Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload.
Monthly Archives: January 2015
Multiple persistent XSS vulnerabilites in CMS BEdita v. 3.4.0
Posted by Steffen Rösemann on Jan 08
Advisory: Multiple persistent XSS vulnerabilites in CMS BEdita v. 3.4.0
Advisory ID: SROEADV-2014-10
Author: Steffen Rösemann
Affected Software: CMS BEdita v. 3.4.0 (Release-Date: 9th-May-2014)
Vendor URL: http://www.bedita.com
Vendor Status: working on a patch
CVE-ID: –
==========================
Vulnerability Description:
==========================
The CMS BEdita v. 3.4.0 (Release: 9th-May-2014) suffers multiple persistent
XSS…
Recon 2015 Call For Papers – June 19 – 21, 2015 – Montreal, Canada
Posted by cfp2015 on Jan 08
+ + + +
+ + +
+ +
/
+ _ – _+_ – ,__
_=. .:. /= _|===|_ ||::|
| | _|. | | | | | | __===_ -=- ||::|
|==| |…
Posting a privacy notice on Facebook is useless
An old hoax has been resurrected after Facebook made a recent announcement about its updated privacy policy. The copyright message claims to protect users’ pictures, information, and posts under UCC 1-308- 1 1 308-103 and the Rome Statute. It’s seems so official; it just must be true, right? Here is an example that I saw on my newsfeed this morning.
Other variations have come through in the past few days with legal-sounding statements, like this:
“In response to the new Facebook guidelines, I hereby declare that my copyright is attached to all of my personal details, illustrations, comics, paintings, professional photos and videos, etc. (as a result of the Berner Convention)….”
The good news is that Facebook users are becoming more aware of privacy issues, and they seek a way to control their own shared media. The bad news is that this notification has no legal standing at all, you are bound to the terms and conditions that you agreed to when you signed up with Facebook, and you are annoying your friends.
The truth is that YOU own all of the content and information you post on Facebook, and YOU can control how it is shared through your privacy and application settings. If you neglect to look at those settings, you grant Facebook a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any content that you post on or in connection with Facebook.
In tomorrow’s blog, we will share the top 3 areas in Facebook where you need to make sure the privacy is set to your liking.
OpenSSL Fixes Eight Security Vulnerabilities
The OpenSSL Project has released several new versions of the software that fix eight security vulnerabilities, including several certificate issues and a couple of denial-of-service flaws. The patches included in OpenSSL 1.0.0p, 1.0.1k and 0.98zd are not for critical or high-risk vulnerabilities, but they do fix some interesting vulnerabilities. Two of the bugs are rated moderate and the other […]
CVE-2014-9575 (vdg_sense)
VDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypass authentication, and consequently read and modify arbitrary plugin settings, via an encoded : (colon) character in the Authorization HTTP header.
CVE-2014-9576 (vdg_sense)
VDG Security SENSE (formerly DIVA) 2.3.13 has a hardcoded password of (1) ArpaRomaWi for the root Postgres account and !DVService for the (2) postgres and (3) NTP Windows user accounts, which allows remote attackers to obtain access.
CVE-2014-9577 (vdg_sense)
VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response.
CVE-2014-9578 (vdg_sense)
VDG Security SENSE (formerly DIVA) 2.3.13 performs authentication with a password hash instead of a password, which allows remote attackers to gain login access by leveraging knowledge of password hash.
CVE-2014-9579 (vdg_sense)
VDG Security SENSE (formerly DIVA) 2.3.13 stores administrator credentials in cleartext, which allows attackers to obtain sensitive information by reading the plugin configuration files.