Patch Efficiently with Automated Patch Management

You’ve got to ask yourself one question. How much hassle does patching cause you? Is the second Tuesday of each month something you dread, or is it just another day for you? If you spend days and days testing and deploying patches; if you stay up until the wee hours of the morning one weekend eac...

CVE-2014-2538 rubygem rack-ssl: URL error display XSS

Cross-site scripting XSS vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack...

Android Vulnerability Bypasses App's Digital Signature

A vulnerability exists in the Android code base that would allow a hacker to modify a legitimate, digitally signed Android application package file APK and not break the app’s cryptographic signature—an action that would normally set off a red flag that something is amiss. Researchers at startup...

Information disclosure

An unspecified third-party component in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 uses short session ID values, which makes it easier for remote attackers to hijack sessions, and consequently obtain sensitive information, via a brute-force attack...

Debian DSA-2718-1 : wordpress - several vulnerabilities

Several vulnerabilities were identified in WordPress, a web blogging tool. As the CVEs were allocated from releases announcements and specific fixes are usually not identified, it has been decided to upgrade the wordpress package to the latest upstream version instead of backporting the patches...

DSA-2718-1 wordpress - several

Bulletin has no description...

Firefox Adds Mixed Content Blocking by Default

The proliferation of SSL-protected sites has been a boon for security conscious Web users in the last couple of years, as more and more sites have taken the step of offering encrypted connections for sensitive sessions. But one of the problems that’s cropped up is that the dynamic nature of today...

0x8004230F or Error: VSSControl: -2147212529 (VSS_E_UNEXPECTED_PROVIDER_ERROR)

Challenge A job fails with the error: Failed to prepare guest for hot backup. Error: VSSControl: -2147212529 Backup job failed. Discovery phase failed. Cannot add volumes to the snapshot set. Cannot add a volume to the snapshot set. Volume name: \?\Volume. Cannot add volume to the set of volumes...

第三方cms程序漏洞导致秒杀V5官网服务器

简要描述： 直接秒杀网站服务器Getshell! 详细说明： 周末无事上网逛，蹦出一购物站广告，讨厌，既然来了，寡人检测下你吧！发现是V5shop模板，去网站下个源码，看着网站嘿嘿检测哈 嘎嘎 邪恶的笑了 Dedecms 既然这样 操刀上阵，最终拿下shell,希望管理员多留意下，修补漏泄，不然被不法分子注意到，后果不堪设想！友情检测到此，希望厂商尽早解决问题！ 漏洞证明：...

Emerson ROC800 Multiple Vulnerabilities (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-13-259-01A Emerson ROC800 Multiple Vulnerabilities that was published December 2, 2014, on the NCCIC/ICS‑CERT web site. This advisory provides mitigation details for multiple vulnerabilities affecting the Emerson...

Security Bypass Vulnerability in extension powermail (powermail)

It has been discovered that the extension "powermail" powermail is susceptible to Security Bypass Vulnerability. Release Date: June 03, 2013 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.6.9 and below, 2.0.1 -...

Several vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third-party TYPO3 extensions: accessibleisbrowseresults, maagformcaptcha, metafeedit, rzautocomplete, sbfolderdownload, sgzfelib, sgzlib, tqseo Release Date: June 03, 2013 Please read first: This Collective Security Bulletin CSB is a listin...

Drupal resets 1 Million Passwords after Data Breach

A Drupal data breach was announced by the official Drupal Association, that Passwords for almost one million accounts on the Drupal.org website are being reset after hackers gained unauthorized access to sensitive user data. The security of the open source content management system has been...

Drupal resets 1 Million Passwords after Data Breach

A Drupal data breach was announced by the official Drupal Association, that Passwords for almost one million accounts on the Drupal.org website are being reset after hackers gained unauthorized access to sensitive user data. The security of the open source content management system has been...

Logic Print 2013 - Stack Overflow (vTable Overwrite)

Exploit for windows platform in category remote exploits var rop = ""; var shellcode = ""; var junk1 = ''; var junk2 = ''; function theMagicalMysteryTour rop = unescape"%u2230%u2030" + ///////////////////////////////////////////// /// STACK PIVOT /// /////////////////////////////////////////////...

Logic Print 2013 - vTable Overwrite Stack Overflow

var rop = ""; var shellcode = ""; var junk1 = ''; var junk2 = ''; function theMagicalMysteryTour rop = unescape"%u2230%u2030" + ///////////////////////////////////////////// /// STACK PIVOT /// ///////////////////////////////////////////// "%u370d%u7d20" + // 0x7d20370d : XCHG EAX,ESP ADD DWORD P...

Drupal.org Resets Passwords After Data Breach

The Drupal Association is urging all users of Drupal.org and groups.drupal.org to reset their passwords after discovering an intrusion that breached files holding usernames, e-mail addresses, countries and hashed passwords. Sites that run on Drupal do not appear to be impacted, though the...

Hacking PayPal accounts to steal user Private data

If you're making a lot of money and you want to keep records of your transactions, then using PayPal's Reporting system you can effectively measure and manage your business. Nir Goldshlager, founder of Breaksec and Security Researcher reported critical flaws in Paypal Reporting system that allowe...

Debian Security Advisory DSA 2701-1 (krb5 - denial of service)

It was discovered that the kpasswd service running on UDP port 464 could respond to response packets, creating a packet loop and a denial of service condition. OpenVAS Vulnerability Test $Id: deb2701.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2701-1 using nvtgen 1....

CVE-2012-6556

Multiple cross-site scripting XSS vulnerabilities in the FirstLastNames plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrary web script or HTML via the 1 User/FirstName or 2 User/LastName parameter to the edit user page. NOTE: some of these details are obtained from third...