SUSE-SU-2017:2175-1 Security update for java-1_8_0-openjdk

This java-180-openjdk update to version jdk8u141 icedtea 3.5.0 fixes the following issues: Security issues fixed: - CVE-2017-10053: Improved image post-processing steps bsc1049305 - CVE-2017-10067: Additional jar validation steps bsc1049306 - CVE-2017-10074: Image conversion improvements bsc10493...

OpenJDK: incorrect handling of references in DGC (RMI, 8163958)

It was discovered that the DCG implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application...

Open Distributed Threat Intelligence: Yeti

Yeti is a platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository. Yeti will also automatically enrich observables e.g. resolve domains, geolocate IPs so that you don’t have to. Yeti provides an interface for humans shiny...

Multi Gather Maven Credentials Collection

This module will collect the contents of all users settings.xml on the targeted machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'nokogiri' class MetasploitModule 'Multi Gather Maven Credentials...

OpenJDK: incorrect handling of references in DGC (RMI, 8163958)

It was discovered that the DCG implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application...

isupplement.co.uk XSS vulnerability

Vulnerable URL: https://isupplement.co.uk/new-collection/by,productname/sports-nutritionx/search?keyword=xss%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E=0=comvirtuemart=category Details: Description| Value ---|--- Patched:| No Latest check for patch:| 10.11.2017 Vulnerability type:| XSS...

GIF Collection 2.0 SQL Injection

Exploit Title: GIF Collection 2.0 - SQL Injection Dork: N/A Date: 10.08.2017 Vendor Homepage : http://www.scriptfolder.com/ Software Link: http://www.scriptfolder.com/scriptfolder-gif-collection-2-0/ Demo: http://gif2.scriptfolder.com/ Version: 2.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx6...

GIF Collection 2.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: GIF Collection 2.0 - SQL Injection Dork: N/A Date: 10.08.2017 Vendor Homepage : http://www.scriptfolder.com/ Software Link: http://www.scriptfolder.com/scriptfolder-gif-collection-2-0/ Demo: http://gif2.scriptfolder.com/ Version...

GIF Collection 2.0 - SQL Injection

GIF Collection 2.0 - SQL Injection Exploit Title: GIF Collection 2.0 - SQL Injection Dork: N/A Date: 10.08.2017 Vendor Homepage : http://www.scriptfolder.com/ Software Link: http://www.scriptfolder.com/scriptfolder-gif-collection-2-0/ Demo: http://gif2.scriptfolder.com/ Version: 2.0 Category:...

Complaint Alleges Hotspot Shield VPN Engages in Deceptive Trade Practices

A complaint has been filed with the U.S. Federal Trade Commission alleging that a free VPN service marketed as a provider of secure and anonymous internet access shares user data and redirects traffic to partners, including online advertising companies. The Center for Democracy and Technology CDT...

Hotspot Shield VPN Accused of Spying On Its Users' Web Traffic

"Privacy" is a bit of an Internet buzzword nowadays as the business model of the Internet has now shifted towards data collection. Although Virtual Private Network VPN is one of the best solutions to protect your privacy and data on the Internet, you should be more vigilant while choosing a VPN...

OpenJDK: incorrect handling of references in DGC (RMI, 8163958)

It was discovered that the DCG implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application...

[SECURITY] Fedora 25 Update: gcc-6.4.1-1.fc25

The gcc package contains the GNU Compiler Collection version 6. You'll need this package in order to compile C code...

Me on Restaurant Surveillance Technology

I attended the National Restaurant Association exposition in Chicago earlier this year, and looked at all the ways modern restaurant IT is spying on people. But there's also a fundamentally creepy aspect to much of this. One of the prime ways to increase value for your brand is to use the Interne...

Niushop open source mall system has multiple SQL injection vulnerabilities

NiuShop open source mall system , is by the Shanxi Niu Cool Information Technology Co., Ltd. completely independent design , research and development of a PHP open source e-commerce system . NiuShop open source mall system collectionGoodsOrShopt, cancelCollGoodsOrShop, platformAdvList,...

GNU GCC Insecure Random Number Generator Vulnerability

GNU gcc GNU Compiler Collection is an open source compiler for programming languages developed by the GNU Project. An insecure random number generator vulnerability exists in GNU GCC. An attacker could exploit the vulnerability to gain access to perform certain unauthorized operations...

CVE-2017-11671

Under certain circumstances, the ix86expandbuiltin function in i386.c in GNU Compiler Collection GCC version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially...

CVE-2017-11671

CVE-2017-11671 affects GCC: the ix86_expand_builtin path in i386.c can generate RDRAND/RDSEED instruction sequences that clobber the status flag before being read, potentially causing reduced randomness. Documented in GCC bug reports and affected across GCC 4.6–4.9, 5 before 5.5, and 6 before 6.4...

Android Spyware Still Collects PII Despite Outcry

UPDATE LAS VEGAS—Shanghai Adups Technology Co. was roundly criticized Wednesday during a Black Hat session for continuing to use spyware called Adups on at least two Android handset makers’ phones. Researchers said the company was still collecting personal identifiable information without user...

Multi Gather Docker Credentials Collection

This module will collect the contents of all users' .docker directories on the targeted machine. If the user has already push to docker hub, chances are that the password was saved in base64 default behavior. This module requires Metasploit: https://metasploit.com/download Current source:...