Friday Squid Blogging: An MRI Scan of a Squid's Brain

This paper30562-0 is filled with brain science that I do not understand news article, but fails to answer what I consider to be the important question: how do you keep a live squid still for long enough to do an MRI scan on them? As usual, you can also use this squid post to talk about the securi...

A New Clue for the Kryptos Sculpture

Jim Sanborn, who designed the Kryptos sculpture in a CIA courtyard, has released another clue to the still-unsolved part 4. I think he's getting tired of waiting. Did we mention Mr. Sanborn is 74? Holding on to one of the world's most enticing secrets can be stressful. Some would-be codebreakers...

F-Secure Internet Gatekeeper 5.40 - Heap Overflow Exploit

Exploit for linux platform in category web applications Title: F-Secure Internet Gatekeeper 5.40 - Heap Overflow PoC Author: Kevin Joensen Vendor: F-Secure Software: https://www.f-secure.com/en/business/downloads/internet-gatekeeper CVE: N/A Reference:...

Afternoon Cyber Tea—The State of Cybersecurity: How did we get here? What does it mean?

Every year the number and scale of cyberattacks grows. Marc Goodman, a global security strategist, futurist, and author of the book, Future Crimes: Everything is Connected, Everyone is Vulnerable, and What We Can Do About It, thinks a lot about how we got here and what it means, which is why he w...

blogger-cli (>=1.2.0, <=1.2.1), canonicalwebteam-blog (>=2.4.0, <=5.0.0) +3 more potentially affected by CVE-2020-5227 via feedgen (>=0.6.1, <=0.8.0)

feedgen PYPI version =0.6.1, =1.2.0, =2.4.0, =1.0.0.dev37, =2.0.2, =2.0.3 Source cves: CVE-2020-5227 Source advisory: OSV:PYSEC-2020-231...

blogger-cli (>=1.2.0, <=1.2.1), canonicalwebteam-blog (>=2.4.0, <=5.0.0) +3 more potentially affected by CVE-2020-5227 via feedgen (>=0.6.1, <=0.8.0)

feedgen PYPI version =0.6.1, =1.2.0, =2.4.0, =1.0.0.dev37, =2.0.2, =2.0.3 Source cves: CVE-2020-5227 Source advisory: GHSA-G8Q7-XV52-HF9F...

Wordable < 3.1.2 - Plugin's Authentication Bypass

This could allow an unauthenticated user to bypass the plugin authentication process and temporarily gain administrative privileges, allowing the publication of pages and posts on the blog, as well as the upload of media files...

blog-klubok.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1075704 Security Researcher geeknik Helped patch 8930 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting blog-klubok.ru website and...

Don't Ignore Chrome's New Password Checkup Feature

It could help save you when the next big breach hits...

Rukovoditel Project Management CRM 2.5.2 SQL Injection

Exploit Title: Rukovoditel Project Management CRM 2.5.2 - 'reportsid' SQL Injection Google Dork: N/A Date: 2020-01-15 Blog: https://fatihhcelik.blogspot.com/ Exploit Author: Fatih Çelik Vendor Homepage: https://www.rukovoditel.net/ Software Link: https://sourceforge.net/projects/rukovoditel/...

Friday Squid Blogging: Stuffed Squid with Vegetables and Pancetta

A Croatian recipe. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Catfish Blog has a file upload vulnerability

Catfish Blog is a free personal blogging system. A file upload vulnerability exists in Catfish Blog, which can be exploited by an attacker to upload malicious files and gain administrative privileges on the site...

Amazon Takes a Swipe at PayPal's $4 Billion Acquisition

The retail giant warned holiday shoppers that Honey, a popular browser extension, was a “security risk.” Honey denies the claim...

admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2019-19911 via pillow (4.1.1)

pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2019-19911 Source advisory: OSV:PYSEC-2020-172...

admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2020-5310 via pillow (4.1.1)

pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2020-5310 Source advisory: OSV:PYSEC-2020-81...

admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2020-5313 via pillow (4.1.1)

pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2020-5313 Source advisory: OSV:PYSEC-2020-84...

admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2020-5311 via pillow (4.1.1)

pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2020-5311 Source advisory: OSV:PYSEC-2020-82...

admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2020-5312 via pillow (4.1.1)

pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2020-5312 Source advisory: OSV:PYSEC-2020-83...

Command Execution Vulnerability in Blue Route Blog System (CNVD-2020-13869)

The Blue Route blog system is a user multi-user collaborative writing blog system. A command execution vulnerability exists in the Blue Route Blog System that can be exploited by an attacker to gain control of a web server...

Code execution vulnerability in Blue Route blog system se***_pa***.php file

Blue Route Blog System is built with PHP+MySQL. A code execution vulnerability exists in the sepa.php file of the Blue Route blog system. An attacker can exploit the vulnerability to execute commands and gain server privileges...