Paragon Initiative Enterprises: Not using Binary::safe* functions for substr/strlen function

Several places in the code don't use Binary::safe or CryptoUtil::safe functions, but use raw functions instead strlen/substr which can act as mbfuncname instead not count bytes for strlen/etc... 1...

Paragon Initiative Enterprises: Missing GIT tag/commit verification in Docker

in: https://github.com/paragonie/airship/blob/master/docker/Dockerfile.airshipL14-L16 RUN git clone https://github.com/jedisct1/libsodium.git /tmp/sodium WORKDIR /tmp/sodium RUN git checkout tags/1.0.10 The code is fetched from Github without one of: 1. signature verification on relevant tag. GPG...

Adobe Patches Nine Code Execution Flaws in Flash Player

Two weeks after rushing out an emergency patch for a zero-day vulnerability, Adobe today released another Flash Player security update. The new release patched nine vulnerabilities, all of which expose the host system to remote code execution. Adobe said it is not aware of public exploits against...

Paragon Initiative Enterprises: DMARC Not found for paragonie.com URGENT

Hi sir, , I am new hacker in hackerone platform I am glad to join paragonie bounty program ..i want to report a very critical bug that is i found DMARC missing for your domain paragonie.com Add DMARC record as soon as possible .. DMARC description Background Email authentication technologies SPF...

Chrome for Android Update

Chrome for Android has been updated to version 54.0.2840.85; the update will be available in Google Play over the next few days. A partial list of changes in this build can be found here. This release fixes some IME regressions discovered in the previous version as well as the following security...

Paragon Initiative Enterprises: [Airship CMS] Local File Inclusion - RST Parser

Airship uses the very useful RST Parser from Gregwar. However, the parser has the RST directive include built-in why it isn't a separate directive per the spec, I don't know. However, as a result, LFI is possible in Airship. I realize this isn't directly Paragonie's code, but since Airship uses...

Keen Lab Takes Down iPhone 6S, Nexus 6P, at Mobile Pwn2Own

Hackers identified a series of vulnerabilities in Android and iOS to take down a Google Nexus 6P and an Apple iPhone 6S this week at Mobile Pwn2Own. The mobile version of the popular hacking challenge, put on by Trend Micro and Tipping Point’s Zero Day Initiative, was held in tandem with the...

VMSA-2016-0015:VMware Horizon View updates address directory traversal vulnerability

VMSA-2016-0015 VMware Horizon View updates address directory traversal vulnerability VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2016-0015 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: VMware Horizon View updates address directory traversa...

flashplugin: multiple issues

CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924 arbitrary code execution Multiple Memory corruption vulnerabilities that could lead to arbitrary code execution have been found...

Stable Channel Update for Desktop

The stable channel has been updated to 53.0.2785.113 for Windows, Mac, and Linux. This will roll out over the coming days/weeks MSI points to M53. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also...

Siemens SINEMA Server Privilege Escalation Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-215-02 Siemens SINEMA Server Privilege Escalation Vulnerability that was published August 2, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 2 -------- Security researcher rgod working...

Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback — Mozilla

An anonymous security researcher working with Trend Micro's Zero Day Initiative reported a buffer overflow in the ClearKey Content Decryption Module CDM used by the Encrypted Media Extensions EME API. This vulnerability can be triggered using a malformed video file due to incorrect error handling...

Paragon Initiative Enterprises: Session Management Issue CMS Airship

Hey, I've found a session management issue in CMS Airship bridge.cspr.ng Issue ---------- When the password of an account is changed from a session, other sessions doesn't expire! Steps to Reproduce + We Need to use two broswers 1. Login to one browser 2. Login to second browser 3. Then change th...

Paragon Initiative Enterprises: Nginx Version Disclosure On Forbidden Page

Hi, PoC 1- Go that link you'll see the version of nginx server https://paragonie.com/static/highlightjs/...

Paragon Initiative Enterprises: Stored Cross-Site-Scripting in CMS Airship's authors profiles

I'm just checking out CMS Airship and some of the security features look pretty nice. Awesome job on that! After clicking around a bit I stumbled however upon a stored XSS vulnerability in the Bridge. As per /bridge/help I use 1.1.0 version installed via Docker, as I couldn't find any reference...

Paragon Initiative Enterprises: Full path disclosure vulnerability on paragonie.com

Sir, I have found a bug which is Full path discloser vulnerability. Vulnerable Point https://paragonie.com/contact my post data...

Coalfire goes to Washington!

Our CEO Larry Jones visited The White House Thursday morning to join with First Lady Michelle Obama and Dr. Biden in the celebration of the Joining Forces initiatives fifth-year anniversary and announce Coalfires pledge to hire and train veterans and military spouses...

Linux Foundation Badge Program Boost Open Source Security

The Linux Foundation says a new Core Infrastructure Initiative CII Best Practices Badge program launched Tuesday will help companies interested in adopting open source technologies evaluate projects based on security, quality and stability. The CII Best Practices Badge does not issue certificates...

Paragon Initiative Enterprises: Vunerability : spf

Heĺlo sir, im an independent security researcher. I found an vunerability in your website Your website https://github.com/paragonie doesn't have valid spf records. To recover this do validate your spf. Sender Policy Framework SPF: This allows you specify which mail servers are allowed to send mai...

Google Chrome Security Update 50.0.2662.75

Google on Wednesday pushed its third Chrome update since the beginning of March, patching a pair of high-severity vulnerabilities in the browser. Yesterday’s update brings Chrome to version 50.0.2662.75 and patched 20 vulnerabilities, according to the Google Chrome Releases blog. Eight of the bug...