avia.at Cross Site Scripting vulnerability

Security Researcher metamorfosec Helped patch 1935 vulnerabilities Received 9 Coordinated Disclosure badges Received 31 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting avia.at website and its users. Following coordinated...

Facebook Agrees to Pay $5 Billion Fine and Setup New Privacy Program for 20 Years

The Federal Trade Commission FTC today officially confirmed that Facebook has agreed to pay a record-breaking $5 billion fine over privacy violations surrounding the Cambridge Analytica scandal. Besides the multibillion-dollar penalty, the company has also accepted a 20-year-long agreement that...

Information about TCP SACK Panic Findings in PAN-OS

Palo Alto Networks is aware of recent vulnerability disclosures known as TCP SACK Panic vulnerabilities. Ref: PAN-119745/ CVE-2019-11477, CVE-2019-11478, CVE-2019-11479...

Microsoft Releases June 2019 Security Updates to Patch 88 Vulnerabilities

After Adobe, the technology giant Microsoft today—on June 2019 Patch Tuesday—also released its monthly batch of software security updates for various supported versions of Windows operating systems and other Microsoft products. This month's security updates include patches for a total of 88...

Nagios XI 5.5.10 XSS / Remote Code Execution Vulnerability

Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim with "autodiscovery job" creation privileges to visit a malicious URL to obtain a remote root shell via a reflected cross site scripting, an authenticated remot...

Microsoft Patch Tuesday — April 2019: Vulnerability disclosures and Snort coverage

Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 74 vulnerabilities, 16 of which are rated “critical” and 58 that are considered “important.” This release also includes a critical advisory...

Reverse Location Search Warrants

The police are increasingly getting search warrants for information about all cell phones in a certain location at a certain time: Police departments across the country have been knocking at Google's door for at least the last two years with warrants to tap into the company's extensive stores of...

Vulnerability disclosure buzzword bingo!

Play Buzzword Bingo With Us! In the last 5 or so years of research we’ve found a substantial number of products with vulnerabilities in their supporting apps and infrastructure, as well as in the devices themselves. Some were low-impact, some were just curiosities, but many critical flaws exposin...

HackerOne: Verbose PHP error messages exposed on a blog article

Hey guys! For what its worth, warning messages aren't suppressed on the /blog/ endpoint, giving verbose PHP error messages when visiting a blog article such as https://www.hackerone.com/blog/H1-702-2018-makes-history-over-500K-bounties-paid. F374066 Impact Not much impact, just disclosures of pat...

Denial Of Service (DoS)

libglusterfs.so is vulnerable to a denial of service DoS attack or information disclosures. The library does not restrict the ../ characters from being passed in pathnames, allowing a malicious user to gain access to file statuses or crash the application with a malformed filename...

Siemens SIMATIC PLCs Reported Issues Summary (Update A)

Overview ICS-CERT has been coordinating multiple reports of issues affecting various models within the Siemens SIMATIC Step 7 S7 programmable logic controller PLC product line. ICS-CERT has coordinated the issues with both Siemens and the researcher and continues to work with both entities. A...

HPESBHF03886 rev.1 - HPE Comware 5 and Comware 7 Switches and Routers using NTP, Remote Denial of Service

Potential Security Impact: Local: Unauthorized Modification; Remote: Denial of Service DoS, Unauthorized Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Switch Fabric Modules Comware 5, Comware 7 HPE 9500 Switch Series Comware 5 HPE FlexFabric 5830...

Information about L1 Terminal Fault findings

Palo Alto Networks is aware of recent vulnerability disclosures, known as L1 Terminal Fault, that affect modern CPU architectures. At this time, our findings show that these vulnerabilities pose no increased risk to Palo Alto Networks PAN-OS devices. CVE-2018-3615, CVE-2018-3620, and CVE-2017-364...

bowlingonline.se XSS vulnerability

Open Bug Bounty ID: OBB-654602 Description| Value ---|--- Affected Website:| bowlingonline.se Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

A Look Inside: Bug Bounties and Pen Testing

As more organizations turn to bug bounty programs, versus penetration testing, to weed out vulnerabilities in their products we ask Christie Terrill, partner at Bishop Fox, what she sees as the pros and cons of either approach. Threatpost’s Lindsey O’Donnell also asks Terrill what kind of compani...

Information Disclosure

h2o-core is vulnerable to information disclosures. The HTTP response headers contain sensitive information such as server version...

wireshark/fuzzshark_ip_proto-udp: Heap-use-after-free in dissect_q931_number_ie

Detailed report: https://oss-fuzz.com/testcase?key=4589130336960512 Project: wireshark Fuzzer: aflwiresharkfuzzsharkipproto-udp Fuzz target binary: fuzzsharkipproto-udp Job Type: aflasanwireshark Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address: 0x60300028f9c8 Crash State:...

The vulnerability of the SAP Business Intelligence software platform, related to the lack of protective measures for SQL queries, allows attackers to alter data, obtain confidential information, cause service failures due to data deletion, or execute administrative operations.

The vulnerability of the SAP Business Intelligence business process management software platform lies in the lack of protective measures for SQL queries. Exploiting this vulnerability allows a malicious actor to modify data, obtain confidential information, cause service failures due to data...

FLIR Systems FLIR Thermal Camera F/FC/PT/D Multiple Information Disclosures

Summary FLIR's PT-Series of high-performance, multi-sensor pan/tilt cameras bring thermal and visible-light imaging together in a system that gives you video and control over both IP and analog networks. The PT-Series' precision pan/tilt mechanism gives you accurate pointing control while providi...

EulerOS 2.0 SP2 : httpd (EulerOS-SA-2017-1178)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that the httpd's modauthdigest module did not properly initialize memory before using it when processing certain headers relate...