CVE-2017-3525: Undefined Security Weakness

Vulnerability in the PeopleSoft Enterprise SCM Service Procurement component of Oracle PeopleSoft Products subcomponent: Usability. The supported version that is affected is 9.2. Easily "exploitable" vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSo...

Password Field With Auto-Complete

In typical form-based web applications, it is common practice for developers to allow autocomplete within the HTML form to improve the usability of the page. With autocomplete enabled default, the browser is allowed to cache previously entered form values. For legitimate purposes, this allows the...

Product update: Virtuozzo 7.0 Update 3 Hotfix 3 (7.0.3-641)

The new packages for Virtuozzo 7.0.3 introducing usability fixes and compatibility with Packet. Vulnerability id: PSBM-62644 Route of container with a host-routed interface was not cleared on source host after migration. Vulnerability id: PSBM-59017 Allowed access to '/dev/kmsg' inside containers...

Important product security update: Virtuozzo PowerPanel RTM Hotfix 1 (7.0.1-346)

The new packages for Virtuozzo PowerPanel introducing a security fix and usability bug fixes. Vulnerability id: PP-312 Incorrect checking of locked VM accounts in Virtuozzo SDK allowed one to use any password to log in to Virtuozzo PowerPanel in the legacy mode for a VM with such a locked account...

Product update: Virtuozzo Automator 7 Update 1 Hotfix 2 (7.0.1-740)

The new packages for Virtuozzo Automator 7 introducing a usability bug fix for the management node. Vulnerability id: PVA-36686 The 'vzlicmon' service now automatically starts on VA Management Node update, start, or restart to make sure that the Virtuozzo Automator license will be updated when...

Product update: Virtuozzo Automator 7 Update 1 Hotfix 1

The new packages for Virtuozzo Automator 7 introducing usability bug fixes for the management node. Vulnerability id: PVA-36679 Hardware nodes with VMs stayed offline after upgrading the management node from version 6 to 7. Vulnerability id: PVA-36677 The 'vaconfig' tool was not installed with...

Product update: Virtuozzo 6.0 Update 12 Hotfix 5 (6.0.12-3672)

The new packages for Virtuozzo 6.0.12 introducing a usability bug fix. Vulnerability id: PSBM-60976 Lack of VNC client capabilities check on host could result in unsupported data being sent to VNC client leading to a disconnection from host with error...

Product security update: Virtuozzo Automator 6.1 Update 2 Hotfix 3

The new packages for Virtuozzo Automator 6.1 introducing a new feature, a security fix, and usability bug fixes for VA Agent for Linux. Vulnerability id: PVA-27270 In cases when multiple containers were processed in a single task by external tools like 'vzabackup', Power Panel of any container...

Kernel security update: Virtuozzo ReadyKernel patch 11.0 for kernels 3.10.0-327.18.2.vz7.15.2 (Virtuozzo 7.0.0) and 3.10.0-327.36.1.vz7.18.7 (Virtuozzo 7.0.1)

The cumulative Virtuozzo ReadyKernel patch updated with security fixes as well as a usability bug fix. The patch applies to Virtuozzo versions 7.0.0 and 7.0.1. Vulnerability id: PSBM-57511 A flaw was found in the way nfnetlink validated length of batch messages that could allow a user logged in t...

I'm giving up on PGP

After years of wrestling GnuPG with varying levels of enthusiasm, I came to the conclusion that it's just not worth it, and I'm giving up. At least on the concept of long term PGP keys. This is not about the gpg tool itself, or about tools at all. Many already wrote about that. It's about the lon...

Password Autocorrect Without Compromising Security

Intuitively, auto-correcting passwords would seem to be a terrible idea, and the worst security-for-convenience tradeoff in technology history. But a team of academics from Cornell University, MIT and a Dropbox security engineer say that the degradation of security from the introduction of such a...

Password Security — Who's to Blame for Weak Passwords? Users, Really?

The majority of Internet users are vulnerable to cyber threats because of their own weaknesses in setting up a strong password. But, are end-users completely responsible for choosing weak passwords? Give a thought. Recently we wrote an article revealing the list of Worst Passwords of 2015 that...

Tor Cloud Shut Down Amid Lack of Support

The Tor Project has shuttered its cloud proxy service citing security vulnerabilities, usability bugs and a lack of resources. Tor offers its users the capacity to surf the Web anonymously, bouncing traffic through a series of relay servers so that no observer at any point can tell where that...

Tor Browser 4.5 - Everything you Need to Safely Browse the Internet

The Tor software protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, it prevents the sites you visit from learning your physical...

openSUSE Security Update : subversion (openSUSE-2015-289)

Apache Subversion was updated to 1.8.13 to fix three vulnerabilities and a number of non-security bugs. This release fixes three vulnerabilities : - Subversion HTTP servers with FSFS repositories were vulnerable to a remotely triggerable excessive memory use with certain REPORT requests. bsc92379...

New Initiative Simply Secure Aims to Make Security Tools Easier to Use

The dramatic revelations of large-scale government surveillance and deep penetration of the Internet by intelligence services and other adversaries have increased the interest of the general public in tools such as encryption software, anonymity services and others that previously were mainly of...

HackerOne: Hackerone Email Addresses Enumeration

Enumeration of email addresses of already registered users is possible, and or, checking if a user with specific email address is registered in the website and will then be used for phising attacks or any malicious intent. In the "Forgot Password" section, there is an implemented security measure...

Linksys系列未明远程代码执行漏洞

No description provided by source. !/usr/bin/php ?php / Exploit for 0day linksys unauthenticated remote code execution vulnerability. As exploited by TheMoon worm; Discovered in the wild on Feb 13, 2013 by Johannes Ullrich. I was hoping this would stay under-wraps until a firmware patch could be...

Improve filter behaviour: auto-complete should not give away field values

h4. Context When using JQL with auto-complete switched on, searching for fields will always list global values. For instance, when using the IN operator in JQL, auto-complete will "give away" values for the majority of fields. Given that for each individual project there are schemes restricting o...

Improve filter behaviour: auto-complete should not give away field values

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-36881. panel h4. Context When using JQL with auto-complete switched on, searching for fields will always list global values. For instance, wh...