CVE-2018-17976

CVE-2018-17976 affects GitLab Community Edition 11.x (before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2). The vulnerability enables information exposure through Epic change descriptions in the Epic feature. Affected versions expose partial to high-privacy data (as per the CVE and rela...

Netgate pfSense CE Command Injection Vulnerability (CNVD-2018-26995)

Netgate pfSense CE is the United States Netgate company's set of free open source FreeBSD-based firewall and router software. A command injection vulnerability exists in the 'powerdacmode' POST parameter in Netgate pfSense CE version 2.4.4-RELEASE, which can be exploited by an attacker to execute...

Fedora Update for community-mysql FEDORA-2018-b4820696e1

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for community-mysql FEDORA-2018-4ae94c8deb

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Kicking off the Microsoft Graph Security Hackathon

Cybersecurity is one of the hottest sectors in tech with Gartner forecasting worldwide information spending to exceed $124 billion by the end of 2019. New startups and security solutions are coming onto the market while attackers continue to find new ways to breach systems. The security solutions...

[SECURITY] Fedora 29 Update: drupal8-8.6.2-1.fc29

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

[SECURITY] Fedora 28 Update: drupal7-7.60-2.fc28

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 28 Update: drupal8-8.6.2-1.fc28

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

PHP Security Advent Calendar 2018

In our first calendar edition in 2016, we analyzed exceptional vulnerabilities in some of the most popular open source PHP applications. Last year, we released 24 PHP security challenges with a hidden security pitfall in every days code challenge. This year we would like to give once again...

Fedora 27 : community-mysql (2018-4ae94c8deb)

MySQL 5.7.24 Release notes : https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-24.html CVEs fixed : CVE-2018-3276 CVE-2018-3200 CVE-2018-3284 CVE-2018-3173 CVE-2018-3162 CVE-2018-3247 CVE-2018-3156 CVE-2018-3161 CVE-2018-3278 CVE-2018-3282 CVE-2018-3187 CVE-2018-3277 CVE-2018-3144...

Cryptocurrency threat predictions for 2019

Kaspersky Security Bulletin: Threat Predictions for 2019 Threat predictions for industrial security in 2019 Cyberthreats to financial institutions 2019: overview and predictions Introduction – key events in 2018 2018 saw cryptocurrency become an established part of many people's lives, and a more...

EZSA-2018-007 User data disclosure

More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure...

A week in security (November 12 – 18)

Last week on Malwarebytes Labs, we found out that TrickBot became a top business threat, so we took a deeper look at what's new with it. With Christmas just around the corner, the Secret Sister scam returned. We also touched on the security and privacy or lack thereof in smart jewelry, air traffi...

'DerpTroll' Faces 10 Years in Prison for DDoSing Gaming Sites as a Teen

After a short but disruptive career knocking popular online gaming sites offline for sport, Austin Thompson, a.k.a. “DerpTroll,” has pleaded guilty to hacking charges. He faces a maximum penalty of 10 years prison and a $250,000 fine. Thompson, a 23-year-old Utah resident, made his plea on Tuesda...

CVE-2018-12411 TIBCO ActiveSpaces Administrative Daemon Vulnerable to CSRF Attacks

The administrative daemon tibdgadmind of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks...

CVE-2018-12411

The CVE-2018-12411 issue affects TIBCO ActiveSpaces Administrative Daemon (tibdgadmind) across Community, Developer, and Enterprise Editions. The root cause is a cross-site request forgery (CSRF) vulnerability that could enable an attacker to gain administrative access, including actions like del...

CVE-2018-12412

The realm server tibrealmserver component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks. Affected releases are TIBCO...

CVE-2018-12413

The Schema repository server tibschemad component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability which may allow an...

CVE-2018-12411

The administrative daemon tibdgadmind of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks...

Cross site request forgery (csrf)

The realm server tibrealmserver component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks. Affected releases are TIBCO...