Symbol DoS vulnerability in Active Record

When a hash is provided as the find value for a query, the keys of the hash may be converted to symbols. Carefully crafted requests can coerce params:name to return a hash, and the keys to that hash may be converted to symbols. All users running an affected release should either upgrade or use on...

CVE-2012-6355

IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through 7.2, Tivoli Service Request Manager 7.1 and 7.2, Maximo Service Desk 6.2, Change and Configuration Management Database CCMDB 7.1 and 7.2, and SmartCloud...

CVE-2012-6355

IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through 7.2, Tivoli Service Request Manager 7.1 and 7.2, Maximo Service Desk 6.2, Change and Configuration Management Database CCMDB 7.1 and 7.2, and SmartCloud...

CVE-2012-6355: Undefined Security Weakness

IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through 7.2, Tivoli Service Request Manager 7.1 and 7.2, Maximo Service Desk 6.2, Change and Configuration Management Database CCMDB 7.1 and 7.2, and SmartCloud...

FreeBSD : Ruby Activemodel Gem -- Circumvention of attr_protected (beab40bf-c1ca-4d2b-ad46-2f14bac8a968)

Aaron Patterson reports : The attrprotected method allows developers to specify a blacklist of model attributes which users should not be allowed to assign to. By using a specially crafted request, attackers could circumvent this protection and alter values that were meant to be protected. All...

Ruby Activemodel Gem -- Circumvention of attr_protected

Aaron Patterson reports: The attrprotected method allows developers to specify a blacklist of model attributes which users should not be allowed to assign to. By using a specially crafted request, attackers could circumvent this protection and alter values that were meant to be protected. All use...

Paypal hacker escaped jail

In London today, an 18-year-old anonymous hacker received an 18-month youth rehabilitation order and a 60-hour unpaid work requirement for his involvement in "Operation Payback". One strike against Paypal alone cost the site £3.5 million pounds. But Jake Birchall escaped jail today after the judg...

CVE-2012-3190: Undefined Security Weakness

Unspecified vulnerability in the Oracle Universal Work Queue component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity, related to UWQ Server Issues...

PT-2013-1577

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 Description The issue affects confidentiality and integrity, and is related to UWQ Server Issues in the Oracle Universal Work Queue component. Recommendations For...

CVE-2012-5649 Apache CouchDB JSONP arbitrary code execution with Adobe Flash

CVE-2012-5649 JSONP arbitrary code execution with Adobe Flash Severity: Moderate Vendor: The Apache Software Foundation Affected Versions: JSONP is supported but disabled by default in all currently supported releases of Apache CouchDB. Administrator access is required to enable it. Releases up t...

New Linux Rootkit Attacks Internet Users

Security researchers have discovered what appears to be an experimental Linux rootkit designed to infect its highly select victims during a classic drive-by website attack. The malware allows hackers to inject code directly in any infected web page. The new malware, discovered on November 13 of...

CVE-2012-0748

Multiple cross-site request forgery CSRF vulnerabilities in unspecified services in IBM Rational Team Concert RTC 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in unspecified services in IBM Rational Team Concert RTC 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items...

CVE-2012-0748: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in unspecified services in IBM Rational Team Concert RTC 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items...

PT-2012-2839

Name of the Vulnerable Software and Affected Versions IBM Rational Team Concert RTC versions prior to 4.0.0.1 Description The issue affects unspecified services in IBM Rational Team Concert, allowing remote attackers to hijack the authentication of arbitrary users for requests that modify work...

SAP Netweaver Dispatcher 7.0 EHP1/2 Multiple Vulnerabilities

Exploit for multiple platform in category dos / poc 1. Advisory Information Title: SAP Netweaver Dispatcher Multiple Vulnerabilities Advisory ID: CORE-2012-0123 Advisory URL: http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities Date published: 2012-05-08 Date of...

USN-1525-1: Calligra vulnerability

It was discovered that Calligra incorrectly handled certain malformed MS Word documents. If a user or automated system were tricked into opening a crafted MS Word file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program...

LinkedIn Data breach costs $1 million

Business networking site LinkedIn has announced it took a hit of up to $1 million due to one of the year's largest reported data breaches. LinkedIn spent between $500,000 and $1 million on forensic work after a large number of passwords were breached, LinkedIn CFO Steve Sordello said on the...

SA-CONTRIB-2012-105 - Hashcash - Cross Site Scripting (XSS)

The Hashcash project is an implementation of a Proof Of Work POW or Puzzle scheme where users of a service have to do computational work to have their request granted. In the case of the Drupal Hashcash project, the service is 'form submission' and the Proof Of Work is a token that causes a parti...

Apache Tomcat: Multiple vulnerabilities

Background Apache Tomcat is a Servlet-3.0/JSP-2.2 Container. Description Multiple vulnerabilities have been discovered in Apache Tomcat. Please review the CVE identifiers referenced below for details. Impact The vulnerabilities allow an attacker to cause a Denial of Service, to hijack a session, ...