The cryptographic algorithm called INCrypt32 is a MAC algorithm to authenticate participants, RFID cards and readers, in HID Global's iCLASS systems. HID's iCLASS cards are widely used contactless smart cards for physical access control. Although INCrypt32 is a heart of the security of HID's iCLASS systems, its security has not been evaluated yet since the specification has not been open to public. In this paper, they reveal the specification of INCrypt32 by reverse engineering an iCLASS card and investigate the security of INCrypt32. As a result, we show that the secret key of size 64 bits can be recovered using only 218 MAC queries if the attacker can request MAC for chosen messages of arbitrary length. If the length of messages is limited to pre-determined values by the authentication protocol, the required number of MAC queries grows to 242 to recover the secret key.

BASE version 1.4.5 suffers from a remote SQL injection vulnerability.

XRayCMS version 1.1.1 suffers from a remote SQL injection vulnerability.

Conduit Wibiya suffers from an open redirection vulnerability.

This whitepaper goes into detail on how to use egg hunting shellcode in order to exploit a BisonWare FTP server.

LibGuides suffers from a cross site scripting vulnerability.

Brainkeeper Enterprise Wiki suffers from a cross site scripting vulnerability.

Red Hat Security Advisory 2012-0101-01 - Red Hat Network Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and remote management of multiple Linux deployments with a single, centralized tool. If a user submitted a system registration XML-RPC call to an RHN Satellite server and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.

Red Hat Security Advisory 2012-0100-01 - Multiple format string flaws were found in Condor. An authenticated Condor service user could use these flaws to prevent other jobs from being scheduled and executed, crash the condor_schedd daemon, or, possibly, execute arbitrary code with the privileges of the "condor" user.

Red Hat Security Advisory 2012-0099-01 - Multiple format string flaws were found in Condor. An authenticated Condor service user could use these flaws to prevent other jobs from being scheduled and executed or crash the condor_schedd daemon.

Red Hat Security Advisory 2012-0102-01 - Red Hat Network Proxy provides a mechanism for caching content, such as package updates from Red Hat or custom content created for an organization on an internal, centrally-located server. If a user submitted a system registration XML-RPC call to an RHN Proxy server and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.

Debian Linux Security Advisory 2405-1 - Several vulnerabilities have been found in the Apache HTTPD Server.

Debian Linux Security Advisory 2404-1 - Nicolae Mogoraenu discovered a heap overflow in the emulated e1000e network interface card of QEMU, which is used in the xen-qemu-dm-4.0 packages. This vulnerability might enable to malicious guest systems to crash the host system or escalate their privileges.

NexorONE Online Banking suffers from multiple cross site scripting vulnerabilities.

Facebook Game Store suffers from a remote SQL injection vulnerability.

The LibAnswers Springshare Library suffers from a cross site scripting vulnerability.

Tube Ace, the adult PHP tube script, suffers from a remote SQL injection vulnerability.

Snort Report versions 1.3.2 and below suffer from a local file inclusion vulnerability.

The help website for Electronic Arts suffers from a cross site scripting vulnerability.

Advantech/Broadwin HMI/SCADA WebAccess 6.x.x/7.x.x universal network RPC exploit that creates an executable file and launches the process on the affected system. webaccess.universal.exploit.rar@z%uxp!@#uzstxy! is the password for the archive.

LibAnalytics Springshare suffers from a cross site scripting vulnerability.

Microsoft Internet Explorer 8 suffers from a denial of service vulnerability due to a stack exhaustion issue.

DAPH CMS suffers from a remote shell upload vulnerability.

ScholarGuides Springshare suffers from a cross site scripting vulnerability.