kscreen DoS

The vulnerability of the kscreen utility for supporting multiple monitors in the Astra Linux operating system is related to scaling errors when changing screen resolutions. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Friday Squid Blogging: Why Mexican Jumbo Squid Populations Have Declined

A group of scientists conclude that it's shifting weather patterns and ocean conditions. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Webmin 1.920 password_change.cgi Backdoor Exploit

This Metasploit module exploits a backdoor in Webmin versions 1.890 through 1.920. Only the SourceForge downloads were backdoored, but they are listed as official downloads on the project's site. Unknown attackers inserted Perl qx statements into the build server's source code on two separate...

Webmin password_change.cgi Backdoor

This module exploits a backdoor in Webmin versions 1.890 through 1.920. Only the SourceForge downloads were backdoored, but they are listed as official downloads on the project's site. Unknown attackers inserted Perl qx statements into the build server's source code on two separate occasions: onc...

Your Business is Compliant with Data Security Regulations. It’s Still not Safe.

There has been plenty of discussion about the impact of global data regulations on data security practices. Particularly with the implementation of the EU’s GDPR last year, organizations in every industry have been scrambling to develop new security practices to avoid fines and the associated bad...

Friday Squid Blogging: More Materials Science from Squid Skin

Article: "How a Squid's Color-Changing Skin Inspired a New Material That Can Trap or Release Heat." As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

CVE-2018-14711

Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-changing actions with specially crafted URLs...

Cross site request forgery (csrf)

Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-changing actions with specially crafted URLs...

PT-2019-9046

Name of the Vulnerable Software and Affected Versions ASUS RT-AC3200 version 3.0.0.4.382.50010 Description The issue is related to missing cross-site request forgery protection in the appGet.cgi file. This allows attackers to cause state-changing actions using specially crafted URLs...

CVE-2018-14711: Cross-Site Request Forgery (CSRF)

Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-changing actions with specially crafted URLs...

Authorization

IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access the application endpoints of high privileged users and also perform some state changing actions restricted to a high privileged user. IBM X-Force ID: 153119...

CVE-2018-1928: Undefined Security Weakness

IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access the application endpoints of high privileged users and also perform some state changing actions restricted to a high privileged user. IBM X-Force ID: 153119...

PT-2018-14901

Name of the Vulnerable Software and Affected Versions IBM StoredIQ version 7.6.0 Description The issue is related to improper authorization of user roles. A low-privileged user can access application endpoints and perform state-changing actions that are restricted to high-privileged users...

CVE-2018-14892: Cross-Site Request Forgery (CSRF)

Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow attackers to perform state-changing actions via crafted HTTP forms...

PT-2018-12782

Name of the Vulnerable Software and Affected Versions ZyXEL NSA325 V2 version 4.81 Description The issue concerns missing protections against Cross-Site Request Forgery in the web application, allowing attackers to perform state-changing actions via crafted HTTP forms. Recommendations For ZyXEL...

[SECURITY] Fedora 29 Update: hesiod-3.2.1-14.fc29

Hesiod is a system which uses existing DNS functionality to provide access to databases of information that changes infrequently. It is often used to distribute information kept in the /etc/passwd, /etc/group, and /etc/printc ap files, among others...

[SECURITY] Fedora 28 Update: hesiod-3.2.1-14.fc28

Hesiod is a system which uses existing DNS functionality to provide access to databases of information that changes infrequently. It is often used to distribute information kept in the /etc/passwd, /etc/group, and /etc/printc ap files, among others...

What's New in Performance

One of the things I like most about living in New England is the changing of seasons. I find myself looking forward, thinking about what's exciting about the next one. Each season offers something unique and special, and if you're ambitious enough to try new things, a variety of new opportunities...

CVE-2018-17986

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...

CVE-2018-9082

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their...