UBUNTU-CVE-2019-6110

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server or Man-in-The-Middle attacker can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred...

CVE-2019-6109

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The-Middle attacker can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This...

CVE-2019-6110

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server or Man-in-The-Middle attacker can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred. Mitigation This issue only affects the user...

ok.ru: Privilege Escalation удаляем все созданные ссылки с okl.lt

IDOR at okl.lt allowed to hide links in another user's dashboard. The short link itself remained functional. Уязвимость позволяла скрывать все созданные ссылки другими пользователями в их панеле, но ссылка продолжала работать IDOR at okl.lt allowed to hide links in another user's dashboard. The...

CVE-2018-6178

Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to Hide Chrome Security UI via a crafted Chrome Extension...

CVE-2018-6178: Improper Restriction of Rendered UI Layers or Frames

Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to Hide Chrome Security UI via a crafted Chrome Extension...

December 4, 2018, update for InfoPath 2013 (KB4022181)

None None...

PT-2019-1441

Name of the Vulnerable Software and Affected Versions OpenSSH version 7.9 Description The issue allows a malicious server or Man-in-The-Middle attacker to manipulate the client output, for example, by using ANSI control codes to hide additional files being transferred. This is due to the acceptan...

WordPress Hide My WP Ghost plugin <= 2.0.02 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by Jonas Lejon in the WordPress Hide My WP Ghost plugin versions = 2.0.02. Solution Update the WordPress Hide My WP Ghost plugin to the latest available version at least 2.0.03...

Hide My WP <= 2.0.02 - SQL Injection & Script Injection

Versions below 2.0.03 are vulnerable for SQL Injection and Script Injection. Fixed in version 2.0.03 released on 2018-09-15...

SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2018:2553-1)

This update for ImageMagick fixes the following issues: Security issue fixed : - Hide PS, XPS and PDF coders into /vulnerable bsc1105592 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automaticall...

Newsmaker Interview: Derek Manky on ‘Self-Organizing Botnet Swarms’

For over five years Derek Manky, global security strategist at Fortinet and FortiGuard Labs, has been helping the private and public sector identify and fight cybercrime. His job also includes working with noted groups: Computer Emergency Response, NATO NICP, INTERPOL Expert Working Group and the...

meliora-testlab Plugin stored API Key in plain text

meliora-testlab Plugin stored the API Key in its configuration unencrypted in its global configuration file on the Jenkins controller. This key could be viewed by users with access to the Jenkins controller file system. Additionally, the API key was not masked from view using a password form fiel...

Stealthy Malware Hidden in Images Takes to GoogleUserContent

Malware that uses Exchangeable Image File Format EXIF data to hide its code has migrated to a new platform: GoogleUserContent sites, such as Google+ and blogger forums. In this technique, previously seen on Pastebin and GitHub, hackers embed malicious code within uploaded images – a stealthy...

June 21, 2018—KB4284822 (OS Build 16299.522)

None None...

Educational Ubuntu Linux Rootkit

The rootkit was tested to work on Linux kernels 2.6.32-38 and 4.4.0-22 as provided by Ubuntu in Ubuntu 10.04.4 LTS and Ubuntu 16.04 LTS respectively, but it should be very easy to port to kernels in-between, as well as newer ones. There is some architecture-specific code in the rootkit which is...

DEBIAN-CVE-2018-12088

S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present old versions of the filesystem metadata database as up-to-date, temporarily inject zero-valued bytes into files, or temporarily hide parts of files. This is...

UBUNTU-CVE-2018-1121

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's procpidreaddir returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower...

T9uSX62CBPeacuH

A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...

FakeImageExploiter - Use a Fake image.jpg (hide known file extensions) to exploit targets

This module takes one existing image.jpg and one payload.ps1 input by user and builds a new payload agent.jpg.exe that if executed it will trigger the download of the 2 previous files stored into apache2 image.jpg + payload.ps1 and execute them. This module also changes the agent.exe Icon to matc...