CVE-2016-0397

CVE-2016-0397 - IBM BigFix Platform (WebReports) : WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x prior to 9.5.2 allows remote attackers to obtain sensitive information by sniffing unencrypted HTTP traffic. The description specifies the affected product and version range...

SQL injection vulnerability in the info_id parameter of PlacardView.aspx page of OA system of Shanghai Shuang Yang Computer Hi-Tech Development Co.

Shanghai Shuang Yang Computer Hi-Tech Development Company Shuang Yang for short is a high-tech enterprise mainly engaged in application software development and system integration. The product /DSOATY/FromBaoShan/LaborSpecial/PlacardView.aspx?infoid=1 at the existence of SQL injection...

【Warning Notice】IOS remote jailbreak APT attack security a threat-vulnerability warning-the black bar safety net

! IOS remote jailbreak APT attacks Apple yesterday for IOS released a security update that relates to three 0 day vulnerability, this vulnerability discovery process from the primary APT attack begins. We need to note that, the hacker through the loopholes for remote control and get for IOS users...

Khan Academy: Sensitive information/action is stored/done is done using a GET request

Description: The action to remove an email from account is done using a GET request and it has security token. The URL is : https://www.khanacademy.org/settings/unlinkaccount?email=134hackerone%40gmail.com&fkey= It is never a good practice to have sensitive information in URL. Following are the...

Certly: Non secure requests at guard.certly.io not upgrading to https

The issue is of http requests not upgrading to https at before mentioned domain. Thus can allow an attack to steal important info like credentials and all other type of info. Your domain is hsts preloaded so automatically upgraded to https , but the browsers who don't have this mentioned support...

Mail.ru: [cfire.mail.ru] CSRF Bypassed - Changing anyone's 'User Info'

Hi, I noticed that when we change userinfo of https://cfire.mail.ru from here: https://cfire.mail.ru/account/userinfo, there are two Anti-CSRF tokens or you can say that; they just do the work of Anti-CSRF token: - signature - submit2 Actually, I was able to bypass both Anti-CSRF tokens, and afte...

Harvest: Extracting private info of estimates.

Hey there, So when someone creates a new estimate for a client it is not accessible to anyone except the admin and the person with the private URL of the web invoice. Now their is an option to convert estimate into invoice through https://amandhakertest.harvestapp.com/invoices/new?estimateid=IDHE...

Omegle, the Popular 'Chat with Strangers' Service Leaks Your Dirty Chats and Personal Info

Ever since the creation of online chat rooms and then social networking, people have changed the way they interact with their friends and associates. However, when it comes to anonymous chatting services, you don't even know what kinds of individuals you are dealing with. Sharing identifiable...

Internet Bug Bounty: stack buffer overflows in the curses module

I found two stack buffer overflows in the curses module. These vulnerabilities have been reported to the PSRT and were fixed here: https://hg.python.org/cpython/rev/d5f6bc45b376 https://hg.python.org/cpython/rev/85b35300f200 Below are copies of the mails I sent to the PSRT. They describe the...

openSUSE Security Update : libarchive (openSUSE-2016-969)

libarchive was updated to fix 20 security issues. These security issues were fixed : - CVE-2015-8918: Overlapping memcpy in CAB parser bsc985698. - CVE-2015-8919: Heap out of bounds read in LHA/LZH parser bsc985697. - CVE-2015-8920: Stack out of bounds read in ar parser bsc985675. - CVE-2015-8921...

MS16-099: Description of the security update for OneNote 2013: August 9, 2016

MS16-099: Description of the security update for OneNote 2013: August 9, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...

CVE-2016-0280

Cross-site scripting XSS vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2, Information Server Framework and InfoSphere Information Server Business Glossary 9.1 before 9.1.2.0, Information Server...

CVE-2016-0280

Cross-site scripting XSS vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2, Information Server Framework and InfoSphere Information Server Business Glossary 9.1 before 9.1.2.0, Information Server...

The recent spate broke the Telegram vulnerabilities in the end is how is it-vulnerability warning-the black bar safety net

! Recently these two days, known as the“most secure”Messaging app Telegram of successive burst of Vulnerability, in turn, is the clipboard information disclosure, and is 1 of 5 0 0 million Iranian users phone number the exposure and how this two vulnerabilities are more dangerous? Exploit 1: To...

Gratipay: nginx version disclosure on downloads.gratipay.com

Hello, Navigating to http://downloads.gratipay.com/Error goes to a 404 error page disclosing your Nginx version. Server information should be protected since anyone with a bad intent on would try to find exploit for the specified server version. Thanks, Footstep...

Stack overflow

gdxbm.c in the GD Graphics Library aka libgd before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service stack-based buffer under-read and application crash via a long name...

CVE-2014-9883

Integer overflow in drivers/char/diag/diagdci.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 2013 devices allows attackers to gain privileges or obtain sensitive information via a crafted application, aka Android internal bug 28769912 and Qualcomm internal bug CR565160...

Set Reporting Items for Nessus Agents

Nessus was able to determine information about the agent host. This plugin, which does not show up in the report, reports information for this host as an XML tag in the Nessus reports. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid92756; scriptversion"1.6";...

[SECURITY] Fedora 23 Update: kf5-kcoreaddons-5.24.0-1.fc23

KCoreAddons provides classes built on top of QtCore to perform various tasks such as manipulating mime types, autosaving files, creating backup files, generating random sequences, performing text manipulations such as macro replacement, accessing user information and many more...

PT-2016-5538 · Oracle · Oracle Agile Plm

Name of the Vulnerable Software and Affected Versions: Oracle Agile PLM versions 9.3.4 through 9.3.5 Description: The issue affects confidentiality and integrity, and it can be exploited remotely. The vulnerability is related to vectors involving PC and Get Shortcut. Recommendations: For versions...