iKAT 2012 - Interactive Kiosk Attack Tool
Beating Heart Edition
-
It is with great pleasure that i would like to release this years
edition of iKAT - The Interactive Kiosk Attack Tool.
http://ikat.ha.cked.net
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
- -
Debian Security Advisory DSA-2526-1 secur...@debian.org
http://www.debian.org/security/Nico Golde
August 12, 2012
Title:
==
7sepehr CMS 2012 - Multiple SQL Injection Vulnerabilities
Date:
=
2012-08-12
References:
===
http://www.vulnerability-lab.com/get_content.php?id=679
VL-ID:
=
680
Common Vulnerability Scoring System:
8.3
Abstract:
So I know FD isn't Craigslist but I figured its my best bet. I am looking
for a KSD-64 Crypto Ignition Key (CIK) as well as a Fortezza card. If you
know where I can get either, please contact me. Note that
http://www.psism.com lists Fortezza cards on their website but they don't
sell them
Often times trends dominate and suffocate a population. We naturally learn
by following. But occasionally in order to keep things interesting we gotta
mix it up.
We've seen DLL injections, we've seen them carefully placed in WebDAVs,
bundled in ZIPs(ugh), fixit'd, and flooding advisory lists of
NeoInvoice is a multi-tenant open source invoicing system, that
currently contains an unauthenticated blind SQL injection condition in
signup_check.php. The input for the value field isn't being properly
sanitized, and is used in string concatenation to create the SQL
query.
See here for the
Hello,
on Android, everyone who wants to give apps root access to his phone uses the
Superuser application by ChainsDD. However, from a security perspective, that
might be a somewhat bad idea.
First, it's not really Open Source anymore, so you can't easily check whether
everything works the way
but with bowling 4 crypto as email, natural and logical 2 assume u
plan big crypto massacre, how many innocent bits will we lose this
time?
On Sat, Aug 11, 2012 at 8:07 PM, Hambone Turkey
bowling4cry...@gmail.com wrote:
So I know FD isn't Craigslist but I figured its my best bet. I am looking
CALL FOR PAPERS/EVENTS
IDEATE, INVENT, INNOVATE
++
Hello! Aloha! Namaskar! Ni Hau! Guten Tag! Privet! Salam-wale-kum! Hej!
Ahoj! Bonjour! Terve! Ciao! Konnichiva! Selamat! Barev! Jum Reap Sour!
Selamat! ahnnyeong ha se yo! Salvete! Moien! Selamat datang! Bonswa! sain
baina uu!
On Sun, Aug 12, 2012 at 09:47:57PM +0200, Jann Horn wrote:
And finally, I've found another vuln that essentially lets apps gain root
rights without asking the user, and I will release all details about it in
two weeks.
Found another independent vuln that also gives all apps root access,
Ok.
On Mon, Aug 13, 2012 at 2:28 PM, Jann Horn jannh...@googlemail.com wrote:
On Sun, Aug 12, 2012 at 09:47:57PM +0200, Jann Horn wrote:
And finally, I've found another vuln that essentially lets apps gain root
rights without asking the user, and I will release all details about it in
two
On Mon, Aug 13, 2012 at 5:41 PM, Richard Miles
richard.k.mi...@googlemail.com wrote:
- Calls a file with a suid file without full path?
No.
- Allows to create a symbolic link inside
/Applications/Viscosity.app/Contents/Resources/ with the name of
ViscosityHelper?
No.
BTW, this file
Sent from whatever device will keep us from debating which one is better.
You're seriously using that thing? I've found it's restricted [vendor term
for application library] is a huge detriment to an already ailing product.
You should probably just switch to the more popular Whichever
On Mon, Aug 13, 2012 at 6:02 PM, Richard Miles
richard.k.mi...@googlemail.com wrote:
Thanks for fast reply. I'm still unsure if I understood properly.
Please reply on list.
Yes, it does exist. When you run Viscosity for the first time, it makes
that file SUID.
So, you only have one chance
Hell yeah I am. It's the only thing I could find that would sync up to that
other thing, unless you buy the thing that plugs into the other thing!
On Aug 13, 2012, at 9:00 AM, Lincoln Anderson wrote:
Sent from whatever device will keep us from debating which one is better.
You're
What, you just Google for that?? You've clearly not tried that fix or you'd
know how hard it is to solder that thing. Well, unless you've got really
expensive equipment. And what do you do if you are out and it breaks? I'll
stick with mine, thank you!!
t
On Aug 13, 2012, at 9:39 AM,
I'm right, everybody else is wrong, the manufacturers of that thing are just
pandering to shareholders. I'm going to go complain on my blog and I don't
care if they don't read it.
From: full-disclosure-boun...@lists.grok.org.uk
[mailto:full-disclosure-boun...@lists.grok.org.uk] On Behalf Of
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
___
Mandriva Linux Security Advisory MDVSA-2012:131
http://www.mandriva.com/security/
Well, what can I say - your write up is accurate.
Though last time I've seen it, around 5 years ago, it was still called
DLL spoofing and not DLL hijacking, and was one of the arguments why
carpet bombing (automatic download) in Safair/Chrome must be fixed
:)
E.g.
Ah, well that's the problem then. At lion they dropped all support for
Rosetta. But there you have it! Mine is *better*. Now we don't have to
debate... Wait. Crap!
Sent from whatever device will keep us from debating which one is better.
On Aug 13, 2012, at 9:55 AM, Stefan Edwards
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
- -
Debian Security Advisory DSA-2527-1 secur...@debian.org
http://www.debian.org/security/Moritz Muehlenhoff
August 13, 2012
On Sat, 11 Aug 2012 12:07:34 -0700, Hambone Turkey said:
sell them anymore. FWIW I am a US citizen...so no, I'm not a spy :P
So said Aldrich Ames, Andrew Daulton Lee, Christopher Boyce, Robert Hanssen,
and John Anthony Walker.
pgpJ8grgJYjA3.pgp
Description: PGP signature
I've got two concerns about this:
1. Either way you put it, I can't see how one can make a convincing
argument out of downloading a DLL file.
Asking laymen, they'd ask what's a dll for? weren't updates done with
exe/msi/etc? why's it got that funny icon?
2. I'm a bit curious about your choice
1. The attack is aiming at a very low hanging fruit, so low in fact it
probably fell on the ground once and has a few bugs on it, this is the
nature of phishing. If the redirect is well designed or the method of the
delivery is convincing enough, they will click save assuming that only
execution
/---\
| TCExam Edit SQL Injection |
\---/
Summary
===
TCExam 11.3.007 is prone to a SQL injection flaw located in
tce_edit_answer.php and tce_edit_question.php. These files pass a
'subject_module_id' parameter into a SQL statement
/--\
| Group-Office Cleartext Credentials Stored in Cookies |
\--/
Summary
===
Group-Office 4.0.71 was found to display a behaviour that could potentially
expose a user's username and
/--\
| TCExam Edit Cross-Site Scripting |
\--/
Summary
===
TCExam 11.3.007 is subject to a cross-site scripting vulnerability. A
'question_subject_id' parameter is not sufficiently sanitised before being
written to the
/--\
| Total Shop UK eCommerce Generic Cross-Site Scripting |
\--/
Summary
===
The open source version of Total Shop UK eCommerce based on CodeIgniter
version 2.1.2 is subject to a
That is totally untrue. There is a partially-working and unmaintained
project on github that totally allows you to skip the plug, if you're
willing to just put in a bit of time to setup the entire suite of tools
necessary to run this one project.
On Mon, Aug 13, 2012 at 12:35 PM, Thor
No way did I just google for that; I'm actually working on a rewrite in
ObscureLNG/S, and I've been following the progress of the original project
closely. Besides, it's not as if that plug is supported anyway; it was
written with OS X 10.1 support, and is broken on later versions. The
windows
Hello Readers,
ClubHack Magazine's Issue 31 - August 2012 is here.
This issue covers following articles:-
0x00 Tech Gyan - Malware Memory Forensics
0x01 Tool Gyan - Tamper Data
0x02 Mom's Guide - Apple iOS vulnerabilities
0x03 Legal Gyan - VARIOUS AUTHORITIES UNDER THE IT ACT
0x04 Matriux
31 matches
Mail list logo
