UBUNTU-CVE-2013-6800

An unspecified third-party database module for the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.10.x allows remote authenticated users to cause a denial of service NULL pointer dereference and daemon crash via a crafted request, a different vulnerability than CVE-2013-1418...

Hackers can remotely control your phone – Android 4.4 break vulnerability with EXP-a vulnerability warning-the black bar safety net

Security expert Jay Freeman discovered Android 4.4 in addition a Master Key vulnerability that allows an attacker to bypass signature verification and malicious code detection, in the legal application to inject malicious code. ! “Android Master Key vulnerability”of the earliest in the last 7...

Stem Innovation ‘IZON’ Hard-coded Credentials (CVE-2013-6236)

Stem Innovation ‘IZON’ Hard-coded Credentials CVE-2013-6236 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- Stem Innovation's IP camera called ‘IZON’ utilizes numerous hard-coded credentials within its Linux distribution and also the hidden web...

Stem Innovation - IZON Hard-Coded Credentials

Stem Innovation - IZON Hard-Coded Credentials Stem Innovation ‘IZON’ Hard-coded Credentials CVE-2013-6236 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- Stem Innovation's IP camera called ‘IZON’ utilizes numerous hard-coded credentials within it...

Adobe Flash Player sandbox for Safari OS X Mavericks

Mac OS X Mavericks may have brought with it iBooks and Maps to the Apple desktop operating system, but for security conscious users, perhaps the thing most worth noting is the addition of sandbox protection for Adobe Flash Player for the Safari browser, announced yesterday by Adobe. “By providing...

Malware infected International Atomic Energy Agency Computers

Hackers and malware are everywhere, waiting for you around every corner of the Internet. The International Atomic Energy Agency IAEA, which holds highly sensitive information and plays a key role in global efforts to prevent the spread of nuclear weapons, said on Tuesday that some of its computer...

[Firebind Reflector v0.53] Portable Network Path Scanning Tool

Firebind Reflector is a portable network path scanning tool that can profile firewall and other network device rules for port blocking, such as perform egresss/exfiltration testing. Reflector has a client side and listener server-side like Netcat and Ncat, except Reflector can dynamically be told...

Drupal Quick Tabs 6.x / 7.x Access Bypass

No description provided by source. Drupal Quick Tabs third party module versions 6.x and 7.x suffer from an access bypass vulnerability. View online: https://drupal.org/node/2103187 Advisory ID: DRUPAL-SA-CONTRIB-2013-078 Project: Quick Tabs 1 third-party module Version: 6.x, 7.x Date:...

[SECURITY] Fedora 18 Update: rubygems-1.8.25-8.fc18

RubyGems is the Ruby standard for publishing and managing third party libraries...

[SECURITY] Fedora 19 Update: rubygems-2.0.10-106.fc19

RubyGems is the Ruby standard for publishing and managing third party libraries...

Researchers Ponder When to Notify Users of Public Vulnerability Exploits

BERLIN–Just whispering the words “vulnerability disclosure” within earshot of a security researcher or vendor security response team members can put you in fear for your life these days. The debate is so old and worn out that there is virtually nothing new left to say or chew on at this point...

SimpleRisk 20130915-01 - Multiple Vulnerabilities

SimpleRisk 20130915-01 - Multiple Vulnerabilities 1. Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting XSS...

Several vulnerabilities in extension AWStats (cc_awstats)

It has been discovered that the extension "AWStats" ccawstats contains an unspecific vulnerability in the bundled AWStats version. Release Date: September 25, 2013 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version...

Several vulnerabilities in extension Apache Solr for TYPO3 (solr)

It has been discovered that the extension "Apache Solr for TYPO3" solr is vulnerable to Cross-Site Scripting and Insecure Unserialize. Release Date: September 25, 2013 Bulletin Update: November 06, 2014 added CVEs Component Type: Third party extension. This extension is not a part of the TYPO3...

Several vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third-party TYPO3 extensions: booking, cronmmratsinfo, icsawstats, iflowgallery, keuserregister, metabeawstatsind, powermailoptin, smarty, youtubevideos Release Date: September 25, 2013 Please read first: This Collective Security Bulletin C...

SQL Injection vulnerability in extension RealURL: speaking paths for TYPO3 (realurl)

It has been discovered that the extension "RealURL: speaking paths for TYPO3" realurl is vulnerable to SQL-Injection. Release Date: September 25, 2013 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.12.6 and below...

Updated polarssl package fixes security vulnerabilities

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in PolarSSL before 1.2.6, does not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and...

iMessage Chat app for Android Worries Security Experts

UPDATE – Security experts and mobile developers are warning Android users to steer clear of an app purporting to be an Android version of Apple’s iMessage technology. The app has been pulled from Google Play according to a Google spokesperson, but it remains available on several third party sites...

[SECURITY] Fedora 19 Update: rubygems-2.0.8-104.fc19

RubyGems is the Ruby standard for publishing and managing third party libraries...

Debian DSA-2757-1 : wordpress - several vulnerabilities

Several vulnerabilities were identified in Wordpress, a web blogging tool. As the CVEs were allocated from releases announcements and specific fixes are usually not identified, it has been decided to upgrade the Wordpress package to the latest upstream version instead of backporting the patches...