Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 61 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 61.0.3163.79 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

CVE-2017-10793

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive...

CVE-2017-10793

The CVE-2017-10793 entry concerns AT&T U-verse firmware 9.2.2h0d83 on Arris NVG589/NVG599 (and related devices). The issue arises when IP Passthrough is not used, where an sbdc.ha WAN TCP service on port 61001 is configured with bdctest credentials, enabling remote attackers to retrieve sensitive...

CVE-2017-10793

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive...

The vulnerability in the task management of the 1x Android operating system from the CAF repository allows a perpetrator to compromise privacy, integrity, and accessibility.

The vulnerability in the task management of the 1x Android operating system arises from reading beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to compromise privacy, integrity, and accessibility...

The vulnerability in the task management of the 1x Android operating system from the CAF repository allows a attacker to trigger a buffer overflow.

Vulnerability of task management in the 1x Android operating system from the CAF repository. Exploiting this vulnerability can allow a malicious actor to trigger buffer overflows during task processing...

The vulnerability of the Android operating system in the CAF repository exists due to errors in processing QMI messages, allowing a perpetrator to compromise privacy, integrity, and accessibility.

The vulnerability of the Android operating system from the CAF repository is related to buffer overflow. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise the confidentiality, integrity, and accessibility of QMI messages during processing...

The vulnerability of the Android operating system from the CAF repository exists due to pointer assignment errors, allowing attackers to cause memory corruption.

The vulnerability of the Android operating system from the CAF repository is related to pointer assignment errors. Exploiting this vulnerability can allow a remote attacker to cause memory corruption in the Guest OS...

The vulnerability of the Android operating system from the CAF repository exists due to errors in WCDMA configuration settings. This allows a perpetrator to compromise privacy, integrity, and accessibility.

The vulnerability of the Android operating system from the CAF repository is related to buffer overflow. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise privacy, integrity, and accessibility when setting the WCDMA mode...

The vulnerability of the Android operating system from the CAF repository exists due to the lack of memory cleanup for buffers, allowing attackers to trigger resource exhaustion.

The vulnerability of the Android operating system from the CAF repository is related to the absence of a memory release mechanism after use. Exploiting this vulnerability allows a remote attacker to cause resource exhaustion...

The vulnerability of the Android operating system from the CAF repository exists due to the lack of checks on buffer size, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Android operating system from the CAF repository arises from the lack of checks for buffer sizes in mechanisms designed to protect against malicious software. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and...

The vulnerability in the IMS multimedia message transmission subsystem of the RCS standard in the Android CAF-release operating system allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the IMS multimedia message transmission subsystem of the RCS standard in the Android operating system’s CAF builds is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and...

The Next Generation of the Rapid7 Community

Rapid7s community is evolving! For the past several years, community.rapid7.com has been our platform for news and knowledge spanning blogs, questions, discussion, and documentation. We have tried to ensure that our community site has been a source of pragmatic, down-to-earth information and...

XSS Radar: Discover Cross Site Scripting with A Chrome Extension

PenTestIT RSS Feed If you remember, there used to an add-on for Firefox - XSS Me; which unfortunately no longer works out of the box for the latest versions of the browser. It was also a part of the Firefox Addons for helping you with web application penetration testing. We now have something...

forum.glowing.com Open Redirect vulnerability

Vulnerable URL: https://forum.glowing.com/linkredirect?targeturl=http://openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 19.11.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...

WordPress Asgaros Forum Plugin <= 1.5.8 - Settings Change Vulnerability

In the file /admin/admin.php, it's missing a CSRF check for settings saving. Solution Update the plugin...

austria-forum.org XSS vulnerability

Vulnerable URL: https://austria-forum.org/Search.jsp?category=AEIOU=userdefined=name=y=%22%3E%3Csvg/onload=alert/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

CVE-2017-10057

Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products subcomponent: Discussion Forum. The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

Microsoft to remove WoSign and StartCom certificates in Windows 10

Microsoft has concluded that the Chinese Certificate Authorities CAs WoSign and StartCom have failed to maintain the standards required by our Trusted Root Program. Observed unacceptable security practices include back-dating SHA-1 certificates, mis-issuances of certificates, accidental certifica...

Oracle PeopleSoft Enterprise PRTL Interaction Hub Remote Vulnerability (CNVD-2017-27314)

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle that provides human capital management, financial management, supplier relationship management, and more.PeopleSoft Enterprise PRTL Interaction Hub is one of the enterprise and Customer Interaction...