CVE-2021-27660 C-CURE 9000

An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs...

CVE-2020-8290

Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in bztransmit helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary...

Hardcoded credentials

Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in bztransmit helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality...

CVE-2020-8290

Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in bztransmit helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary...

CVE-2020-8289

Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in bztransmit helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality...

Backblaze 信任管理问题漏洞

Backblaze is a cloud backup service from Backblaze, Inc. in the United States. A trust management issue vulnerability exists in Backblaze for Windows prior to 7.0.1.433 and Backblaze for macOS prior to 7.0.1.434, which stems from suffering improper certificate validation in the bztransmit helper...

Slack: Stored XSS in files.slack.com

We want to once again thank researcher @oskarsv for informing us of this issue. In the original submission that we previously disclosed here: https://hackerone.com/reports/783877, Oskarsv detailed a remote code execution vulnerability that hinged on the functionality of Slack’s “Posts” feature...

CVE-2019-6656

BIG-IP APM Edge Client before version 7.1.8 7180.2019.508.705 logs the full apm session ID in the log files. Vulnerable versions of the client are bundled with BIG-IP APM versions 15.0.0-15.0.1, 14,1.0-14.1.0.6, 14.0.0-14.0.0.4, 13.0.0-13.1.1.5, 12.1.0-12.1.5, and 11.5.1-11.6.5. In BIG-IP APM...

bookmycab.com Cross Site Request Forgery vulnerability

Open Bug Bounty ID: OBB-655263 Description| Value ---|--- Affected Website:| bookmycab.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| CSRF Cross-Site Request Forgery / CWE-352 CVSSv3 Score:| 8.8...

[SECURITY] Fedora 22 Update: quassel-0.12.2-6.fc22

Quassel IRC is a modern, distributed IRC client, meaning that one or multiple clients can attach to and detach from a central core -- much like the popular combination of screen and a text-based IRC client such as WeeChat, but graphical...

Threat Outbreak Alert: Fake Email Client Application Update Instructions Email Messages on April 18, 2014

Medium Alert ID: 33854 First Published: 2014 April 18 18:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain email settings update instructions for the recipient. The text in the email message attempts to convince the...

Update to Bitcoin Client Fixes DoS Bug, Password Strength

The developers behind Bitcoin-QT, a software wallet used to protect and back up Bitcoin currency, have pushed out a new version of the client, fixing a critical denial-of-service bug, three security issues and fortifying password security. Version 0.8.4 of the original Bitcoin client was posted t...

Skype Privacy Bug Sends IMs to Random Recipients

Skype users who are chatting online when their client crashes may later find the last instant message they sent to someone actually ended up with someone else. The privacy bug surfaced after users began reporting strange activity in a community forum. Today Skype’s Leonas Sendrauskas issued a...

[SECURITY] Fedora 14 Update: quassel-0.7.3-1.fc14

Quassel IRC is a modern, distributed IRC client, meaning that one or multiple clients can attach to and detach from a central core -- much like the popular combination of screen and a text-based IRC client such as WeeChat, but graphical...

CentOS 5 : spice-xpi (CESA-2010:0651)

An updated spice-xpi package that fixes two security issues and three bugs is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severi...

CVE-2009-3110

Race condition in the file transfer functionality in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 allows remote attackers to read sensitive files and prevent client updates by connecting to the file transfer port before the expected client does...

Local LiveUpdate server username / password information revealed by client

SUMMARY Risk Impact Medium Remote Access | Yes ---|--- Local Access | Yes Authentication Required | Yes Exploit publicly available | No AFFECTED PRODUCTS Product | Version | Build | Solution ---|---|---|--- LiveUpdate Client | 2.7 | 34 | LiveUpdate Client Update ADDITIONAL PRODUCT INFORMATION...

[SECURITY] [DSA 287-1] New EPIC packages fix DoS and arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 287-1 [email protected] http://www.debian.org/security/ Martin Schulze April 15th, 2003 http://www.debian.org/security/faq -...

Domino Advisories UPDATE

Hi All, Please note the following correction - The Notes Client Up-Date can be found at http://www14.software.ibm.com/webapp/download/search.jsp?q=&cat=&pf=&k=&dt=& go=y&rs=ESD-NOTECLNTi&STACT=&SCMP=&sb=r The Domino Web Server Update can be found at...

Important: Red Hat Security Advisory: xchat security update

A security issue in XChat allows a malicious server to execute arbitrary commands. XChat is a popular cross-platform IRC client. Versions of XChat prior to 1.8.9 do not filter the response from an IRC server when a /dns query is executed. Because XChat resolves hostnames by passing the configured...