Last updated:
Sat Jul 4 04:07:54 2015 GMT
  2014 FIRST Annual Conference in Boston - Register now


Recent bugs
via SecurityFocus,
Oracle Java SE CVE-2015-0486 Remote Security Vulnerability
Cisco AnyConnect Secure Mobility Client CVE-2015-0761 Local Privilege Escalation Vulnerability
Apache Tomcat 'mod_jk' CVE-2014-8111 Information Disclosure Vulnerability
Linux Kernel 'fs/pipe.c' Multiple Local Memory Corruption Vulnerabilities
Multiple Cisco Products CVE-2015-0744 Denial of Service Vulnerability
WordPress ReFlex Gallery Plugin 'php.php' Arbitrary File Upload Vulnerability
Google Chrome CVE-2015-1265 Multiple Unspecified Security Vulnerabilities
Google Chrome Prior to 43.0.2357.65 Multiple Security Vulnerabilities
Oracle Java SE CVE-2015-0459 Remote Security Vulnerability
Multiple OleumTech Products CVE-2014-2362 Predictable Random Number Generator Weakness
Recent advisories
via Secunia, US-CERT,
TA12-073A: Microsoft Updates for Multiple Vulnerabilities
TA12-045A: Microsoft Updates for Multiple Vulnerabilities
TA12-024A: "Anonymous" DDoS Activity
TA12-010A: Microsoft Updates for Multiple Vulnerabilities
TA12-006A: Wi-Fi Protected Setup (WPS) Vulnerable to Brute-Force Attack
TA11-350A: Adobe Updates for Multiple Vulnerabilities
TA11-347A: Microsoft Updates for Multiple Vulnerabilities
TA11-312A: Microsoft Updates for Multiple Vulnerabilities
TA11-286A: Apple Updates for Multiple Vulnerabilities
TA11-284A: Microsoft Updates for Multiple Vulnerabilities
TA11-256A: Microsoft Updates for Multiple Vulnerabilities
TA11-222A: Adobe Updates for Multiple Vulnerabilities
TA11-221A: Microsoft Updates for Multiple Vulnerabilities
TA11-201A: Oracle Updates for Multiple Vulnerabilities
TA11-200A: Security Recommendations to Prevent Cyber Intrusions
TA11-193A: Microsoft Updates for Multiple Vulnerabilities
TA11-165A: Microsoft Updates for Multiple Vulnerabilities
TA11-166A: Adobe Updates for Multiple Vulnerabilities
TA11-130A: Microsoft Updates for Multiple Vulnerabilities
TA11-102A: Microsoft Updates for Multiple Vulnerabilities
Bugtraq Topics
via SecurityFocus,
iTunes 12.2 and QuickTime 7.7.7 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED and VULNERABLE pathnames C:\Program Files\...
ESA-2015-111: EMC Documentum WebTop Client Products Multiple Vulnerabilities
ESA-2015-112: EMC Isilon OneFS Command Injection Vulnerability
ESA-2015-108: EMC Documentum D2 Multiple DQL Injection Vulnerabilities
Exploit Code for ipTIME firmwares < 9.58 (root RCE against 127 router models)
APPLE-SA-2015-06-30-1 iOS 8.4
APPLE-SA-2015-06-30-2 OS X Yosemite v10.10.4 and Security Update 2015-005
APPLE-SA-2015-06-30-3 Mac EFI Security Update 2015-001
APPLE-SA-2015-06-30-4 Safari 8.0.7, Safari 7.1.7, and Safari 6.2.7
CVE-2015-4674 - TimeDoctor autoupdate over plain-HTTP
Top Worms and Viruses
via Sophos,
Latest MS bulletins
via Microsoft,
MS11-703 - Important: Test MNP bulletin #3 (test0703)
MS11-702 - Moderate: Test MNP bulletin #2 (test0702)
MS11-701 - Low: Test MNP bulletin #1 (test0701)
MS11-069 - Moderate: Vulnerability in .NET Framework Could Allow Information Disclosure (2567951)
MS11-068 - Moderate: Vulnerability in Windows Kernel Could Allow Denial of Service (2556532)
MS11-067 - Important: Vulnerability in Microsoft Report Viewer Could Allow Information Disclosure (2578230)
MS11-066 - Important: Vulnerability in Microsoft Chart Control Could Allow Information Disclosure (2567943)
MS11-065 - Important: Vulnerability in Remote Desktop Protocol Could Allow Denial of Service (2570222)
MS11-064 - Important: Vulnerabilities in TCP/IP Stack Could Allow Denial of Service (2563894)
MS11-063 - Important: Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege (2567680)
Stock Watch
via Yahoo! Finance
Updated 7/2/2015
^ixic 5009.21 -3.91
jnpr 26.11 -0.19
symc 23.03 -0.18
csco 27.33 -0.02
ckp 10.07 -0.12
msft 44.40 -0.04
ibm 165.09 +0.60
intc 30.555 +0.375
amd 2.53 +0.11
cic.to 10.26 +0.05
ca 29.53 +0.02
bcsi N/A N/A
vrsn 62.87 -0.43
intc 30.555 +0.375
CUDA 39.51 -0.03
splk 69.72 +0.25
feye 48.19 -0.32
qlys 38.57 -1.47
panw 173.90 -2.24
hpq 30.69 +0.17
impv 67.00 -0.10
pfpt 63.62 -0.75

 

Recent News

Vigil@nce - busybox: bypass of modprobe filter, analyzed on 18/06/2015
Vigil@nce - public vulnerabilities
A privileged attacker can add path separator to module names, in order to make modprobe of busybox load forbidden modules.

The last seconds are ticking off the U.S. IPv4 network clock
LinuxSecurity.com - Latest News
LinuxSecurity.com: The American Registry for Internet Numbers (ARIN), the nonprofit group that manages Internet addresses for Canada, most Caribbean countries, and the United States, announced that it has activated its Unmet Request Policy. What th

Security News This Week: Your VPN Probably Isn't Private
LinuxSecurity.com - Latest News
LinuxSecurity.com: So many hacks, so few days in the week to write alarming stories about every one. Here's our roundup of what you have may missed this week.

Akamai Identifies Old Protocol in New DrDoS Attacks
LinuxSecurity.com - Latest News
LinuxSecurity.com: An old protocol found in SOHO routers may be responsible for recent DrDoS attacks, says the security steam at Akamai. Akamai, through the company's Prolexic Security Engineering & Research Team (PLXsert), issued an alert today f

Vigil@nce - Wireshark: two vulnerabilities, analyzed on 18/06/2015
Vigil@nce - public vulnerabilities
An attacker can use several vulnerabilities of Wireshark.

Vigil@nce - Cisco Adaptive Security Appliance: lack of integrity check of IPsec flows, analyzed on 18/06/2015
Vigil@nce - public vulnerabilities
An attacker can change IPsec packets or inject new ones to be handled by Cisco Adaptive Security Appliance, in order to corrupt the plain text.

Xen Information Disclosure Vulnerabilities
SecuriTeam.com
The emulation routines for X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.

WonderPlugin Audio Player 2.0 Blind SQL Injection Vulnerabilities
SecuriTeam.com
Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[

Websense Data Security DLP Incident Forensics Preview Cross-Site Scripting Vulnerabilities
SecuriTeam.com
Multiple cross-site scripting (XSS) vulnerabilities in the data loss prevention (DLP) incident Forensics Preview in Websense Triton 7.8.3 and V-Series 7.7 appliances allow remote attackers to inject arbitrary web script or HTML via a crafted (1) email or

SPCanywhere Information Disclosure Vulnerabilities
SecuriTeam.com
The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP addresses and spoof servers by intercepting the client-server

Samsung IPolis XnsSdkDeviceIpInstaller.ocx ActiveX Remote Code Execution Vulnerabilities
SecuriTeam.com
Buffer overflow in the XnsSdkDeviceIpInstaller.ocx ActiveX control in Samsung iPOLiS Device Manager 1.12.2 allows remote attackers to execute arbitrary code via a long string in the first argument to the (1) ReadConfigValue or (2) WriteConfigValue functio

PHP Integer Overflow Application Crash Vulnerabilities
SecuriTeam.com
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of se

OpenSSL Remote Memory Corruption Vulnerabilities
SecuriTeam.com
Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption

Mozilla Firefox Double Free Memory Corruption Vulnerabilities
SecuriTeam.com
Double free vulnerability in the nsXMLHttpRequest::GetResponse function in Mozilla Firefox before 36.0, when a nonstandard memory allocator is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) vi

LibXfont Font Out-Of-Bounds Memory Access Vulnerabilities
SecuriTeam.com
The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memo

IBM Rational ClearCase Cleartext Server Passwords Vulnerabilities
SecuriTeam.com
IBM Rational ClearCase 8.0.0 before 8.0.0.14 and 8.0.1 before 8.0.1.7, when Installation Manager before 1.8.2 is used, retains cleartext server passwords in process memory throughout the installation procedure, which might allow local users to obtain sens

HP Integrated Lights-Out Security Vulnerabilities
SecuriTeam.com
HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3 before 1.82, and 4 before 2.10 allows remote attackers to bypass intended access restrictions or cause a denial of service

GNU Glibc Infinite Loop Denial Of Service Vulnerabilities
SecuriTeam.com
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing

EMC Secure Remote Services Virtual Edition SQL Injection Vulnerabilities
SecuriTeam.com
SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary SQL commands

Cups-Filters Execute Arbitrary Commands Vulnerabilities
SecuriTeam.com
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL.

Cisco Common Services Multiple Cross Site Scripting Vulnerabilities
SecuriTeam.com
Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML

Adobe Font Driver Could Allow Remote Code Execution Vulnerabilities
SecuriTeam.com
Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive

Attackers Revive Deprecated RIPv1 Routing Protocol in DDoS Attacks
LinuxSecurity.com - Latest News
LinuxSecurity.com: A long-deprecated-and aptly named-routing protocol, RIPv1, still has some life to it. Hackers, since the middle of May, have been carrying out reflection- and amplification-style distributed denial of service attacks using home

Workarounds, kludges, and hacks that will improve your life
LinuxSecurity.com - Latest News
LinuxSecurity.com: Life would be simpler if every piece of technology we dealt with worked in an obvious and straightforward way. Life would also be a lot duller.

How to access Wi-Fi anonymously from miles away
LinuxSecurity.com - Latest News
LinuxSecurity.com: Staying anonymous online is difficult, if not almost impossible. Standard traffic can be monitored, government agencies enjoy slurping vast amounts of data, and even networks such as Tor and VPNs can only protect you so far. For

Xiaomi books 1H sales fall, putting full-year goal in doubt
Yahoo! News: Security News

Vigil@nce - curl: information disclosure via SMB, analyzed on 17/06/2015
Vigil@nce - public vulnerabilities
A attacker who controls a SMB server can read a memory fragment of the client process using curl, in order to obtain sensitive information.

Blacklist warnings spread on websites in North Korea
Yahoo! News: Security News
TOKYO (AP) North Korea, already one of the least-wired places in the world, appears to be cracking down on the use of the Internet by even the small number of foreigners who can access it with relative freedom by blacklisting and blocking social media ac

Xen Memory Corruption Vulnerabilities
SecuriTeam.com
The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly exec

Wireshark ATN-CPDLC Dissector Denial Of Service Vulnerabilities
SecuriTeam.com
The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements, which allows remote attackers to cause a denial of se

Websense TRITON AP-EMAIL Security Vulnerabilities
SecuriTeam.com
Websense TRITON AP-EMAIL before 8.0.0 has an impact and attack vectors

WebGate EDVR Manager Multiple Stack Buffer Overflow Vulnerabilities
SecuriTeam.com
Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary code via unspecified vectors to the (1) LoadImage or (2) LoadImageEx function in the WESPMonitor.WESPMonitorCtrl.1 control, (3) ChangePa

UnAce Buffer Overflow Vulnerabilities
SecuriTeam.com
Integer overflow in unace 1.2b allows remote attackers to cause a denial of service (crash) via a small file header in an ace archive, which triggers a buffer overflow.

Tcpdump IPv6 Mobility/TCP/Ethernet/Force Printer Crash Vulnerabilities
SecuriTeam.com
The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) length, (2) offset, or (3) base pointer checksum value.

Spring Framework Predictable Session ID Generation Vulnerabilities
SecuriTeam.com
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions

SCADA Engine BACnet OPC Server Remote Heap Buffer Overflow Vulnerabilities
SecuriTeam.com
Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet.

Samba 'TALLOC_FREE()' Function Remote Code Execution Vulnerabilities
SecuriTeam.com
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute ar

PNG Processing Information Disclosure Vulnerabilities
SecuriTeam.com
Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize memory for rendering of malformed PNG

Ninja Forms WordPress Plugin Multiple Cross-Site Scripting Vulnerabilities
SecuriTeam.com
Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admi

MyConnection Server 8.2b Cross Site Scripting Vulnerabilities
SecuriTeam.com
Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variable, or (3) et parameter to myspeed/db/historyitem.

Mozilla Firefox Denial Of Service Vulnerabilities
SecuriTeam.com
The mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 36.0 allows remote attackers to cause a denial of service (out-of-bounds write of zero values, and application crash) via vectors that trigger use of DrawTarge

Microsoft Windows DLL Loading Remote Code Execution Vulnerabilities
SecuriTeam.com
Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain

Microsoft Kernel Mode Driver Local Information Disclosure Vulnerabilities
SecuriTeam.com
The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly restrict the availabil

JBoss RichFaces 'do' Parameter Remote Code Execution Vulnerabilities
SecuriTeam.com
JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.

IBM WebSphere Portal Cross Site Request Forgery Vulnerabilities
SecuriTeam.com
Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Older News

Google Chrome Prior To 41.0.2272.76 Integer Overflow Vulnerabilities
SecuriTeam.com

EMC Isilon OneFS Privilege Escalation Vulnerabilities
SecuriTeam.com

Adobe Font Driver Remote Code Execution Vulnerabilities
SecuriTeam.com

Donald Trump's hotel collection under possible credit card breach: blog
Yahoo! News: Security News

DDoS Attackers Exploiting '80s-Era Routing Protocol
LinuxSecurity.com - Latest News

OpenDNS Acquisition Gives Cisco Big Security Data
LinuxSecurity.com - Latest News

Amazon introduces new open-source TLS implementation 's2n'
LinuxSecurity.com - Latest News

Vigil@nce - Redhat OpenSSL: denial of service via locking management, analyzed on 16/06/2015
Vigil@nce - public vulnerabilities

The Trouble with Security
WindowSecurity.com

Emails show top officials aware of Clinton's private address
Yahoo! News: Security News

Analyses of root causes?
RISKS Digest

California mandatory vaccination harbinger of anti-virus software?
RISKS Digest

Growing opposition to the Leap Second
RISKS Digest

Leap Second problem
RISKS Digest

ISIS and the Lonely Young American
RISKS Digest

The Future of Car Keys? Smartphone Apps, Maybe
RISKS Digest

Automation dependency: Children of the Magenta
RISKS Digest

"Tap your iPad to order: Restaurant automation nobody needs"
RISKS Digest

"Microsoft quietly pushes 17 new trusted root certificates to all Windows systems"
RISKS Digest

"Sad day for developers: SCOTUS denies Google's appeal on APIs"
RISKS Digest

The sharp elbows of driverless cars
RISKS Digest

WiFi Offloading is Skyrocketing
RISKS Digest

*The Washington Post* to Deploy More Secure HTTPS Across Site
RISKS Digest

The latest RISKS items from TechWeekEurope
RISKS Digest

Most Internet anonymity [VPN service] software leaks users' details
RISKS Digest

Israel's comptroller: Biometric database full of flaws
RISKS Digest

Top Obama aides knew about Clinton's private email in 2009
Yahoo! News: Security News

WordPress Captcha Plugin CAPTCHA Security Bypass Vulnerabilities
SecuriTeam.com

Video Gallery Plugin For WordPress Vid SQL Injection Vulnerabilities
SecuriTeam.com

The Slapi-Nis Plug-In Infinite Loop And CPU Consumption Vulnerabilities
SecuriTeam.com

Tcpdump IPv6 Mobility/TCP/Ethernet/Force Printer Denial Of Service Vulnerabilities
SecuriTeam.com

Schneider Electric InduSoft Web Studio Brute-Force Password-Guessing Attack Vulnerabilities
SecuriTeam.com

PHP Libmagick 'src/softmagic.c' Out-Of-Bounds Read Vulnerabilities
SecuriTeam.com

OpenStack Glance Denial Of Service Vulnerabilities
SecuriTeam.com

Multiple Cisco Products Denial Of Service Vulnerabilities
SecuriTeam.com

Mozilla Firefox Buffer Underflow Vulnerabilities
SecuriTeam.com

Microsoft Windows Registry Virtualization Local Privilege Escalation Vulnerabilities
SecuriTeam.com

Manage Engine AD Audit Manager Plus Admin Panel Reflected Cross-Site Scripting Vulnerabilities
SecuriTeam.com

Libssh2 Denial Of Service Vulnerabilities
SecuriTeam.com

IBM WebSphere Portal 8.5.0 Cross-Site Scripting Vulnerabilities
SecuriTeam.com

Hospira MedNet Hardcoded Cryptographic Key Vulnerabilities
SecuriTeam.com

Google Chrome Prior To 41.0.2272.76 Trigger Movement Of A SCRIPT Element Vulnerabilities
SecuriTeam.com

EMC Documentum XMS Sensitive Information Disclosure Vulnerabilities
SecuriTeam.com

Cisco Unified Computing System C-Series DHCP Packet Handling Denial Of Service Vulnerabilities
SecuriTeam.com

Cisco IOS And IOS-XE ANI Device Reload Vulnerabilities
SecuriTeam.com

Cisco IOS-XE Common Flow Table Device Reload Vulnerabilities
SecuriTeam.com

Bsdcpio In Libarchive Absolute Path Traversal Vulnerabilities
SecuriTeam.com

Apple Mac OS X And IOS Multiple Buffer Overflow Vulnerabilities
SecuriTeam.com

Adobe Flash Player Type Confusion Remote Code Execution Vulnerabilities
SecuriTeam.com


all content is copyright its respective owner or owners. the tools and components behind this page are copyright © 2003-2010 jose nazario, all rights reserved. this page is available as RSS 2.0.