PT-2018-14613

Name of the Vulnerable Software and Affected Versions catfish blog version 2.0.33 Description A CSRF issue was discovered in the admin/Index/tiquan endpoint of the catfish blog. Recommendations For catfish blog version 2.0.33, update to a version that includes a fix for this issue, if available. ...

PT-2018-14614

Name of the Vulnerable Software and Affected Versions catfish blog version 2.0.33 Description A cross-site scripting XSS issue was found, related to the "write source code" functionality. Recommendations For catfish blog version 2.0.33, at the moment, there is no information about a newer version...

Leanote cross-site scripting vulnerability (CNVD-2018-21793)

Leanote is an open source notepad application. A cross-site scripting vulnerability exists in the Blog Basic Setting page in Leanote version 2.6.1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the title field...

On Disguise

The former CIA Chief of Disguise has a fascinating video about her work...

セキュリティ更新プログラム リリース スケジュール (2019 年)

2018 年のリリース スケジュールは「セキュリティ更新プログラム リリース スケジュール 2018 年」をご覧ください。...

Design/Logic Flaw

Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page...

CVE-2018-18553

Leanote 2.6.1 is affected by a cross-site scripting (XSS) vulnerability in the Blog Basic Setting title field, exploitable via rendering of the  Likes page. The issue stems from mishandling the title field during page rendering, allowing injected scripts/HTML to execute in affected contexts. Pub...

CVE-2018-18553: Improper Neutralization of Input During Web Page Generation

Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page...

PT-2018-14512

Name of the Vulnerable Software and Affected Versions Leanote version 2.6.1 Description The issue concerns a mishandling of the title field in the Blog Basic Setting during the rendering of the "likes" page, leading to an XSS issue. Recommendations For Leanote version 2.6.1, update to a version...

Friday Squid Blogging: Roasted Squid with Tomatillo Salsa

Recipe and commentary. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Tumblr Privacy Bug Could Have Exposed Sensitive Account Data

Tumblr on Wednesday disclosed it had fixed a vulnerability that could have exposed sensitive account information including usernames/passwords and individual IP addresses. However, the company stressed there’s no evidence that any data was exposed. The bug existed in the “Recommended Blogs” featu...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +15264 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (>=4.0.0.release, <=4.3.14.release)

org.springframework:spring-core MAVEN version =4.0.0.release, =0.1.6, =0.1.4-sb1x, =0.1.0, =4.0.2, =4.0.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.1.0.release, =1.1.0.release, =1.1.4.release and more Source cves: CVE-2018-1272 Source advisory: GHSA-4487-X383-QPPH...

am.ik.blog:blog-domain (>=4.0.2, <=4.3.6), am.ik.blog:blog-mapper (>=4.0.0, <=4.5.0) +9487 more potentially affected by CVE-2018-1199 via org.springframework:spring-core (>=4.3.0.release, <=4.3.13.release)

org.springframework:spring-core MAVEN version =4.3.0.release, =4.0.2, =4.0.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0.release, =0.2, =0.2, =0.2, =0.3 - at.researchstudio.sat:won-matcher 0.3 - at.researchstudio.sat:won-matcher-rescal 0.3 - at.researchstudio.sat:won-matcher-service 0.3 -...

Tumblr Patches A Flaw That Could Have Exposed Users' Account Info

Tumblr today published a report admitting the presence of a security vulnerability in its website that could have allowed hackers to steal login credentials and other private information for users' accounts. The affected information included users email addresses, protected hashed and salted...

October 2018 Security Update Release

Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. MSRC team...

Linux Kernel < 4.11.8 - mq_notify: double sock_put() Local Privilege Escalation Exp

Exploit for linux platform in category local exploits / CVE-2017-11176: "mqnotify: double sockput" by LEXFO 2018. DISCLAIMER: The following code is for EDUCATIONAL purpose only. Do not use it on a system without authorizations. WARNING: The exploit WILL NOT work on your target, it requires...

Google+ Shuts Down Over Breach as Google Offers New Privacy Features

Google got caught hiding a privacy issue affecting 500,000 users on the same day it rolled out privacy protections...

Big Data and Cybersecurity: Opportunity or Threat?

By Marie Fincher Suppose you write for a living. You write articles and blog posts for a number of clients. In the course of that writing, you have to do a lot of research, accessing data and information from all over the web. The inevitable happens. You get hacked or you pick up a virus...

Linux Kernel 4.11.8 - mq_notify: double sock_put() Local Privilege Escalation

Linux Kernel 4.11.8 - mqnotify: double sockput Local Privilege Escalation / CVE-2017-11176: "mqnotify: double sockput" by LEXFO 2018. DISCLAIMER: The following code is for EDUCATIONAL purpose only. Do not use it on a system without authorizations. WARNING: The exploit WILL NOT work on your target...

Friday Squid Blogging: Squid Protein Used in Variable Thermal Conductivity Material

This is really neat. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...