August 13, 2019—KB4512516 (OS Build 16299.1331)

None None...

Black Hat 2019 News Wrap: The Best and Worst of the Show

LAS VEGAS – Black Hat and DEF CON 2019 may be wrapping up, but the dual conferences last week in Las Vegas left the security industry with a flurry of new security flaws, topics and announcements to discuss for the weeks to come. Threatpost editors Tara Seals and Lindsey O’Donnell get together to...

ZTE MF910 – An end of life router, running lots of vivacious hidden code

You might be here because you saw our talk at Defcon 27. You might want to watch that for the full rundown! The ZTE MF910 is a really interesting router for reversing, mainly because it’s full of nice debug calls, and underused functionality. Also, it’s never going to get patched, and it’s really...

Security Bulletin: Potential Remote code execution vulnerability in WebSphere Application Server may affect IBM InfoSphere Identity Insight (CVE-2018-1904)

Summary There is a potential remote code execution vulnerability in WebSphere Application Server shipped as part of IBM InfoSphere Identity Insight. Vulnerability Details CVEs: CVE-2018-1904 Link to security bulletin http://www-01.ibm.com/support/docview.wss?uid=ibm10738735 Affected Products and...

Security Bulletin: Code execution vulnerability in WebSphere Application Server may affect IBM InfoSphere Identity Insight (CVE-2018-1567)

Summary There is a potential remote code execution vulnerability in WebSphere Application Server shipped as part of IBM InfoSphere Identity Insight. Vulnerability Details CVEs: CVE-2018-1567 Link to security bulletin: Affected Products and Versions IBM InfoSphere Identity Insight 8.1...

Security Bulletin: Potential spoofing attack in WebSphere Application Server may affect IBM InfoSphere Identity Insight (CVE-2018-1695)

Summary There is a potential spoofing attack in WebSphere Application Server shipped as part of IBM InfoSphere Identity Insight. Vulnerability Details CVEs: CVE-2018-1695 Link to security bulletin: https://www-01.ibm.com/support/docview.wss?uid=ibm10716523 Affected Products and Versions IBM...

IBM Sterling File Gateway SQL Injection Vulnerability

IBM Sterling File Gateway is a suite of file transfer software from IBM in the United States. The software integrates different centers of file transfer activity and facilitates the secure exchange of file-based data over the Internet. An SQL injection vulnerability exists in IBM Sterling File...

libjpeg: "cjpeg" utility large loop because read_pixel in rdtarga.c mishandles EOF

libjpeg 9c has a large loop because readpixel in rdtarga.c mishandles EOF...

mercurial: Missing check for fragment start position in mpatch.c:mpatch_apply()

The mpatchapply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004...

July 9, 2019—KB4507435 (OS Build 17134.885)

None None...

July 9, 2019—KB4507450 (OS Build 15063.1928)

None None...

Apple Suspends Siri Program After Privacy Backlash

Apple is suspending a program that lets contractors listen in on Siri voice recordings after facing a rain of backlash regarding the privacy implications of the program. The suspension comes after a report in The Guardian last week outlining how contractors regularly listen to intimate voice...

(RHSA-2019:2000) Low: Red Hat OpenShift Enterprise final end-of-life notice

As part of the maintenance phase, qualified security patches of Critical or Important impact, as well as select mission-critical bug-fix patches, were released for Red Hat OpenShift Enterprise 3.6 and Red Hat OpenShift Container Platform 3.7. After July 31, 2019, customers will not receive those...

Unauthorized Access Vulnerability in Shaanxi Cloud Enterprise CMS System

Ltd. currently has subsidiaries - Yulin Cloud Enterprise Media Co., Ltd. and Yulin Ali Zongchuang Information Technology Co. Shaanxi Cloud Enterprise CMS system has an unauthorized access vulnerability, attackers can use the vulnerability to directly front-end access to the administrator account...

DEBIAN-CVE-2019-14267

PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is mishandled...

PT-2019-13572 · Pdfresurrect +2 · Pdfresurrect +2

Name of the Vulnerable Software and Affected Versions: PDFResurrect version 0.15 Description: The issue arises from a buffer overflow that occurs when PDFResurrect mishandles data associated with startxref and %%EOF in a crafted PDF file. Recommendations: For PDFResurrect version 0.15, at the...

GigToDo 1.3 - Cross-Site Scripting

GigToDo 1.3 - Cross-Site Scripting Exploit Title: GigToDo - Freelance Marketplace Script v1.3 Persistent XSS Injection Google Dork: - Date: 2019/07/28 Author: m0ze Vendor Homepage: https://www.gigtodoscript.com Software Link: https://codecanyon.net/item/gigtodo-freelance-marketplace-script/238553...

Windows Server 2008 End of Support: Are you Prepared?

On July 14th, 2015, Microsoft’s widely deployed Windows Server 2003 reached end of life after nearly 12 years of support. For millions of enterprise servers, this meant the end of security updates, leaving the door open to serious security risks. Now, we are fast approaching the end of life of...

grapheneX - Automated System Hardening Framework

grapheneX In computing, hardening is usually the process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions; in principle a single-function system is more secure than a multipurpose one. Reducing available ways of attack typically...

(RHSA-2019:1862) Low: Red Hat OpenShift Enterprise one-month end-of-life notice

As part of the maintenance phase, qualified security patches of Critical or Important impact, as well as select mission-critical bug-fix patches, were released for Red Hat OpenShift Enterprise 3.6 and 3.7. After July 31st, 2019, customers will not receive those updates. Red Hat OpenShift Containe...