OPENSUSE-SU-2020:0436-1 Security update for python-nltk

This update for python-nltk fixes the following issues: Update to 3.4.5 boo1146427, CVE-2019-14751: CVE-2019-14751: Fixed Zip slip vulnerability in downloader for the unlikely situation where a user configures their downloader to use a compromised server boo1146427 Update to 3.4.4: fix bug in plo...

Qualys Cloud Platform 3.0 New Features

This release of the Qualys Cloud Platform version 3.0 includes updates and new features for Vulnerability Management, highlights as follows. Vulnerability Management The following features apply to all subscriptions that are currently using the Vulnerability Management Dashboard beta. With this...

Product update: Virtuozzo 7.0 Update 13 (7.0.13-298)

The Update 13 for Virtuozzo 7.0 introduces new features and provides stability and usability bug fixes. It also introduces a new kernel 3.10.0-1062.12.1.vz7.131.10. Vulnerability id: PSBM-95072 'pstorage-target' files are left over after successful migrations of VMs on Virtuozzo Storage from...

One-Lin3r v2.1 - Gives You One-Liners That Aids In Penetration Testing Operations, Privilege Escalation And More

One-Lin3r is simple modular and light-weight framework gives you all the one-liners that you will need while penetration testing Windows, Linux, macOS or even BSD systems or hacking generally with a lot of new features to make all of this fully automated ex: you won't even need to copy the...

UPDATE: Octopus v1.0

Octopus v1.0 is now available. A brief mention about this tool can be found in my previous post titled List of Open Source C2 Post-Exploitation Frameworks. This is the first stable version of Octopus C2 which now supports Cobalt Strike deployment, auto kill functionality, command logging, bug fix...

Fedora 31 : ckeditor (2020-a832c215bf)

CKEditor 4.14 Security Updates: - CVE-2020-9281 Fixed XSS vulnerability in the HTML data processor reported by Micha Bentkowski of Securitum. Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: i switch CKEditor to source mode, then ii paste a specially...

OPENSUSE-SU-2020:0409-1 Security update for python-mysql-connector-python

This update for python-mysql-connector-python fixes the following issues: python-mysql-connector-python was updated to 8.0.19 boo1122204 - CVE-2019-2435: - WL13531: Remove xplugin namespace - WL13372: DNS SRV support - WL12738: Specify TLS ciphers to be used by a client or session - BUG30270760:...

[SECURITY] Fedora 30 Update: ckeditor-4.14.0-1.fc30

CKEditor is a text editor to be used inside web pages. It's a WYSIWYG edito r, which means that the text being edited on it looks as similar as possible to the results users have when publishing it. It brings to the web common edit ing features found on desktop editing applications like Microsoft...

ProjectOpal - Stealth Post-Exploitation Framework For Wordpress

Stealth post-exploitation framework for Wordpress CMS Official ProjectOpal Repository. What is it and why was it made? We intentionally made it for our penetration testing jobs however its getting grey hairs now so we thought we would like to pass it on to the public!. ProjectOpal or Opal. Is a...

TrickBot Mobile App Bypasses 2‐Factor Authentication for Net Banking Services

The malware authors behind TrickBot banking Trojan have developed a new Android app that can intercept one-time authorization codes sent to Internet banking customers via SMS or relatively more secure push notifications, and complete fraudulent transactions. The Android app, called "TrickMo" by I...

Apple Safari Blocks Ad-Targeting Cookie Support

Apple has released an update to its Safari browser that blocks third-party cookies, following an announcement by Google that it would do the same for its Chrome browser. Through the release of Safari 13.1 on Tuesday, alongside some changes to Apple’s Intelligent Tracking Prevention ITP in iOS and...

Unspecified Vulnerability in Samsung Mobile Devices (CNVD-2020-31396)

Android is a free and open source operating system from Google based on the Linux kernel without GNU components. An unspecified vulnerability exists in Samsung mobile devices, which can be exploited by an attacker to turn off some protected features...

CVE-2019-20608

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. An attacker can use Emergency mode to disable features. The Samsung IDs are SVE-2018-13164, SVE-2018-13165 April 2019...

CVE-2019-20608

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. An attacker can use Emergency mode to disable features. The Samsung IDs are SVE-2018-13164, SVE-2018-13165 April 2019...

Design/Logic Flaw

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. An attacker can use Emergency mode to disable features. The Samsung IDs are SVE-2018-13164, SVE-2018-13165 April 2019...

Windows 7 is EOL: What next?

End-of-life EOL is an expression commonly used by software vendors to indicate that a product or version of a product has reached the end of usefulness in the eyes of the vendor. Many companies, including Microsoft, announce the EOL dates for their products far in advance. Every Windows product h...

March 24, 2020—KB4541335 (OS Builds 18362.752 and 18363.752)

None None...

Secured-core PCs: A brief showcase of chip-to-cloud security against kernel attacks

Gaining kernel privileges by taking advantage of legitimate but vulnerable kernel drivers has become an established tool of choice for advanced adversaries. Multiple malware attacks, including RobbinHood, Uroburos, Derusbi, GrayFish, and Sauron, and campaigns by the threat actor STRONTIUM, have...

[SECURITY] Fedora 30 Update: mediawiki-1.32.6-1.fc30

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

GLSA-202003-03 : PostgreSQL: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202003-03 PostgreSQL: Multiple vulnerabilities Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrar...