Persistent XSS in Ghost 0.11.3

Posted by Patrick on Jan 19

=====[ Tempest Security Intelligence – ADV-9/2017 ]========================

Persistent Cross-Site Scripting (XSS) in Ghost
——————————————————-
Author:
– Patrick Costa < patrickrbcosta () gmail.com >

Tempest Security Intelligence – Recife, Pernambuco – Brazil

=====[ Table of Contents ]=================================================

1. Overview
2. Detailed description
3….

[RCESEC-2016-012] Mattermost <= 3.5.1 "/error" Unauthenticated Reflected Cross-Site Scripting / Content Injection

Posted by Julien Ahrens on Jan 19

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: Mattermost
Vendor URL: www.mattermost.org
Type: Cross-Site Scripting [CWE-79]
Date found: 02/12/2016
Date published: 16/01/2017
CVSSv3 Score: 4.7 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)
CVE: –

2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE…

Tap 'n' Sniff

Posted by Curesec Research Team (CRT) on Jan 19

Content Table

1. Introduction
2. Failsafe mode
3. Installing Openwrt
4. Configuring Openwrt
5. Testing

1. Introduction

The goal of this guide is to provide a reliable and fast way for creating a lan
tap for red team assessments of networks. While this was our main target this
tap is also quite helpful if you want to have a great device for your daily
analysis of network attached computers. Before we started with our
implementation we made a…

APPLE-SA-2017-01-18-1 GarageBand 10.1.5

Posted by Apple Product Security on Jan 19

APPLE-SA-2017-01-18-1 GarageBand 10.1.5

GarageBand 10.1.5 is now available and addresses the following:

Projects
Available for: OS X Yosemite v10.10 and later
Impact: Opening a maliciously crafted GarageBand project file may
lead to arbitrary code execution
Description: A memory corruption issue was addressed through improved
memory handling.
CVE-2017-2372: Tyler Bohan of Cisco Talos

Installation note:

GarageBand 10.1.5 may be obtained from…

APPLE-SA-2017-01-18-2 Logic Pro X 10.3

Posted by Apple Product Security on Jan 19

APPLE-SA-2017-01-18-2 Logic Pro X 10.3

Logic Pro X 10.3 is now available and addresses the following:

Projects
Available for: OS X Yosemite v10.10 and later (64 bit)
Impact: Opening a maliciously crafted GarageBand project file may
lead to arbitrary code execution
Description: A memory corruption issue was addressed through improved
memory handling.
CVE-2017-2372: Tyler Bohan of Cisco Talos

Installation note:

Logic Pro X 10.3 may be obtained…

[ERPSCAN-16-036] SAP ASE ODATA SERVER – DENIAL OF SERVICE

Posted by ERPScan inc on Jan 19

Application: SAP ASE

Versions Affected: SAP ASE ODATA Server v16

Vendor URL: http://SAP.com

Bugs: Denial of Service

Sent: 01.02.2016

Reported: 02.02.2016

Vendor response: 02.02.2016

Date of Public Advisory: 12.10.2016

Reference: SAP Security Note 2330422

Author: Vahagn @vah_13 Vardanyan (ERPScan)

Description

1. ADVISORY INFORMATION

Title:[ERPSCAN-16-036] SAP ASE ODATA SERVER – DENIAL OF SERVICE

Advisory ID:[ERPSCAN-16-036]

Risk:…

[ERPSCAN-16-037] SAP NetWeaver AS JAVA P4 – INFORMATION DISCLOSURE

Posted by ERPScan inc on Jan 19

Application: SAP NetWeaver AS JAVA

Versions Affected: SAP NetWeaver AS JAVA 7.11-7.4

Vendor URL: http://SAP.com

Bugs: Information disclosure

Sent: 10.03.2016

Reported: 11.03.2016

Vendor response: 11.03.2016

Date of Public Advisory: 12.10.2016

Reference: SAP Security Note 2331908

Author: Vahagn @vah_13 Vardanyan (ERPScan)

Description

1. ADVISORY INFORMATION

Title:[ERPSCAN-16-037] SAP NetWeaver AS JAVA P4 MSPRUNTIMEINTERFACE…

Pirate Party: the Future of Politics?

Could Iceland’s Hacker-founded Pirate Party be the Future of Politics?

So, Donald Trump is president of the leading world power. Yes, that really happened. While the jury is still out on the reasons behind the new president’s rise to power, many believe it’s down to a sense of apathy towards left wing politicians, in this case Hillary Clinton and the Democrats, who would otherwise be the traditional harbingers of progress and change.

One political movement however, is trying to do away with this apathy by embracing something that we’re all about here at Panda Security: online privacy and security on the web!

Introducing Iceland’s wing of the Pirate Party.

Okay, you’ve most likely heard of them already as 2016 is looking to have been a watershed year for them, having tripled their seats in Iceland’s parliament during October’s elections.

This party have really caught our attention though, and that of many others worldwide, with the way they are embracing technology and highlighting how it can play a much much larger role in the future of democracy.

The Pirate Party can be considered a worldwide movement, with branches cropping up all over, including in the UK, Australia and the US.

The first iteration of the party was founded in Sweden by Rick Falkvinge in 2006 after the Pirate Bay torrent website was raided by police. The fact that visitors to the website more than doubled due to media exposure following the raid, was enough of a signal that legislation was out of touch with public opinion when it came to online distribution and surveillance laws. And so was named, Sweden’s Pirate Party.

How did Iceland’s Pirate Party become so popular?

Iceland’s Pirate Party is based on the Swedish party’s model, however, it has its own ideas about issues like data protection as well as how Iceland should be run as a country. Their propositions seem to be appealing to an Iceland that is increasingly looking to break from the status quo.

Birgitta Jónsdóttir, a former Wikileaks volunteer, co-founded Iceland’s Pirate Party in 2012 along with other prominent activists and hackers. According to Jónsdóttir, Iceland’s Pirate Party can sense the winds of change and they see a future of technology-centered upheaval. In a recent interview she said, “we have to be innovative to fight against political apathy”.

But what does she mean by this? Well, the Pirate Party are very much working within the political system to advocate a peaceful political revolution based on greater political transparency, and a grass roots approach to politics. Think Mr.Robot gone mainstream.

The Pirate Party want to increase public participation in common-decision making by giving them direct access to the process via the Internet. Under their system, the public would be able to propose and veto legislation using the party’s online voting system.

Jónsdóttir has also gone on record saying the Pirates would implement propositions such as the United Nations’ proposed resolution, ‘The right to privacy in the digital age’. The resolution, aimed largely at addressing and curbing world governments’ illegal surveillance methods has, for all intents and purposes, been largely ignored by world governments.

The party’s success and recent popularity also comes after the backlash the traditional parties in Iceland have suffered following the 2008 financial crisis and, most recently, the stepping down of the country’s prime minister, Sigmundur Davíð Gunnlaugsson, following his implication in the Panama Papers scandal. Many Icelanders feel it’s time for change and that the Pirate Party are

But they’re hackers!

In a recent interview, Jónsdóttir said “we do not define ourselves as left or right but rather as a party that focuses on [reforming] the systems. In other words, we consider ourselves hackers.”

But what questions does this bring up? Hackers are bad right?

Well, yes and no. A hacker can be defined in various ways; it could be someone who breaks down firewalls and retrieves information, often illegally, or someone who finds simple solutions –a hack- to everyday problems. The Pirate Party propose themselves as the latter, a party that will introduce simple hacks to problems they feel the current system refuses to deal with.

Many questions still arise as to how their vision of Iceland’s future would function in the real world. Increasing democratic reach through the use of the Internet seems like a logical step in this technological age, but what are the dangers? In this future world, could a DDOS attack bring government to a halt? Could a malicious hacker bypass encryption and twist legislation by altering online poll results in their favor? Would transferring the democratic process onto the web empower hackers in new unconceivable ways?

In a recent interview, Ben de Biel, a spokesperson for Berlin’s Pirate Party claimed, “the established parties browse the Internet but we work with it.” Whilst any Pirate Party coming to power would lead to unprecedented change, Iceland’s is the closest to getting there. Their plans, if put into action, could lead to very positive change in digital privacy laws, however, they would also bring to light an increasing necessity for cyber security in an age that is becoming more and more technology reliant.

The post Pirate Party: the Future of Politics? appeared first on Panda Security Mediacenter.

THN Deal — Become A Certified Ethical Hacker With This Online Training Course

Hacking is not a trivial process, but it does not take too long to learn. If you want to learn Ethical Hacking and Penetration testing, you are at right place.

We frequently receive emails from our readers on how to learn hacking, how to become an ethical hacker, how to break into computers, how to penetrate networks like a professional, how to secure computer systems and networks, and so on.

Stegano 0.6.2

Stegano is a basic Python Steganography module. Stegano implements two methods of hiding: using the red portion of a pixel to hide ASCII messages, and using the Least Significant Bit (LSB) technique. It is possible to use a more advanced LSB method based on integers sets. The sets (Sieve of Eratosthenes, Fermat, Carmichael numbers, etc.) are used to select the pixels used to hide the information.