Posted by Juan Sacco on Feb 18
# Exploit author: Juan Sacco – jsacco () exploitpack com
# Affected program: Cisco ASA VPN Portal – Zero Day
# Cisco ASA VPN is prone to a XSS on the password recovery page.
# This vulnerability can be used by an attacker to capture other user’s
credentials.
# The password recovery form fails to filter properly the hidden inputs
fields.
#
# This Zero Day exploit has been developed and discovered by Juan Sacco.
# Exploit Pack – Team…
Posted by Necmettin COŞKUN on Feb 18
# Exploit Title    :Vesta Control Panel <= 0.9.8-15 – Persistent XSS Vulnerability
# Vendor Homepage  :http://www.vestacp.com
# Version          :0.9.8-15
# Exploit Author   :Necmettin COSKUN @babayarisiÂ
# Blog             :http://ha.cker.io
# Discovery date   :16/02/2016
# Tested on :Fedora23 -…
Vesta Control Panel versions 0.9.8-15 and below suffer from a persistent cross site scripting vulnerability via the user agent.
New survey suggests medical data breaches increase the number of patients who hold back information from doctors due to concerns about the security or privacy of medical records, undermining treatment.
The post Healthcare data breaches lead more patients to withhold information from doctors appeared first on We Live Security.
A unique survey among threat experts has revealed that most cyberattacks against a typical IT infrastructure take less than 24 hours to plan and execute, and almost half are successful.
The post How the threat experts see it … appeared first on We Live Security.
If you are using a SimpliSafe wireless home alarm system to improve your home security smartly, just throw it up and buy a new one. It is useless.
“Unfortunately, there’s no easy workaround for the issue since the keypad happily sends unencrypted PINs out to anyone listening,” Zonenberg explains.
“Normally, the vendor would fix the vulnerability in a new firmware version by adding cryptography to the protocol,” Zonenberg adds. But, “this isn’t an option for the affected SimpliSafe products because the microcontrollers in currently shipped hardware are one-time programmable.”
17th February, 2016
A security issue affects these releases of Ubuntu and its
derivatives:
xdelta3 could be made to crash or run programs if it opened a specially
crafted file.
It was discovered that xdelta3 incorrectly handled certain files. If a user
or automated system were tricked into processing a specially-crafted file,
a remote attacker could use this issue to cause xdelta3 to crash, resulting
in a denial of service, or possibly execute arbitrary code.
The problem can be corrected by updating your system to the following
package version:
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
17th February, 2016
A security issue affects these releases of Ubuntu and its
derivatives:
graphite2 could be made to crash or run programs as your login if it
opened a specially crafted font.
Yves Younan discovered that graphite2 incorrectly handled certain malformed
fonts. If a user or automated system were tricked into opening a specially-
crafted font file, a remote attacker could use this issue to cause
graphite2 to crash, resulting in a denial of service, or possibly execute
arbitrary code.
The problem can be corrected by updating your system to the following
package version:
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart applications using
graphite2, such as LibreOffice, to make all the necessary changes.
17th February, 2016
A security issue affects these releases of Ubuntu and its
derivatives:
NSS could be made to expose sensitive information.
Hanno Böck discovered that NSS incorrectly handled certain division
functions, possibly leading to cryptographic weaknesses. (CVE-2015-1938)
This update also refreshes the NSS package to version 3.21 which includes
the latest CA certificate bundle, and removes the SPI CA.
The problem can be corrected by updating your system to the following
package version:
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use NSS, such as Evolution and Chromium, to make all the necessary
changes.
Lock-screen types and file-encrypting “crypto-ransomware”, both of which have been causing major financial and data losses for many years, have made their way to the Android platform. ESET has prepared a topical white paper on the growth of this insidious Android malware.
The post The rise of Android ransomware appeared first on We Live Security.
