Monthly Archives: January 2015

Full Disclosure

full name disclosure information leak in google drive

Posted by kevin mcsheehan on Jan 21

exploit title: full name disclosure information leak in google drive
software link: https://drive.google.com/drive/#my-drive
author: kevin mcsheehan
website: http://mcsheehan.com
email: kevin () mcsheehan com
date: 01/20/15

source: http://mcsheehan.com/?p=15

description: google drive leaks the full name of a target email
address when said email address is associated with an uploaded file.
the full name is displayed whether or not the target…

Full Disclosure

CVE-2015-1169 – CAS Server 3.5.2 allows remote attackers to bypass LDAP authentication via crafted wildcards.

Posted by J. Tozo on Jan 21

=====[Alligator Security Team – Security Advisory]========

CVE-2015-1169 – CAS Server 3.5.2 allows remote attackers to bypass LDAP
authentication via crafted wildcards.

Reporter: José Tozo < juniorbsd () gmail com >

=====[Table of Contents]==================================

1. Background
2. Detailed description
3. Other contexts & solutions
4. Timeline
5. References

=====[1. Background]======================================…

Drupal

SA-CONTRIB-2015-029 – Corner – Cross Site Request Forgery (CSRF) – Unsupported

Description

This module enables you to add configurable corners to your site.

A malicious user can cause an administrator to enable and disable corners by getting the administrator’s browser to make a request to a specially-crafted URL while the administrator is logged in.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • All versions of Corner module

Drupal core is not affected. If you do not use the contributed Corner module,
there is nothing you need to do.

Solution

If you use the Corner module you should uninstall it.

Also see the Corner project page.

Reported by

  • Pere Orga provisional member of the Drupal Security Team

Fixed by

Not applicable.

Coordinated by

  • Pere Orga provisional member of the Drupal Security Team

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 
Drupal 6.x
NVD

CVE-2015-0411

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption.