15799 matches found
CVE-2018-19120
The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address...
CVE-2018-19120
The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address...
CVE-2018-19120
The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address...
Hardcoded credentials
The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address...
CVE-2018-19120
The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address...
CVE-2018-19120
CVE-2018-19120 detail: The HTML thumbnailer in KDE Applications prior to 18.12.0 can trigger outbound TCP connections to arbitrary IPs, exposing the source IP address. This affects KDE’s HTML thumbnailer component (and related KDE Applications packaging that ships kio-extras). Root cause is insuf...
Making Vulnerable Web-Applications: XXS, RCE, SQL Injection and Stored XSS ( + Buffer Overflow)
In this post I will write some simple vulnerable web applications in python3 and will show how to attack them. This is all for educational purposes and for complete beginners. So please don't be too hard on me. As a first step I will create a basic web-application using twisted python web server...
Panasonic applications register unquoted service paths
Overview Some pre-installed applications on Panasonic PCs register Windows services with unquoted file paths CWE-428. Panasonic Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Panasonic Corporation coordinated under the Information...
FAST or Burp or both?
By @aLLy , Wallarm Research Hello guys, time to talk details about Wallarm FAST Framework for Application Security Testing. It’s a new automatic web vulnerability scanning and fuzzing detection tool by Wallarm Inc. It is well suited for security researchers in enterprise Red Teams as well as for...
USN-3830-1: OpenJDK regression
USN-3804-1 fixed vulnerabilities in OpenJDK. Unfortunately, that update introduced a regression when validating JAR files that prevented Java applications from finding classes in some situations. This update fixes the problem. We apologize for the inconvenience...
[SECURITY] Fedora 28 Update: rubygem-rack-2.0.4-4.fc28
Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a single...
[SECURITY] Fedora 27 Update: rubygem-rack-2.0.3-4.fc27
Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a single...
Ubuntu 16.04 LTS / 18.04 LTS : OpenJDK regression (USN-3830-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3830-1 advisory. USN-3804-1 fixed vulnerabilities in OpenJDK. Unfortunately, that update introduced a regression when validating JAR files that prevented Java...
[SECURITY] Fedora 28 Update: flatpak-1.0.6-1.fc28
flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information...
PHP Security Advent Calendar 2018
In our first calendar edition in 2016, we analyzed exceptional vulnerabilities in some of the most popular open source PHP applications. Last year, we released 24 PHP security challenges with a hidden security pitfall in every days code challenge. This year we would like to give once again...
[SECURITY] Fedora 27 Update: flatpak-1.0.6-1.fc27
flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information...
Bug Bounty: Earn $40,000 for hacking Facebook, Instagram or WhatsApp
By Waqas Facebook has launched a new bug bounty program inviting hackers to identify and report vulnerabilities in its website and applications. The social network has increased payouts and offers researchers to look for vulnerabilities in a wide variety of products owned by Facebook including...
ghostscript sandbox bypass remote command execution vulnerability alerts-a vulnerability alert-the black bar safety net
! 0x00 vulnerability background 11 on the 21st, Semmle team of security researchers Man Yue Mo by semmle website, once again that ghostscript security sandbox can be bypassed by constructing a malicious PDF content that can cause remote command execution. ghostscript is widely used, ImageMagick,...
UBUNTU-CVE-2018-4345
A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...