The vulnerability of the QEMU hardware emulation software, which allows a hacker to trigger a service failure

The vulnerability of the virglresourceattachbacking function in the QEMU hardware/display/virtio-gpu-3d.c emulator is related to a memory leak. Exploiting this vulnerability can allow an attacker, operating locally, to cause a service failure memory consumption by using a large number of speciall...

wireshark: X11 memory leak (wnpa-sec-2015-15)

A flaw was found in X11 dissector of wireshark of which an attacker could make wireshark consume excessive CPU resources which could make system unresponsive by injecting specially crafted packet onto the wire or by convincing wireshark user to read malformed packet trace file...

DEBIAN-CVE-2017-5985

lxc-user-nic in Linux Containers LXC allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those interfaces by leveraging lack of netns ownership check...

Designed to pit people up! The outlaws are a large number of the abuse of Apple's iOS enterprise certificate-vulnerability warning-the black bar safety net

Not molecule by abuse or the purchase of the corporate certificate packing illegal Apps through itms:services://?, the Online install ipa ,across the Appstore in the form, spread a large number of jurisprudence involved in gambling applications, designed to pit the Chinese people! Include...

tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests

It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP...

OpenJDK: imageio PNGImageReader failed to honor ignoreMetadata for iTXt and zTXt chunks (2D, 8166988)

It was discovered that the 2D component of OpenJDK performed parsing of iTXt and zTXt PNG image chunks even when configured to ignore metadata. An attacker able to make a Java application parse a specially crafted PNG image could cause the application to consume an excessive amount of memory...

LocalTapiola: High server resource usage on captcha (viestinta.lahitapiola.fi)

Basic report information Summary: It is possible to generate a simple request which creates a high cpu/bandwidth consumption from the server by abusing the captcha servlet Description: By sending a specially crafted request and changing the height/width parameters in the captcha form it is possib...

DEBIAN-CVE-2017-5595

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...

Many Android VPN Apps Breaking Privacy Promises

An alarming number of Android VPNs are providing a decidedly false sense of security to users, especially those living in areas where communication is censored or technology is crucial to the privacy and physical security. A study published recently identified a number of shortcomings common to...

The vulnerability of the QEMU hardware emulation software, which allows a hacker to trigger a service failure

The vulnerability of the v9fsdeviceunrealizecommon function hw/9pfs/9p.c in the QEMU hardware emulation software is related to a memory leak. Exploiting this vulnerability allows an attacker, who operates locally and is also a user of the guest operating system, to cause a service failure such as...

GNU Screen 4.5.0 - Local Privilege Escalation

!/bin/bash screenroot.sh setuid screen v4.5.0 local root exploit abuses ld.so.preload overwriting to get root. bug: https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.html HACK THE PLANET infodox 25/1/2017 echo " gnu/screenroot " echo "+ First, we create our shell and library..." ca...

USN-3161-1 linux vulnerabilities

Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the Linux kernel. A local attacker could use this to expose sensitive information kernel memory. CVE-2015-8964 It was discovered that the Video For Linux Two v4l2 implementation in the Linux kernel d...

Pornhub: Account takeover via Pornhub Oauth

The researcher found it was possible to take over a YouPorn account by using an unverified account with matching email address to sign up to PornHub. this vulnerability works by abusing an insecure OAuth implementation. Due to improperly implemented oauth fuctionality and lack of user information...

CVE-2016-4046

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response typ...

Information disclosure

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response typ...

CVE-2016-4046

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response typ...

CVE-2016-4046

Open-Xchange OX App Suite (before 7.8.1-rev11) is affected by CVE-2016-4046. The API used to configure external mail accounts can be abused to map and access network components within the operator’s trust boundary; attackers can inject arbitrary hosts and ports into API calls, enabling informatio...

CVE-2016-9755

An attacker on a network could abuse a flaw in the IPv6 stack fragment reassembly code to induce kernel memory corruption on the system, possibly leading to a system crash...

ipsilon: DoS via logging out all open SAML2 sessions

A vulnerability was found in ipsilon in the SAML2 provider's handling of sessions. An attacker able to hit the logout URL could determine what service providers other users are logged in to and terminate their sessions...

git-fastclone Arbitrary Command Execution Vulnerability

git-fastclone is a set of tools for cloning git. An arbitrary command execution vulnerability exists in git-fastclone versions prior to 1.0.1, which stems from a program executing arbitrary shell commands from .gitmodules. The vulnerability can be exploited to execute arbitrary shell commands by...