GNS3 Mac OS-X 1.5.2 - ubridge Local Privilege Escalation

GNS3 Mac OS-X 1.5.2 - ubridge Local Privilege Escalation !/bin/sh GNS-3 Mac OS-X LPE local root exploit ===================================== GNS-3 on OS-X bundles the "ubridge" binary as a setuid root file. This file can be used to read arbitary files using "-f" arguement but also as it runs as...

Security update 2017-04-11

...

Description of the security update for 2007 Microsoft Office Suite: April 11, 2017

None None...

Blue coat SSL Visibility Denial of Service Vulnerability

Blue Coat SSL Visibility is an SSL traffic visibility appliance from Blue Coat Systems, Inc. that supports the addition of SSL inspection capabilities to advanced threat protection solutions and existing network security architectures. A denial of service vulnerability exists in version 3.x prior...

Edit and Replay Network Traffic: tcpreplay

Edit and Replay Network Traffic Tcpreplay is a suite of GPLv3 licensed utilities for UNIX and Win32 under Cygwin operating systems for editing and replaying network traffic which was previously captured by tools like tcpdump and Ethereal / Wireshark . It allows you to classify traffic as client o...

FreeBSD : id Tech 3 -- remote code execution vulnerability (e48355d7-1548-11e7-8611-0090f5f2f347)

The content auto-download of id Tech 3 can be used to deliver maliciously crafted content, that triggers downloading of further content and loading and executing it as native code with user credentials. This affects ioquake3, ioUrbanTerror, OpenArena, the original Quake 3 Arena and other forks...

guestzone.nl Open Redirect vulnerability

Vulnerable URL: http://www.guestzone.nl/gfx/banners/banner20151014151256.swf?clickTag=http://openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 222755 VIP...

CVE-2017-2675

Little Snitch 3.0–3.7.3 contains a local privilege escalation in the installer related to writing the configuration file at.obdev.littlesnitchd.plist to /Library/LaunchDaemons. The CVSSv3 context indicates LOCAL attack with HIGH impact to confidentiality, integrity, and availability, and LOW priv...

Null pointer dereference

The msmipcrouterclose function in net/ipcrouter/ipcroutersocket.c in the ipcrouter component for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allow attackers to cause a denial of service NULL pointer dereference or...

CVE-2016-5870

The msmipcrouterclose function in net/ipcrouter/ipcroutersocket.c in the ipcrouter component for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allow attackers to cause a denial of service NULL pointer dereference or...

Fedora 24 : pcs (2017-7accc8010b)

Security fix for CVE-2017-2661: Improper node name field validation when creating clusters leads to XSS - Re-added support for clufter as it is now available for Python 3 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Threat Outbreak Alert RuleID28590: Email Messages Distributing Malicious Software on April 3, 2017

Medium Alert ID: 53309 First Published: 2017 April 3 19:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28590 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID28596: Email Messages Distributing Malicious Software on April 3, 2017

Medium Alert ID: 53306 First Published: 2017 April 3 15:26 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28596 may contain the following files: Name | Siz...

[SECURITY] Fedora 24 Update: webkitgtk4-2.16.0-1.fc24

WebKitGTK+ is the port of the portable web rendering engine WebKit to the GTK+ platform. This package contains WebKitGTK+ for GTK+ 3...

World Backup Day is as good as any to back up your data

In today’s security landscape, there are more threats to data than ever before. Beyond corruption caused by hardware or human failure, malware and cyberattacks can put data in serious danger. That’s why it’s imperative for enterprises, small-and-medium businesses, and individuals to back up data...

SolarWinds Log and Event Manager (LEM) < 6.3.1 Hotfix 3 SSH Jailbreak and Privilege Escalation Vulnerabilities

SolarWinds Log and Event Manager LEM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Visual Studio 2015 update 3 - Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: Microsoft Visual Studio 2015 update 3 – Stack overflow Date: 2017-03-26 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link:...

Product update: Virtuozzo 7.0 Update 3 Hotfix 3 (7.0.3-641)

The new packages for Virtuozzo 7.0.3 introducing usability fixes and compatibility with Packet. Vulnerability id: PSBM-62644 Route of container with a host-routed interface was not cleared on source host after migration. Vulnerability id: PSBM-59017 Allowed access to '/dev/kmsg' inside containers...

OnePlus 3/3T open up an ADB session without authorization (CVE-2017-5622)

Last month we published CVE-2017-5626 patched in OxygenOS 4.0.2, a vulnerability which allowed attackers to effectively unlock a OnePlus 3/3T device without a factory reset. Combining this with our also discovered CVE-2017-5624 patched in OxygenOS 4.0.3 enabled a powerful attack against locked...

CVE-2017-5622

With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other...