Moderate: Red Hat Security Advisory: jbossweb security update

Updated jbossweb packages for JBoss Enterprise Web Platform 5.2.0 which fix multiple security issues are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS ba...

[WPScan Android] WordPress Security Scanner Android App

WPScan is a black box WordPress Security Scanner written in Ruby which attempts to find known security weaknesses within WordPress installations. Its intended use it to be for security professionals or WordPress administrators to asses the security posture of their WordPress installations...

Moxie Marlinspike Leaving Twitter Security Team

Twitter has been collecting a lot of security talent in the last year or so, but now a major piece of the company’s security team is leaving. Moxie Marlinspike, the creative security and privacy researcher who founded Whisper Systems, which was acquired by Twitter in 2011, said on Friday that he ...

Apache Tomcat 7.0.x < 7.0.30 DIGEST Authentication Multiple Security Weaknesses

Binary data 800606.prm...

Apache Tomcat 5.5.x < 5.5.36 DIGEST Authentication Multiple Security Weaknesses

According to its self-reported version number, the instance of Apache Tomcat 5.5.x listening on the remote host is prior to 5.5.36. It is, therefore, affected by the following vulnerabilities : - Replay-countermeasure functionality in HTTP Digest Access Authentication tracks cnonce values instead...

FreeBSD : tomcat -- authentication weaknesses (152e4c7e-2a2e-11e2-99c7-00a0d181e71d)

The Apache Software Foundation reports : Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved : - Tomcat tracked client rather than server nonces and nonce count. - When a session ID was present, authentication was bypassed. - The user name and passwor...

tomcat -- authentication weaknesses

The Apache Software Foundation reports: Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved: Tomcat tracked client rather than server nonces and nonce count. When a session ID was present, authentication was bypassed. The user name and password were n...

IT Security Horror Stories: Tale of the Fake IT Rep

Some IT security monsters arent as obvious as a Mummy. At Coalfire Labs, we discover--and help our clients address--some pretty scary security and compliance problems. There are lots of deceptive monsters looking to exploit the weaknesses of their victims. This is one of those terrifying but true...

ecshop csrf getshell

简要描述： 吐槽下ecshop后台安全性真的太弱了。。前台组合xss来猥琐的让管理员后台getshell 详细说明： 0x0 后台getshell 在includes/clstemplate.php fetch函数 / 处理模板文件 @access public @param string $filename @param sting $cacheid @return sring / function fetch$filename, $cacheid = '' if !$this-seterror errorreportingEALL ^ ENOTICE; $this-seterror+...

Microsoft Warns Users About ChapCrack Tool Availability

Microsoft is warning customers about the availability of the ChapCrack tool that Moxie Marlinspike built to crack the VPN credentials for systems built on MS-CHAPv2 protocol. The company said that while it’s not aware of any active attacks using the tool, customers can protect themselves by...

Microsoft Releases Attack Surface Analyzer Tool

Microsoft has released a public version of its internal Attack Surface Analyzer tool, which helps organizations identify changes to a system’s attack surface as new applications are added. The tool has been in beta for a few months, but this is the first official release. The Attack Surface...

security advisory: AirDroid 1.0.4 beta

Dear Sir or Madam, we'd like to publish the following advisory. Thanks in advance. TC-SA-2012-02: Several weaknesses in implementation of security features in AirDroid 1.0.4 beta Published: 2012/07/12 Advisory-Version: 1.0 Affected products: AirDroid 1.0.4 beta References: TC-SA-2012-02...

AirDroid multiple security vulnerabilities

Multiple cryptography weaknesses...

tomcat: Multiple weaknesses in HTTP DIGEST authentication

DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret aka private key, which makes it easier for remote attackers to bypass cryptographic...

Interview: Android Engineered To Enable Data Harvesting

We wrote yesterday about research by Paul Brodeur of Leviathan Security Group on security weaknesses that are built into Google’s Android mobile operating system. Brodeur was able to show, using a proof of concept application, that Android applications without any permissions can still access fil...

HITB2011KUL - Hacking Androids for Profit

Document Title: =============== HITB2011KUL - Hacking Androids for Profit References: =========== Download: http://www.vulnerability-lab.com/resources/videos/412.wmv View: http://www.youtube.com/watch?v=QizOQjsjLq4 Release Date: ============= 2012-02-02 Vulnerability Laboratory ID VL-ID:...

Thinking About Software Security Holistically

While assessing software systems of all types a few common mistakes regularly come up. These aren’t mistakes that lead directly to vulnerabilities, but mistakes in how some software companies think about security, that can lead to invalid assumptions, and ultimately which can allow real security...

RHEL 5 : tomcat5 (RHSA-2011:1845)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1845 advisory. - tomcat: file permission bypass flaw CVE-2010-3718 - tomcat: XSS vulnerability in HTML Manager interface CVE-2011-0013 - tomcat: Multiple...

Spoofing

The billing system for Parallels Plesk Panel 10.3.1build1013110726.09 does not disable the SSL 2.0 protocol, which makes it easier for remote attackers to conduct spoofing attacks by leveraging protocol weaknesses...

JonDo 00.16.001 Released - Automatic error recognition and easier usability

JonDo 00.16.001 Released - Automatic error recognition and easier usability JonDos publishes a new version of the JonDo-Software, an IP changer and IP anonymization program, that you can use for anonymous surfing in the Internet with high security anonymous proxy servers. What is JonDo? JonDo is ...