The Great DOM Fuzz-off of 2017

Posted by Ivan Fratric, Project Zero Introduction Historically, DOM engines have been one of the largest sources of web browser bugs. And while in the recent years the popularity of those kinds of bugs in targeted attacks has somewhat fallen in favor of Flash which allows for cross-browser exploi...

Cb Defense Praised in Independent Tests, Product Reviews

Earlier this week, Carbon Black announced the Q3 release of Cb Defense, which features breakthrough streaming ransomware prevention as well as live response capability. Following this announcement, three independent security organizations published reviews and reports confirming the efficacy of C...

Lessons Learned from the Equifax Disaster

143 million U.S. consumers, Equifax.com users who may have been affected by the the worst data breach in history are receiving all sorts of advice including a free TrustedID product license from Equifax. But despite numerous public reports about the incident, there are still many important...

Etherpad Directory Traversal Vulnerability

Etherpad is the Etherpad Foundation's open source rich-text online collaboration software . frontend tests is one of the front-end test component . A directory traversal vulnerability exists in the node/hooks/express/tests.js file in versions of Etherpad frontend tests prior to 1.6.1. An attacker...

Directory traversal

Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1...

CVE-2015-4085

Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1...

CVE-2015-4085

CVE-2015-4085 is a directory traversal vulnerability in Etherpad frontend tests (node/hooks/express/tests.js) affecting Etherpad frontend tests prior to version 1.6.1. Exploitation could allow an attacker to browse files, impacting confidentiality (Partial). The issue is documented across multipl...

CVE-2015-4085: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1...

Updated dbus packages fix security vulnerabilities

A format string vulnerability in the reference bus implementation, dbus-daemon, could potentially allow local users to cause arbitrary code execution or denial of service. Symlink attack in nonce-tcp transport bsc1025950. Symlink attack in unit tests bsc1025951...

Portia - Automate Techniques Commonly Performed On Internal Network Penetration Tests

Portia aims to automate a number of techniques commonly performed on internal network penetration tests after a low privileged account has been compromised: Privilege escalation Lateral movement Convenience modules Portia is a genus of jumping spider that feeds on other spiders - known for their...

Fedora 26 : community-mysql (2017-ee93493bea)

Update to version 5.7.19 Replication tests in the testsuite enabled, they don't fail anymore Resolves: 1462688; /run 1406172; random failures of the testsuite 1417880, 1417883, 1417885, 1417887, 1417890, 1417891, 1417893, 1417894, 1417896; replication tests CVE fixes: 1472716 CVE-2017-3633,...

Fedora 25 : community-mysql (2017-7c039552fa)

Update to version 5.7.19 Replication tests in the testsuite enabled, they don't fail anymore Resolves: 1462688; /run 1406172; random failures of the testsuite 1417880, 1417883, 1417885, 1417887, 1417890, 1417891, 1417893, 1417894, 1417896; replication tests CVE fixes: 1472716 CVE-2017-3633,...

North Korea Hit By Konni and Inexsmar Malware After Missile Tests

By Uzair Amir An unknown hacking group has been targeting organizations in North This is a post from HackRead.com Read the original post: North Korea Hit By Konni and Inexsmar Malware After Missile Tests...

Oracle Linux 7 : tcpdump (ELSA-2017-1871)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-1871 advisory. 14:4.9.0-5 - Resolves: 1441597; use bigger capture buffer than in upstream 14:4.9.0-4 - Drop downstream patch drop root privileges - Add libcap-ng as a...

Automated Privilege Escalation: portia

Portia aims to automate a number of techniques commonly performed on internal network penetration tests after a low privileged account has been compromised Privilege escalation Lateral movement Convenience modules Portia is a genus of jumping spider that feeds on other spiders – known for their...

Fedora 26 : 3:mariadb (2017-09dd8907da)

Rebase to 10.1.24 Plugin oqgraph enabled Plugin jemalloc enabled Sphinx engine enabled Build dependecies Bison and Libarchive added, others corrected Disabling Mroonga engine for i686 architecture, as it is not supported by MariaDB Removed patches: fixed by upstream Patch5:...

Command injection

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SMTP configuration tests...

CVE-2017-2845

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SMTP configuration tests...

audiocheck.net XSS vulnerability

Vulnerable URL: http://www.audiocheck.net/blindtestspitch.php?cent=1"...

PT-2017-15577

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD Camera version 2.52.2.37 Description An exploitable command injection issue exists in the web management interface. A specially crafted HTTP request can allow a user to inject arbitrary shell characters during the SMTP...