LinkedIn Intro Service to Shut Down March 7

LinkedIn announced on Friday it was shuttering its four-month-old Intro service which stirred up a privacy meltdown shortly after its release in October. Intro was an integrated service for iOS which sat as a proxy between the built-in iOS mail client and the user’s email provider. Intro would...

Attackers Target Yahoo Mail Accounts in 'Coordinated Effort' to Own Users

After years of focusing their attention on Gmail, it seems that attackers have finally gotten around to expending some effort hacking Yahoo mail accounts. Yahoo officials said Thursday that they have reset the passwords on an unspecified number of mail accounts after detecting what they call a...

Cross-Site Request Forgery Protection in TYPO3 CMS 6.2

TYPO3 CMS 6.2 will get CSRF Protection throughout all modules and parts that manipulate data. Component Type: TYPO3 CMS Vulnerability Types: Cross-Site Request Forgery CSRF Overall Severity: Low Release Date: January 31, 2014 Affected Versions: All versions below 6.2 CVE: Will be requested. Probl...

Stem Innovation IZON Hardcoded Password

Stem Innovation ‘IZON’ Hard-coded Credentials CVE-2013-6236 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- Stem Innovation's IP camera called ‘IZON’ utilizes numerous hard-coded credentials within its Linux distribution and also the hidden web...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change an email address or 2 conduct script insertion attacks. NOTE: the provenance o...

CVE-2013-5910

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Security. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that...

Twitter Forces HTTPS Connections to its API

UPDATE: As of yesterday, Twitter’s application programming interface API will only recognize traffic traveling via Transport Layer Security TLS or Secure Sockets Layer SSL. Any applications connecting to the API in plaintext will no longer work. There is a vast selection of third-party Twitter...

CVE-2013-5896

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that...

6 Tips to Save Time Doing Patch Management

If you spend more than a few hours a month doing patching; if you stay up until the middle of the night one Saturday each month doing patching; if you just flip on automatic updates and hope for the best; or if you email your users instructions on how to update their machines – then you’re doing ...

CSCMS V3.5 最新版 后台命令执行GETSHELL（源码详析）

简要描述： CSCMS V3.5 最新版 后台PHP命令执行GETSHELL（源码详析） CSCMS的全新架构加强了安全性，以往的一串漏洞均已修复， 读代码，发现还有新的漏洞 代码分析见详细说明，测试演示在漏洞证明里 详细说明： 漏洞位置为后台的 网站设置-第三方登录设置 中 有关代码如下： /app/controllers/admin/setting.php line:426 public function dengluedit //设置第三方登录的几项配置 $this-CsdjAdmin-AdminQx'4'; //注意，本处已使用xssclean过滤特定字符，之后的结论会用到...

A Proven Strategy for Implementing Vendor Management Programs

Every regulated industry includes a requirement for managing third-party risk. Some industries are further along the path and have more mature processes than others. However, there are tried and true methodologies and standards established by those early movers that we can utilize across other...

CVE-2013-6417

The CVE-2013-6417 issue affects Ruby on Rails’ ActionPack (lib/action_dispatch/http/request.rb) where differences in parameter handling between Active Record and the JSON implementation allow remote attackers to bypass database-query restrictions and trigger NULL checks or missing WHERE clauses b...

VMSA-2013-0015 : VMware ESX updates to third-party libraries

a. Update to ESX service console kernel The ESX service console kernel is updated to resolve multiple security issues. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2012-2372, CVE-2012-3552, CVE-2013-2147, CVE-2013-2164, CVE-2013-2206, CVE-2013-2224,...

VMware ESXi and ESX address an NFC Protocol memory corruption and third party library security issues (VMSA-2013-0003) - Remote Version Check

The remote ESXi is missing one or more security related Updates from VMSA-2013-0003. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...

VMSA-2013-0003 VMware vCenter Server, ESXi and ESX address an NFC Protocol memory corruption and third party library security issues. (remote check)

The remote ESXi is missing one or more security related Updates from VMSA-2013-0003. OpenVAS Vulnerability Test $Id: gbVMSA-2013-0003remote.nasl 6086 2017-05-09 09:03:30Z teissa $ VMSA-2013-0003 VMware vCenter Server, ESXi and ESX address an NFC Protocol memory corruption and third party library...

VMSA-2013-0011 VMware ESX and ESXi updates to third party libraries (remote check)

VMware has updated VMware ESXi and ESX to address a vulnerability in an unhandled exception in the NFC protocol handler. OpenVAS Vulnerability Test $Id: gbVMSA-2013-0011remote.nasl 6115 2017-05-12 09:03:25Z teissa $ VMSA-2013-0011 VMware ESX and ESXi updates to third party libraries remote check...

VMSA-2013-0015:VMware ESX updates to third party libraries

VMSA-2013-0015 VMware ESX updates to third party libraries VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2013-0015 VMware Security Advisory Synopsis: VMware ESX updates to third party libraries VMware Security Advisory Issue date: 2013-12-05 VMware Security Advisory Updated...

VMware ESX and ESXi updates to third party libraries (VMSA-2013-0011) - Remote Version Check

VMware has updated VMware ESXi and ESX to address a vulnerability in an unhandled exception in the NFC protocol handler. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Microsoft Releases Security Advisory 2914486

Today we released Security Advisory 2914486 regarding a local elevation of privilege EoP issue that affects customers using Microsoft Windows XP and Server 2003. Windows Vista and later are not affected by this local EoP issue. A member of the Microsoft Active Protections Program MAPP found this...

Apple Mac OS X and QuickTime multiple security vulnerabilities

Multiple vulnerabilities in kernel, networking components, printing services, AFP Server, AppKit, Apple Type Services, CFNetwork, CoreGraphics, CoreText, Directory Services, diskdevcmds, Disk Images, Image Capture, ImageIO, Image RAW, Password Server, QuickLook, QuickTime, Safari RSS, Time Machin...