Strength and Weakness of Methods to Confirm SSH Host Key

2014-09-22 Thread John Leo
Monkeysphere (advice from maxigas) "verify your SSH key through the OpenPGP web of trust" Strength: OpenPGP is cool if you REALLY know how to use it. Weakness: "vote counting scheme" does not sound too cool. "use of an organization's own HTTPS site" (advice from Stephanie Daugherty) In my persona

TP-LINK WDR4300 - Stored XSS & DoS

2014-09-22 Thread ozelisyan
Advisory Information === Vendors Contacted: TP-LINK Vendor Patched: Yes, Firmware 140916 System Affected: N750 Wireless Dual Band Gigabit Router (TL-WDR4300), might affect others. Versions Affected: 130617 , possibly earlier CVE Numbers Assigned: CVE-2014-4727, CVE-2014-4728 Vulner

[SECURITY] [DSA 3030-1] mantis security update

2014-09-22 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-3030-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff September 20, 2014

CVE-2014-5516 CSRF protection bypass in "KonaKart" Java eCommerce product

2014-09-22 Thread Christian Schneider
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2014-5516 === "Cross-Site Request Forgery (CSRF) protection bypass" (CWE-352) vulnerability in "KonaKart Storefront Application" Enterprise Java eCommerce product Vendor === DS Data Systems (UK) Ltd. Product ==

[SECURITY] [DSA 3029-1] nginx security update

2014-09-22 Thread Salvatore Bonaccorso
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3029-1 secur...@debian.org http://www.debian.org/security/ Salvatore Bonaccorso September 20, 2014