Debian DLA-1794-1 : libspring-security-2.0-java security update

A vulnerability was discovered in libspring-security-2.0-java, a modular Java/J2EE application security framework, when using SecureRandomFactoryBeansetSeed to configure a SecureRandom instance, resulting in insecure randomness. For Debian 8 'Jessie', this problem has been fixed in version...

CVE-2019-4072

IBM Tivoli Storage Productivity Center IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17 allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time,...

Vulnerabilities in financial mobile apps put consumers and businesses at risk

Security hubris. It’s the phrase we use to refer to our feeling of confidence grounded on assumptions we all have but may not be aware of or care to admit about cybersecurity—and, at times, privacy. It rears its ugly head when 1 we share the common notion that programmers know how to code securel...

Buffer Overflow

libwmf is a library for reading and converting Windows Metafile Format WMF vector graphics. libwmf is used by applications such as GIMP and ImageMagick. It was discovered that libwmf did not correctly process certain WMF Windows Metafiles with embedded BMP images. By tricking a victim into openin...

Denial Of Service (DoS)

Libxml2 is vulnerable to denial of service DoS. The attack is possible because of heap-based buffer overflow in the way libxml2 handled documents that enable entity expansion. A remote attacker could provide a large, specially-crafted XML file that, when opened in an application linked against...

CVE-2015-9284

The request phase of the OmniAuth Ruby gem 1.9.1 and earlier is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able ...

Management Interface Exposed

github.com/heketi/heketi does not require authentication to its management interface. This allows a remote attacker to gain unauthenticated access to management functions and perform further attacks against the application...

CVE-2016-1584

CVE-2016-1584 concerns Unity8 on large-screen devices where a running but non-active application could communicate with Maliit and consume keyboard input. The connected sources confirm this is a vulnerability in the Unity8/converged application lifecycle, allowing background apps to interact with...

How to find Web App Yummy Days of the security vulnerabilities? - Vulnerability warning-the black bar safety net

As a financial Web application developer, I of the security issues have been of particular concern. In the past two years, I was involved in some Web application before entering the production mode before, will go through comprehensive and rigorous safety checks to ensure they are in fully...

Casino Goes All In and Wins Big with Imperva Security

There’s no good time to be hit by ransom-seeking DDoS attackers. For one casino-entertainment provider, the timing was particularly bad — right before one of its largest online poker events in 2016. The casino, which generates multiple billions in revenue per year, leveraged Imperva’s emergency...

Mail.ru: Reflected cross site scripting at https://auto.mail.ru/reviews/add_review/ via problems_text parameter.

Description https://auto.mail.ru is vulnerable for xss. It is possible for an attacker to inject arbitrary JavaScript in application response Step to reproduce 1. Open the below link in Firefox...

DefectDojo v1.5.4 - Application Vulnerability Correlation And Security Orchestration Application

DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, schedule scans, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one...

Zomato: [Zomato Order] Insecure deeplink leads to sensitive information disclosure

Hello, i want to report the vulnerability found, Since the following activity com.application.zomato.activities.DeepLinkRouter has exported="true" it can be exploited by another application. Application Information Application: Zomato Order - Food Delivery App Package Name:...

Default credentials

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change...

Making Our Security Portfolio Simpler — and Better

Since its inception in 2009, Incapsula has been a proud part of Imperva, the analyst-recognized cybersecurity leader. However, cybersecurity needs are evolving, and so are we. On April 7th, we will officially retire Incapsula.com. All of the great Incapsula web site content that wasn’t already...

About the security content of tvOS 11 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

CVE-2018-12679

The Serialize.deserialize method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications that use this library e.g., the standard CoAP server, CoAP client, example collect CoAP server and client when they receive crafted CoAP messages...

CVE-2019-5891

The CVE-2019-5891 issue affects OverIT Geocall 6.3 prior to build 2:346977. An unauthenticated servlet allows an attacker to obtain a cookie of an authenticated user and log into the web application, compromising session integrity and potentially exposing user data. The vulnerability arises in th...

WordPress Ultimate Member 2.0.38 Cross Site Request Forgery

Exploit Title: WordPress Ultimate Member Plugin 2.0.38 CSRF Discovery Date: 03 / 05 / 2019 Discovered By: Georg Knabl Vendor Website: https://ultimatemember.com/ Software Link: https://wordpress.org/plugins/ultimate-member/ Software Download URL :...

CVE-2019-6607

On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vulnerability in an ASM violation viewed in the Configuration utility. In the worst case, an attacker can store a CSRF which results in code execution as the adm...