Instacart: Host Header Injection/Redirection in: https://www.instacart.com/

Hi, Your website is vulnerable to Host Header Injection because the host header can be changed to something outside the target domain In many cases, developers are trusting the HTTP Host header value and using it to generate links, import scripts and even generate password resets links with its...

Privilege escalation

The Netlogon service in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 improperly establishes secure communications channels, which allows local users to gain privileges by leveraging access to a domain-joined machine, aka "Netlogon Elevation of Privilege Vulnerability...

VTun 'client.c' Denial of Service Vulnerability

VTun is a suite of software for creating virtual channels over TCP/IP. A security vulnerability exists in VTun that could be exploited by remote attackers to submit a special request to consume CPU resources and cause a denial of service...

The vulnerability of the Linux operating system, which allows a malicious individual to trigger a service failure

A local user can trigger a service failure when using the RDS network protocol through Infiniband channels...

UBUNTU-CVE-2016-4805

Use-after-free vulnerability in drivers/net/ppp/pppgeneric.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service memory corruption and system crash, or spinlock or possibly have unspecified other impact by removing a network namespace, related to the...

PT-2017-7998 · Red Hat · Red Hat Satellite

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite 5 affected versions not specified Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected API...

Germany TV Channels - External URLs, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Germany TV Channels published at the 'play' market has multiple vulnerabilities...

openSUSE Security Update : MozillaThunderbird (openSUSE-2016-402)

MozillaThunderbird was updated to 38.7.0 to fix the following issues : - Update to Thunderbird 38.7.0 boo969894 - MFSA 2015-81/CVE-2015-4477 bmo1179484 Use-after-free in MediaStream playback - MFSA 2015-136/CVE-2015-7207 bmo1185256 Same-origin policy violation using performance.getEntries and...

Putty pscp 0.66 - Stack Buffer Overwrite

Exploit for multiple platform in category dos / poc Source: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563 Author: Date: Feb 20th, 2016 Name: putty Vendor: sgtatham - http://www.chiark.greenend.org.uk/sgtatham/putty/ Version: 0.59 3 9 years ago = affected = 0.66 Platforms: win/ni...

Citrix ICA Virtual Channels Overview

This article provides details of the design, functionality, and usage of the Citrix ICA Virtual Channels and focuses on the Citrix XenApp Plug-ins/Receiverfor Windows Target Audience Application developers, Citrixserver administrators, and help desk personnel. What are ICA Virtual Channels? A lar...

FreeBSD : mozilla -- multiple vulnerabilities (2225c5b4-1e5a-44fc-9920-b3201c384a15)

Mozilla Foundation reports : MFSA 2016-16 Miscellaneous memory safety hazards rv:45.0 / rv:38.7 MFSA 2016-17 Local file overwriting and potential privilege escalation through CSP reports MFSA 2016-18 CSP reports fail to strip location information for embedded iframe pages MFSA 2016-19 Linux video...

Use-after-free when using multiple WebRTC data channels — Mozilla

Security researcher Dominique Hazaël-Massieux reported a use-after-free issue when using multiple WebRTC data channel connections. This causes a potentially exploitable crash when a data channel connection is freed from within a call through it...

UBUNTU-CVE-2016-1962

Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections...

Ubuntu 14.04 LTS : Libgcrypt vulnerability (USN-2896-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2896-1 advisory. Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that Libgcrypt was susceptible to an attack via physical side channels. A local attacker...

Ubuntu: Security Advisory (USN-2896-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2896-1: Libgcrypt vulnerability

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that Libgcrypt was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys...

Python Fuzzing Framework: Kitty

Kitty is an open-source modular and extensible fuzzing framework written in python, inspired by OpenRCE’s Sulley and Michael Eddington’s and now Deja Vu Security’s Peach Fuzzer . Goal The goal of Kitty was to help with fuzzing unusual targets — proprietary and esoteric protocols over non-TCP/IP...

Shopify: shopifyapps.com XSS on sales channels via currency formatting

pinterest, twitter, buy button and facebook sales channels vulnerable to xss via currency formatting. steps to reproduce: - remove pinterest, twitter, buy button and facebook sales channels at .myshopify.com/admin/channels - go to .myshopify.com/admin/settings/general - change currency formating ...

Juniper Networks Junos OS FTPS-Extensions Vulnerability

Junos OS is prone to a vulnerability in BFD daemon. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if descriptio...

Telegram — Secret Messaging app — Shuts Down 78 ISIS Channels

The terrorist groups affiliated with the Islamic State have an extensive presence not only on social media accounts but also on the popular end-to-end encrypted messaging app Telegram through which they communicate with their followers and spread terror propaganda materials. Telegram has always...