

RedHat Update for curl RHSA-2010:0273-05

Check for the Version of curl OpenVAS Vulnerability Test RedHat Update for curl RHSA-2010:0273-05 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...

Top 25 Dangerous Programming Errors Updated

The 2010 CWE/SANS Top 25 Most Dangerous Programming Errors is a list of widespread and critical programming errors that can lead to serious software vulnerabilities. Read the full article. Common Weakness Enumeration/Mitre...

DTSA-205-1 openoffice.org - several vulnerabilities

Bulletin has no description...

CVE-2009-4405

Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to 1 "policy checks in report results when using alternate formats" or 2 a "check for the 'raw' role that is missing in docutils 0.6."...

CUPS / poppler / xpdf / Adobe Reader multipls security vulnerabilities

Integer overflows, race condiotions...

Microsoft .Net multiple security vulnerabilities

Multiple vulnerabilities allow escape from sandbox environment...

PBS Website Compromised, Used to Serve Exploits

Some sections of the popular PBS.org Web site have been hijacked by hackers serving up a cocktail of dangerous exploits. According to researchers at Purewire, attempts to access certain PBS Web site pages yielded JavaScript that serves exploits from a malicious domain via an iframe. The malicious...

Opera Unite multiple security vulnerabilities

Request spoofing, crossite scripting, information leak, etc...

CVE-2008-7147

CVE-2008-7147 describes multiple cross-site scripting (XSS) vulnerabilities in IntraLearn Software IntraLearn 2.1, and possibly versions before 4.2.3. The issues allow remote attackers to inject arbitrary web script or HTML via (1) outline and (2) course parameters to library/description_link.cfm...

Mozilla Firefox, Thunderbird, SeaMonkey, NSS multiple security vulnerabilities

Certificate spoofing, buffer overflow, code execution...

CVE-2009-2460

Multiple stack-based buffer overflows in mathtex.cgi in mathTeX, when downloaded before 20090713, have unspecified impact and remote attack vectors...

Microsoft DirectShow multiple security vulnerabilities

Multiple DoS conditions and memory corruptions on Apple QuickTime formats processing...

CVE-2009-1183

The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service infinite loop and hang via a crafted PDF file...