CVE-2017-14172

In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage due to lack of an EOF End of File check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length"...

PT-2017-4194

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.1, 15.2, and 15.4 Cisco IOS XE versions 3.14 through 3.18 Description A vulnerability in the UDP processing code could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP...

PT-2018-3767

Name of the Vulnerable Software and Affected Versions Debian shadow package versions prior to 1:4.5-1 Description The issue is related to the incorrect listing of pts/0 and pts/1 as physical terminals in /etc/securetty, which allows local users to login as password-less users even if they are...

CVE-2017-14108

libgedit.a in GNOME gedit through 3.22.1 allows remote attackers to cause a denial of service CPU consumption via a file that begins with many '\0' characters...

NEC EXPRESS CLUSTER clpwebmc Remote Root Exploit

NEC EXPRESS CLUSTER comes with Cluster Manager, a Java applet for cluster configuration and management. The underlying webserver 'clpwebmc' runs as root and accepts connections on TCP port 29003 which can be initiated without authentication in the default installation. / 2017 update: as of 3.3.4...

Debian DLA-1085-1 : libidn2-0 security update

It was discovered that there was an integer overflow vulnerability in libidn2-0's Punycode handling an encoding used to convert Unicode characters to ASCII which would have allowed attackers to cause a remote denial of service. For Debian 7 'Wheezy', this issue has been fixed in libidn2-0 version...

[SECURITY] [DLA 1085-1] libidn2-0 security update

Package : libidn2-0 Version : 0.8-2+deb7u1 CVE ID : CVE-2017-14062 Debian Bug : 873902 It was discovered that there was an integer overflow vulnerability in libidn2-0s Punycode handling an encoding used to convert Unicode characters to ASCII which would have allowed attackers to cause a remote...

DLA-1085-1 libidn2-0 - security update

Bulletin has no description...

Debian DSA-3955-1 : mariadb-10.1 - security update

Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.1.26. Please see the MariaDB 10.1 Release Notes for further details : - https://mariadb.com/kb/en/mariadb/mariadb-10124-release- notes/ -...

Abusing BITS: BITSInject

Windows’ BITS service is a middleman for your download jobs. You start a BITS job, and from that point on, BITS is responsible for the download. But what if we tell you that BITS is a careless middleman? We have uncovered the way BITS maintains its jobs queue using a state file on disk, and found...

DIGISOL DG-BG1100N ROM-0 Backup File Disclosure

Exploit Title : ROM-0 Backup File Disclosure on DIGISOL Date : 24-08-2017 Exploit Author : Sudin nk Vendor Homepage: http://www.digisol.com Tested Routers : DG-BG1100N ADSL 2/2+ Modem Wifi Router Tested on : Parrotsec x8664 ROM-0 Backup File Disclosure on DIGISOL A dangerous vulnerability present...

[SECURITY] [DLA 1063-1] extplorer security update

Package : extplorer Version : 2.1.0b6+dfsg.3-4+deb7u5 CVE ID : CVE-2017-12756 CVE-2017-12756 Fix command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile0 parameter. For Debian 7 "Wheezy", these problems have been fixed in...

PT-2017-19173

Name of the Vulnerable Software and Affected Versions Quali CloudShell versions prior to 8 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via several parameters,...

Researchers Find Phishing Site Encrypted with AES

Scammers chasing Apple credentials and payment card information have ramped up their efforts to hide their phishing page by encrypting it with AES. Researchers at Ring 0 Labs disclosed details about the operation last week, pointing out that the criminals behind this activity are buffering a fair...

Debian DLA-1051-1 : postgresql-9.1 security update

Several vulnerabilities have been found in the PostgreSQL database system : CVE-2017-7486 Andrew Wheelwright discovered that user mappings were insufficiently restricted. CVE-2017-7546 In some authentication methods empty passwords were accepted. CVE-2017-7547 User mappings could leak data to...

CVE-2017-12756: Improper Neutralization of Special Elements used in a Command

Command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile0 parameter...

PT-2017-12679

Name of the Vulnerable Software and Affected Versions extplorer versions 2.1.9 and prior Description The issue allows an attacker to inject commands via the userfile0 parameter when transferring from another server. This can be exploited by sending malicious input to the vulnerable parameter...

UBUNTU-CVE-2017-11525

The ReadCINImage function in coders/cin.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service memory consumption via a crafted file...

Mail.ru: uninitilized server memory disclosure via ImageMagick in my.mail.ru and cloud.mail.ru

0-day Image Magic application / library vulnerability led to process's uninitialized memory region disclosure via converted image file. Region's address was not directly controlled by attacker. Vulnerability was reported for 2 projects: cloud.mail.ru is in bug bounty scope, but, as a mitigation...

CVE-2017-11478

The ReadOneDJVUImage function in coders/djvu.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a malformed DJVU image...