Attack inception: Compromised supply chain within a supply chain poses new risks

A new software supply chain attack unearthed by Windows Defender Advanced Threat Protection Windows Defender ATP emerged as an unusual multi-tier case. Unknown attackers compromised the shared infrastructure in place between the vendor of a PDF editor application and one of its software vendor...

MyEtherWallet: Development configuration file https://myetherwallet.com/

Vulnerability description A configuration file e.g. Vagrantfile, Gemfile, Rakefile, ... was found in this directory. This file may expose sensitive information that could help a malicious user to prepare more advanced attacks. It's recommended to remove or restrict access to this type of files fr...

atl-autotechnik.de XSS vulnerability

Open Bug Bounty ID: OBB-653924 Description| Value ---|--- Affected Website:| atl-autotechnik.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

FFmpeg ASF_F format demuxer array out-of-bounds read vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team.ASFF format demuxer is one of the video and audio splitters. An out-of-bounds read vulnerability exists in the ASFF format demuxer array in versions prior to FFmpeg commit...

DEBIAN-CVE-2018-1999015

FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASFF format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially crafted ASF file that has to provided as input. This vulnerability appears to...

UBUNTU-CVE-2018-1999011

FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asfo format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be...

The vulnerability of the AMD component in the Mac OS X operating system allows a hacker to trigger a service failure.

The vulnerability of the AMD component in the Mac OS X operating system is related to the operation of reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created application...

CVE-2018-0380

Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format ARF and Webex Recording Format WRF files. An attacker could exploit these vulnerabilities by providing a user with a malicious .arf or .wrf file via email or URL and convincing the user to...

CVE-2018-0379

Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format ARF and Webex Recording Format WRF files. An attacker could exploit these vulnerabilities by providing a user with a malicious .arf or .wrf file via email or URL and convincing the user to...

shop.xion.de XSS vulnerability

Open Bug Bounty ID: OBB-648763 Description| Value ---|--- Affected Website:| shop.xion.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2016-9494

Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input validation. The device's advanced status web page that is linked to from the basic status web page does not appear to properly parse malformed GET requests. This may...

[SECURITY] Fedora 28 Update: xapian-core-1.4.6-1.fc28

Xapian is an Open Source Probabilistic Information Retrieval Library. It offers a highly adaptable toolkit that allows developers to easily add adva nced indexing and search facilities to applications...

[SECURITY] Fedora 27 Update: xapian-bindings-1.4.6-1.fc27

Xapian is an Open Source Probabilistic Information Retrieval Library. It offers a highly adaptable toolkit that allows developers to easily add adva nced indexing and search facilities to applications. This package provides the files needed for scripts which use Xapian...

P = NP: Cloud data protection in vulnerable non-production environments

Data is the holy grail of your cloud workloads for attackers. Data breaches are the kind of breaches that make the news. With the recent European Union General Data Protection Regulations GDPR, they will make even bigger headlines. From an enterprise point of view, the most challenging aspect of...

rastawinkel.nl XSS vulnerability

Open Bug Bounty ID: OBB-644580 Description| Value ---|--- Affected Website:| rastawinkel.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

de.sydney.com XSS vulnerability

Open Bug Bounty ID: OBB-644403 Description| Value ---|--- Affected Website:| de.sydney.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

inktrunner.nl XSS vulnerability

Open Bug Bounty ID: OBB-642398 Description| Value ---|--- Affected Website:| inktrunner.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

desportvisserdenhaag.nl XSS vulnerability

Open Bug Bounty ID: OBB-642396 Description| Value ---|--- Affected Website:| desportvisserdenhaag.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

bambinobabygiftshop.nl XSS vulnerability

Open Bug Bounty ID: OBB-642377 Description| Value ---|--- Affected Website:| bambinobabygiftshop.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

USN-3690-2 amd64-microcode regression

USN-3690-1 provided updated microcode for AMD processors to address CVE-2017-5715 aka Spectre. Unfortunately, the update caused some systems to fail to boot. This update reverts the update for Ubuntu 14.04 LTS. We apologize for the inconvenience. Original advisory details: Jann Horn discovered th...