CVE-2017-12870

SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers...

[SECURITY] [DLA 1075-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb7u16 CVE ID : CVE-2017-9066 Debian Bug : 862816 In WordPress, there is insufficient redirect validation in the HTTP class, leading to SSRF. For Debian 7 "Wheezy", these problems have been fixed in version 3.6.1+dfsg-1deb7u16. We recommend that you...

CVE-2017-1376

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873...

Code injection

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873...

CVE-2017-1376

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873...

libfpx Denial of Service Vulnerability (CNVD-2017-25760)

libfpx is a library for manipulating FlashPIX images. A denial of service vulnerability exists in OLEStream::WriteVTLPSTR in olestrm.cpp in libfpx, which can be exploited by a remote attacker to cause a denial of service via a specially crafted fpx image...

CVE-2015-7517: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to 1 class-doifd-download.php or 2 class-doifd-landing-page.php in public/includes/...

CVE-2017-1376: Inclusion of Functionality from Untrusted Control Sphere

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873...

CVE-2017-1376

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873...

pilotundflugzeug.de XSS vulnerability

Vulnerable URL: https://www.pilotundflugzeug.de/servlet/protect/UserLogin.class?showSendPassword Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 264556 VIP website status:| No...

Path traversal

The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system...

Hijacking Autoloader

symfony/class-loader is susceptible to the hijacking of the autoloader. The vulnerability exists because it does not prevent the ability to access the loader instance, resulting in the auto-outputting or revealing unwanted information...

CVE-2017-1376

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873...

The vulnerability of the Oniguruma library, which arises from the use of an uninitialized variable and allows for memory corruption to occur.

The vulnerability of the Oniguruma library arises from an improper change in the state of the parsecharclass function. This allows for the use of an uninitialized variable during writing to the buffer. Exploiting this vulnerability could enable a malicious actor to cause memory corruption by...

August 17, 2017 – Morning Cyber Coffee Headlines – “Davy Crockett” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 17, 2017 - Headlines Students offer hope for narrowing of skills gap in...

Microsoft Edge Chakra - 'InterpreterStackFrame::ProcessLinkFailedAsmJsModule' Incorrectly Re-parses

GetOriginalEntryPoint : nullptr; if this-pCurrentFunction && this-pCurrentFunction-IsFunctionParsed Assertthis-pCurrentFunction-StartInDocument == pnode-ichMin; pCurrentFunction" is the consturctor, but "pnode" refers to the method "f". PoC: -- class MyClass fa printa; constructor 'use asm';...

Microsoft Edge Chakra - InterpreterStackFrame::ProcessLinkFailedAsmJsModule Incorrectly Re-parses

Microsoft Edge Chakra - InterpreterStackFrame::ProcessLinkFailedAsmJsModule Incorrectly Re-parses GetOriginalEntryPoint : nullptr; if this-pCurrentFunction && this-pCurrentFunction-IsFunctionParsed Assertthis-pCurrentFunction-StartInDocument == pnode-ichMin; pCurrentFunction" is the consturctor,...

Microsoft Edge Chakra EmitAssignment Register Issue Exploit

Microsoft Edge Chakra has an issue where EmitAssignment uses the "this" register without initializing. Microsoft Edge: Chakra: EmitAssignment uses the "this" register without initializing "EmitAssignment" doesn't call "EmitSuperMethodBegin" that initializes the "this" register for the case when t...

Gxlcms audiobook system v1.0 frontend CommAction.class.php has SQL injection vulnerability

Gxlcms audiobook system is a simple to use, provide listening to the network resource station to provide free collection nodes. Gxlcms Audiobook System v1.0 bulid 20170714 SQL injection vulnerability exists in CommAction.class.php in the foreground due to the system's failure to strictly filter...

JDK: class verifier allowing Security Manager bypass

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873...