The Data Provisioning Agent (aka DP Agent) in SAP HANA does not properly restrict access to service functionality, which allows remote attackers to obtain sensitive information, gain privileges, and conduct unspecified other attacks via unspecified vectors, aka SAP Security Note 2262742.
Monthly Archives: April 2016
CVE-2016-4017
The Data Provisioning Agent (aka DP Agent) in SAP HANA allows remote attackers to cause a denial of service (process crash) via unspecified vectors, aka SAP Security Note 2262710.
Journalist Matthew Keys gets 2-Year Prison term for helping Anonymous Hackers
Former Reuters journalist Matthew Keys, who was convicted last year of helping the Anonymous group of hackers, has been sentenced to 24 months in prison for computer hacking charges.
Keys was found guilty last year in October of giving Anonymous login credentials that allowed the group to deface the Los Angeles Times, a Tribune Media-owned newspaper, back in 2013.
After leaving the job
Re: end of useable crypto in browsers?
Posted by Sebastian on Apr 14
Hey,
That’s true. But the keygen element is flawed by the known-broken CA
system(*) and you can’t build a secure house on a broken foundation. You
could check whether the certificate for your site is issued by your CA,
but if the can issue certificates they could simply attack your browsers
updater. Our only hope for truly secure communication are tools like pgp
combined with anonymity through for example TOR or freenet (not the…
Call for Papers for 4th Balkan Computer Congress – BalCCon2k16
Posted by Milos Krasojevic on Apr 14
Call for Papers for 4th Balkan Computer Congress – BalCCon2k16
09|10|11 September 2016, Novi Sad, Vojvodina, Serbia, Europe, Earth,
Milky Way
The BalCCon2k16 staff are now soliciting papers to be presented at our
BalCCon2k16 Congress to be held 09 – 11th September in Novi Sad, Serbia.
The CfP in open until 1st July 2016.
The Event
Balkan Computer Congress is an annual three days gathering of the
international hacker…
DAVOSET v.1.2.8
Posted by MustLive on Apr 14
Hello participants of Mailing List.
After making public release of DAVOSET
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2013-June/008850.html),
I’ve made next update of the software. At 26th of March DAVOSET v.1.2.8 was
released – DDoS attacks via other sites execution tool
(http://websecurity.com.ua/davoset/).
Video demonstration of DAVOSET: http://www.youtube.com/watch?v=RKi35-f346I
GitHub:…
Re: end of useable crypto in browsers?
Posted by Seth Arnold on Apr 14
The only TLS client certificate authentication I see on a regular basis
is for CertFP use for IRC nickserv authentication and OpenVPN. Trying to
use a browser to perform either of these actions would be awkward at best.
What application or service do you know of that uses TLS client
authentication that requires browser integration? If you can demonstrate
users who will be affected they may be more amenable to your claims. (I
suspect the browser…
Re: end of useable crypto in browsers?
Posted by Sebastian on Apr 14
Hey,
to put it simply: No.
The real problem is that no one is using it. Yes, it is pretty secure,
but its too much trouble for most users (try to log in from your phone)
and also a baseless PITA for most server operators. It’s also not good
for business (you need to be able to restore the certificate easily,
have multiple devices, all your servers need https …). To make matters
worse many browser don’t even bother supporting it…
Re: end of useable crypto in browsers?
Posted by Árpád Magosányi on Apr 14
No doubt keygen have its problems. But there should be a bit more reason
for entirely removing a technology which is needed than “it is not
mature enough yet”.
One reason that the whole symmetric crypto technology could not mature
because getting key deployment right is not a straightforward task
(fscked up trust relationship did not help either, but that is an issue
which we can work around. With smart key management. Oh, wait…) ….
Django CMS 3.2.3 Filter Bypass / Script Insertion
Django CMS version 3.2.3 suffers from filter bypass and malicious script insertion vulnerabilities.