The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object.
Monthly Archives: December 2014
CVE-2014-9372
Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) before 7103 allows remote attackers to delete arbitrary files via a .. (dot dot) in a filename.
CVE-2014-9373
Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. (dot dot) in the filename.
Sony: Employee Health Information May Have Been Compromised
Sony Pictures Entertainment has sent a letter to employees warning them that, along with huge amounts of corporate and employee information, some personal health data belonging to SPE employees may also have been compromised in the attack that hit the company in late November. The letter, which also was sent to the California Office of […]
Senator: Backdoor For The Feds Is A Backdoor For Hackers
The FBI Used Metasploit To Unmask Tor Users
Snowden Spying Leaks Prompt Millions To Protect Data
Delta Flaw Allows Theft Of Boarding Passes
A Guide to Facebook Privacy Basics
I’ve written a lot about over-sharing on social media. Why? Because it can be embarrassing, annoying and, in the worst case, dangerous to over-share our private information.
Often over-sharing happens unintentionally, because people haven’t adjusted their privacy settings. On Facebook for example, every time you post it’s possible to choose who can see it.
The issue is that people regularly overlook privacy options or just fail to understand why it is a good idea. Facebook has taken steps to change this with the introduction of “Privacy Basics”.
Available from January 1st, Facebook will provide interactive guides to answer commonly asked questions about how to control your personal information on the site. These guides, available in 36 languages, will allow users to learn more about untagging, unfriending, blocking and more.
Here’s what Privacy Basics can help you control on Facebook:
What others see about you – Control who can see your posts, profile and friends, how to remove comments, tags and accounts.
How others interact with you – What other people can post on your timeline, what people can do to things you post, how to block users and what to do if your account is hacked.
What you see – How to customize what you see in your newsfeed and from advertisers.
Erin Egan, Facebook’s Chief Privacy Officer, described it this way: ”Privacy Basics is the latest step we’ve taken to help you make sure you’re sharing with exactly who you want, including our privacy checkup, reminder for people posting publicly and simplified audience selectors.” You can read the announcement here.
Making Facebook settings simple, more intuitive, and explainable is great news, especially for new users.
Of course, it’s up to all of us to control our settings. Facebook is essentially handing you the keys. As the welcoming page for Privacy Basics says, “You’re in Charge.”
[Onapsis Security Advisory 2014-034] SAP Business Objects Search Token Privilege Escalation via CORBA
Posted by Onapsis Research Labs on Dec 16
Onapsis Security Advisory ONAPSIS-2014-034: SAP Business Objects Search
Token Privilege Escalation via CORBA
1. Impact on Business
=====================
By exploiting this vulnerability a remote and potentially
unauthenticated attacker would be able to access or modify any
information stored on the SAP BusineesObjects server.
The attacker could also connect to the business systems depending on the
configuration of the BO infrastructure.
Risk…