HackerOne: Improve signals in reputation

New section has been added recently in reputation where you can see something called as signal , which says average reputation per report. However, you can improve your signal points by following below steps Steps: create any report in any team self close the bug see your signal in reputation. it...

libssh2 security and bug fix update

1.4.3-10 - check length of data extracted from the SSHMSGKEXINIT packet CVE-2015-1782 1.4.3-9 - curl consumes too much memory during scp download 1080459 - prevent a not-connected agent from closing STDIN 1147717...

Serendipity 2.0.2 Cross Site Scripting

Date: 28/10/2015 Discovered by: Joel Vadodil Varghese Type of vulnerability: Stored XSS Tested on: Windows 8.1 Product: Serendipity Version: 2.0.2 Description: Application is vulnerable to Stored XSS attack. There is a XSS issue in version 2.0.2. and the vulnerable parameters are "Blog name" and...

Apache Groovy Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Groovy. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Closure implementation which accepts and deserializes a Java serialized binary strea...

The vulnerability of the Debian GNU\Linux operating system, which allows a perpetrator to trigger a service failure.

The vulnerability of the Debian GNU\Linux operating system is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker, operating remotely, to cause a service failure by closing the SSL session at a certain time...

SEO SearchTerms Tagging 2 <= 1.535 - XSS & Authenticated SQL Injection

Plugin is still affected and has been closed...

GetSimple CMS 5.7.3.1 Cross Site Scripting

Date: 29/06/2015 Discovered by: Joel Vadodil Varghese Type of vulnerability: Persistent XSS Tested on: Windows 7 Product: GetSimple CMS Version: 5.7.3.1 Description: Application is vulnerable to Persistent XSS attack on page - URL -...

CVE-2013-7441

The modern style negotiation in Network Block Device nbd-server 2.9.22 through 3.3 allows remote attackers to cause a denial of service root process termination by 1 closing the connection during negotiation or 2 specifying a name for a non-existent export...

PT-2015-3589 · Nbd +2 · Nbd-Server +2

Name of the Vulnerable Software and Affected Versions: nbd-server versions 2.9.22 through 3.3 Description: The issue in nbd-server allows remote attackers to cause a denial of service by either closing the connection during negotiation or specifying a name for a non-existent export, which can lea...

Tomcat full system packet DoS denial of service vulnerability CVE-2 0 1 4-0 2 3 0-vulnerability warning-the black bar safety net

Tomcat burst number for the CVE-2 0 1 4-0 2 3 0 DoS denial of service vulnerability. The vulnerability risk level is LOW, the impact of the version include: - - Apache Tomcat 8.0.0-RC1 to 8.0.8 - - Apache Tomcat 7.0.0 to 7.0.54 - - Apache Tomcat 6.0.0 to 6.0.43 The problem occurs in with the...

[SECURITY] Fedora 20 Update: php-ZendFramework2-2.3.7-1.fc20

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...

WordPress gSlideShow 0.1 CSRF / XSS

Title: CSRF / Stored XSS Vulnerability in gSlideShow Wordpress Plugin Author: Manideep K CVE-ID: CVE 2014-9391 Plugin Homepage: https://wordpress.org/plugins/gslideshow/ Version Affected: 0.1 probably lower versions Severity: High Description: Vulnerable Parameter: 1 id:rssid , name:rss 2...

WordPress O2Tweet 0.0.4 CSRF / XSS

Title: CSRF/XSS Vulnerability in O2Tweet WP Plugin Author: Manideep K CVE -ID: CVE-2014-9338 Plugin Homepage: https://wordpress.org/plugins/o2tweet/ Version Affected: 0.0.4 probably lower versions Severity: High Description: Vulnerable Parameter: o2tusername, o2ttags etc About Vulnerability: This...

Mikiurl WordPress Eklentisi 2.0 CSRF / XSS

Title: CSRF/XSS Vulnerability in Mikiurl WordPress Eklentisi WP Plugin Author: Manideep K CVE -D : CVE-2014-9337 Plugin Homepage: https://wordpress.org/plugins/mikiurl-wordpress-eklentisi/ Version Affected:2.0 probably lower versions Severity: High Description: Vulnerable Parameter:...

IRCCloud: Unvalidated Channel names causes IRC Command Injection

IRCCloud does not validate the channel names created by a user causing it to be parsed as an IRC command such as QUIT. This means the user can have their clients force-closed by a malicious channel name. This could also lead to other command injections such as forcing the handover of channels to...

Category Page Icons <= 0.9.1 - Arbitrary File Upload/Deletion via Path Traversal

v0.9.2 added a check to not allow direct access to the affected file. However the path traversal was not fixed Plugin has been closed from repository. PoC Choose File to upload : Directory :...

UserPreferencesResource accepts form encoded data, is vulnerable to XSRF attacks

UserPreferencesResource exposes all data stored in a UserPreferences object, and allows updating it via a POST. This vulnerability needs to be closed before the next deployment...

dovecot security update

Package : dovecot Version : 1:1.2.15-7+deb6u1 CVE ID : CVE-2014-3430 Debian Bug : 747549 It was discovered that the Dovecot email server is vulnerable to a denial of service attack against imap/pop3-login processes due to incorrect handling of the closure of inactive SSL/TLS connections...

curl, libcurl security update

CentOS Errata and Security Advisory CESA-2014:0561 Updated curl packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System...

[SECURITY] Fedora 19 Update: php-ZendFramework2-2.2.6-1.fc19

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...