CVE-2018-18495

WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions...

Wireshark Null Pointer Dereference Vulnerability (CNVD-2019-18501)

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A null pointer dereference vulnerability exists in the TCAP parser in Wireshark versions...

UBUNTU-CVE-2019-9208

In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash. This was addressed in epan/dissectors/asn1/tcap/tcap.cnf by avoiding NULL pointer dereferences...

Memu Play 6.0.7 - Privilege Escalation

Exploit Title: Memu Play 6.0.7 - Privilege Escalation PoC Date: 20/02/2019 Author: Alejandra Sánchez Vendor Homepage: https://www.memuplay.com/ Software Link: https://www.memuplay.com/download-en.php?filename=Memu-Setup&from=officialrelease Version: 6.0.7 Tested on: Windows 10 / Windows 7...

Quagga BGP Daemon bgp_capability_msg_parse Denial-of-Service (CVE-2018-5381)

A denial-of-service vulnerability has been reported in the BGP Daemon of Quagga. The vulnerability is due to improper handling of Multiprotocol Extensions Capabilities within certain BGP messages. A remote attacker could exploit this vulnerability by sending a crafted BGP message to the target...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0002)

The remote OracleVM system is missing necessary patches to address critical security updates : - rds: congestion updates can be missed when kernel low on memory Mukesh Kacker Orabug: 28425811 - net/rds: ib: Fix endless RNR Retries caused by memory allocation failures Venkat Venkatsubra Orabug:...

How Web Apps Can Turn Browser Extensions Into Backdoors

Researchers have added another reason to be suspicious of web browser extensions. According to a recently published academic report, various Chrome, Firefox and Opera browser extensions can be compromised by an adversary that can steal sensitive browser data and plant arbitrary files on targeted...

Memory corruption

An extension to hooks capabilities which debuted in Kea 1.4.0 introduced a memory leak for operators who are using certain hooks library facilities. In order to support multiple requests simultaneously, Kea 1.4 added a callout handle store but unfortunately the initial implementation of this stor...

CVE-2018-5739

An extension to hooks capabilities which debuted in Kea 1.4.0 introduced a memory leak for operators who are using certain hooks library facilities. In order to support multiple requests simultaneously, Kea 1.4 added a callout handle store but unfortunately the initial implementation of this stor...

Multiple Reflective Cross-Site Scripting Vulnerabilities in Ampache

Ampache is a WEB-based audio/video streaming software and file manager. Multiple reflective cross-site scripting vulnerabilities exist in Ampache. An attacker can construct XSS statements and perform pop-up box operations to obtain user cookies and other information...

CentOS 7 : libvirt (CESA-2018:3113)

An update for libvirt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Android Trojan Targets PayPal Users

Want to download an Android battery utility app from a third-party Android app store? What could possibly go wrong? Last month researchers downloaded a power management app called “Optimization Android” from an undisclosed third-party app store. What they found was instead of optimizing the phone...

UBUNTU-CVE-2018-18495

WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions...

Defending Credentials From Automated Attack Tools

By Danny Wasserman The folks on the Akamai Professional Services team are the people who help implement, configure, and tune the cloud security products that protect our customers' web applications from the daily onslaught of bots blasting login attempts against their websites, mobile apps, and...

Small Business Benefits of Moving to the Cloud: Resource Friendly

Small businesses never seem to have enough people or funding, and the last thing they need is for their security solution to be eating up precious resources. Your people are stretched thin and don’t really have time or budget to source new hardware or push software updates. Not to mention the...

Fedora 27 : rpm (2018-2c9120d494)

An unfortunate regression in rpm 4.14.2 causes --setperms to behave incorrectly on symbolic links: file and directory permissions become world-writable and executable on symlink targets. A similar flaw exists in --setugids, but it is less exploitable. If you have used --setperms or --setugids, or...

Threat Intelligence, the Dark Web and Information sharing: Supporting improved protection

There are numerous different elements and obstacles that contribute to the challenges of data protection in the current threat environment. However, a leading issue is ensuring protection against the latest, emerging attack styles and breach strategies. After all, how can an organization ensure t...

Important: Red Hat Security Advisory: libvirt security update

An update for libvirt is now available for Red Hat Enterprise Linux 6.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Cell Phone Security and Heads of State

Earlier this week, the New York Times reported that the Russians and the Chinese were eavesdropping on President Donald Trump's personal cell phone and using the information gleaned to better influence his behavior. This should surprise no one. Security experts have been talking about the potenti...

Podcast: A Utility Ransomware Attack, Post-Hurricane

A “critical water utility” was hit by a recent ransomware attack, significantly impeding the service in the week after Hurricane Florence hit the East Coast of the U.S. The Onslow Water and Sewer Authority ONWASA said in a Monday release that a “sophisticated ransomware attack… has left the utili...