3891 matches found
[SECURITY] Fedora 27 Update: rust-1.29.1-2.fc27
Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator...
bouncycastle: Information leak in AESFastEngine class
In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak...
Getting the most out of your branch local connection
In our global world of business, organizations often have multiple branch offices spanning every country. Some of these branches are quite large with their own IT infrastructure and personnel, while some are very small with just a few employees. In the past, these branch offices were connected to...
Updated cgit packages fix security vulnerability
Jann Horn discovered a directory traversal vulnerability in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of this flaw to retrieve arbitrary files via a specially crafted request, when 'enable-http-clone=1' default is not turned off...
Compromising Online Accounts by Cracking Voicemail Systems: VoiceMailAutomator
voicemailautomator is a tool that serves as a Proof of Concept for the research I presented at DEF CON 26, “Compromising online accounts by cracking voicemail systems”. voicemailautomator supports two actions: “message” – retrieves and records the newest message in the voicemail system. It return...
Debian DSA-4263-1 : cgit - security update
Jann Horn discovered a directory traversal vulnerability in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of this flaw to retrieve arbitrary files via a specially crafted request, when 'enable-http-clone=1' default is not turned off. C Tenable...
Friday Squid Blogging: Calamari Squid Catching Prey
The calamari squid grabs prey three feet away with its fast tentacles. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Node.js third-party modules: Code Injection Vulnerability in zombie Package
I would like to report a code injection vulnerability in zombie. It allows crawled websites to access privileged APIs such as the file system or child process. Module module name: zombie version: 6.1.2 npm page: https://www.npmjs.com/package/zombie Module Description Insanely fast, headless...
Allok Fast AVI MPEG Splitter 1.2 SEH Overwrite Exploit
Exploit for windows platform in category dos / poc !/usr/bin/env python Exploit Title : Allok Fast AVI MPEG Splitter 1.2 SEH Overwrite POC Vulnerability Type: SEH Overwrite POC Discovery by : Shubham Singh Known As : Spirited Wolf Twitter: @Pwsecspirit Email : email protected Youtube Channel :...
Allok Fast AVI MPEG Splitter 1.2 - Buffer Overflow (PoC)
Allok Fast AVI MPEG Splitter 1.2 - Buffer Overflow PoC Exploit Title: Allok Fast AVI MPEG Splitter 1.2 SEH Overwrite POC Vulnerability Type: SEH Overwrite POC Discovery by: Shubham Singh Known As: Spirited Wolf Twitter: @Pwsecspirit Discovey Date: 2018-08-01 Software Link:...
Allok Fast AVI MPEG Splitter 1.2 SEH Overwrite
!/usr/bin/env python Exploit Title : Allok Fast AVI MPEG Splitter 1.2 SEH Overwrite POC Vulnerability Type: SEH Overwrite POC Discovery by : Shubham Singh Known As : Spirited Wolf Twitter: @Pwsecspirit Email : [email protected] Youtube Channel : www.youtube.com/c/Pentestingwithspirit...
Allok Fast AVI MPEG Splitter 1.2 - Buffer Overflow (PoC)
Exploit Title: Allok Fast AVI MPEG Splitter 1.2 SEH Overwrite POC Vulnerability Type: SEH Overwrite POC Discovery by: Shubham Singh Known As: Spirited Wolf Twitter: @Pwsecspirit Discovey Date: 2018-08-01 Software Link: http://www.alloksoft.com/fastsplitter.htm Tested Version: 1.2 Tested on OS:...
[SECURITY] Fedora 27 Update: suricata-4.0.5-1.fc27
The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-threading, Automatic...
Be like a Moomin: How to establish trust between competitors so we can fight cybercrime
Do you know the Moomins? They're a tight-knit, happy, collaborative cartoon family. I'd never heard of them until I was lucky enough to spend a few days at the Microsoft offices in Helsinki, Finland. The Moomin keychain in the photo was a gift from the Finnish CISO. As I did a little research int...
GHSA-9FRQ-F867-HGQC Directory Traversal in fast-http-cli
fast-http-cli is the command line interface for fast-http, a simple web server. fast-http-cli is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Example request: http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:...
Directory Traversal in fast-http-cli
fast-http-cli is the command line interface for fast-http, a simple web server. fast-http-cli is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Example request: http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:...
ARE YOU LEAVING YOUR SECURITY BACKDOOR OPEN?
Gartner predicts that enterprises will spend $96 Billion on cyber security this year, up 8% from their spend in 2017. That's a big chunk of change. To put it into context, that spend is in the same ballpark as the individual GDPs of Venezuela, Sri Lanka and Puerto Rico in 2018. Despite this,...
[SECURITY] Fedora 28 Update: rust-1.27.1-2.fc28
Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator...
Fast C++ CSV Parser Buffer Error Vulnerability
Fast C++ CSV Parser a.k.a. fast-cpp-csv-parser is a parser written in C++ for reading comma separated value CSV files. Fast C++ CSV Parser A heap buffer overflow vulnerability exists in the 'io::trimchars' function of the csv.h file in versions prior to 2018-07-06. An attacker can exploit this...
