[SECURITY] Fedora 26 Update: dnsdist-1.2.0-1.fc26

dnsdist is a highly DNS-, DoS- and abuse-aware loadbalancer. Its goal in li fe is to route traffic to the best server, delivering top performance to legitimate users while shunting or blocking abusive traffic...

Twitter Bots Use Likes, RTs for Intimidation

I awoke this morning to find my account on Twitter @briankrebs had attracted almost 12,000 new followers overnight. Then I noticed I'd gained almost as many followers as the number of re-tweets RTs earned for a tweet I published on Tuesday. The tweet stated how every time I tweet something relate...

BSA-2017-358

Security Advisory ID : BSA-2017-358 Component : Offset2lib Patch Protection Bypass Revision : 2.0: Interim The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to beexecve'edwith 1GB of arguments or environmental strings then the stack occupies the...

PYSEC-2017-11

Cross-site request forgery CSRF vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified vectors...

Mercurial: pathaudit: path traversal via symlink

A vulnerability was found in the way Mercurial handles path auditing and caches the results. An attacker could abuse a repository with a series of commits mixing symlinks and regular files/directories to trick Mercurial into writing outside of a given repository...

Many Factors Conspire in ICS/SCADA Attacks

Critical infrastructure operators can’t be blamed for a perpetual case of whiplash. They are mired between hackers targeting internet-facing and air-gapped systems with equal precision, and vendors and management unwilling to properly tackle security for fear of downtime and incompatibility. “The...

Dealing with cybersquatting, typosquatting and phishing

It won't be a secret to say that phishing remains one of the most effective attack vectors. For example, your colleague receives by email a malicious web link that looks like a link to your corporate portal and opens it. If your Vulnerability and Patch Management programs are not good enough see...

Brave Software: URL Spoof / Brave Shield Bypass

Summary: Improper URL parsing in Brave allows an attacker to spoof the hostname shield settings are applied to. POC: https://youtu.be/yz99TTrfuc Products affected: Brave browser-laptop 0.18.14 rev ad92d02 Steps To Reproduce: 1. Browse to http://brave.com 2. Click on the Shield icon and toggle the...

New Bill Seeks Basic IoT Security Standards

Lawmakers in the U.S. Senate today introduced a bill that would set baseline security standards for the government's purchase and use of a broad range of Internet-connected devices, including computers, routers and security cameras. The legislation, which also seeks to remedy some widely-perceive...

Code injection

There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php...

CVE-2017-11718

There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php...

CVE-2017-11718

There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php...

CVE-2017-11718

MetInfo CMS versions up to 5.3.17 are affected by CVE-2017-11718 due to improper handling of the gourl parameter in member/login.php, enabling URL redirector abuse to external sites. The issue is described as a redirection vulnerability that can be exploited to direct users to phishing sites (per...

Code injection

dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php...

CVE-2017-11586

dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php...

CVE-2017-11586

dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php...

CVE-2017-11586

FineCMS 5.0.9 contains an open redirect vulnerability exploitable via the url parameter in a sync action, linked to controllers/Weixin.php. The NVD entry CVE-2017-11586 documents URL Redirector Abuse with CVSS 3.0 score 6.1 (NETWORK, PR:N, UI:R). Nuclei templates corroborate an open redirect cond...

CVE-2017-11586

dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php...

Free Certs Come With a Cost

Let’s Encrypt is the largest certificate authority by volume doling out more than 100,000 free domain certificates a day. The non-profit fulfills a noble mission of securing website communications that is applauded across the internet; it has raised the bar on SSL and TLS security, issuing 100...

Cuvva: CSRF on cuvva.insure allows to attacker to send multiple SMS to download the app without visiting the cuvva

Description : cuvva.co allows user to send app download link to his/her mobile number via SMS. But attacker can abuse this system via cross site request forgery and can send SMS to N number of mobile numbers without even visiting the cuvva.com/cuvva.insure website. Reproduction Steps :...