Micro Focus Rumba FTP Client 4.x Stack Overflow

Exploit Title: Rumba FTP Client 4.x stack overflow SEH Date: 29-10-2016 Exploit Author: Umit Aksu Vendor Homepage: http://community.microfocus.com/microfocus/mainframesolutions/rumba/w/knowledgebase/28731.rumba-ftp-4-x-security-update.aspx Software Link:...

CVE-2016-8339

A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG S...

CVE-2016-8339: Out-of-bounds Write

A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG S...

SOL38110373 - Apache Tomcat vulnerability CVE-2014-7810

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Shopify: race condition in adding team members

The researcher reported a race condition when adding new staff members that would allow bypassing the staff account limit for all plans. We fixed this issue by adding an exclusive lock around the account creation process. Note: Shopify no longer accepts reports regarding race conditions bypassing...

FreePBX Recordings Backdoor Upload

Added: 10/14/2016 Background FreePBX is a web-based open-source graphical user interface used to manage Asterisk PBX, an open-source communication server. The FreePBX System Recordings module allows playback of recorded files. Problem The System Recordings module in FreePBX 13 and 14 is vulnerabl...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3626)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-3626 advisory. kernel-uek 4.1.12-61.1.14 - net: add recursion limit to GRO Sabrina Dubroca Orabug: 24829133 CVE-2016-7039 Tenable has extracted the preceding description...

How to Limit One Session Per User on NetScaler Gateway?

This article describes how to limit one session per user on NetScaler Gateway. Use case An administrator wants to ensure that at any point in time a given user can only have one active session with NetScaler Gateway. Administrators can use a session policy or the global NetScaler Gateway settings...

Simple Blog PHP 2.0 - Multiple Vulnerabilities

Simple Blog PHP 2.0 - Multiple Vulnerabilities ===================================================== Simple Blog PHP 2.0 - CSRFAdd Post // Stored XSS ===================================================== Vendor Homepage: http://simpleblogphp.com/ Date: 13 Oct 2016 Demo Link :...

Unbreakable Enterprise kernel security update

kernel-uek 4.1.12-61.1.14 - net: add recursion limit to GRO Sabrina Dubroca Orabug: 24829133 CVE-2016-7039...

CVE-2015-5162

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service memory and disk consumption via a crafted disk image...

Nextcloud: Bypassing quota limit

Hi an user can upload files despite having a limited quota by changing value of "OC-Total-Length" in header to "A" or adding "X-Expected-Entity-Length" in header with "A" value in normal insuffisant storage we have: PUT /remote.php/webdav/a.jpg HTTP/1.1 Content-Type: application/octet-stream...

Redis CONFIG SET client-output-buffer-limit command Code Execution Vulnerability

Summary An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution. Tested Versions...

kernel: challenge ACK counter information disclosure.

It was found that the RFC 5961 challenge ACK rate limiting as implemented in the Linux kernel's networking subsystem allowed an off-path attacker to leak certain information about a given connection by creating congestion on the global challenge ACK rate limit counter and then measuring the chang...

SUSE-SU-2016:2388-1 Security update for openssh

This update for OpenSSH fixes the following issues: - Prevent user enumeration through the timing of password processing. bsc989363, CVE-2016-6210 - Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used. bsc948902 - Sanitize input for xauth1. bsc970632...

Algolia: No rate limit for Referral Program

Hi, It is possible to bombard the referral requests to the same email any number of times. Thanks,...

MyBB 1.8.6 - SQL Injection

MyBB 1.8.6 - SQL Injection Security Advisory - Curesec Research Team 1. Introduction Affected Product: MyBB 1.8.6 Fixed in: 1.8.7 Fixed Version Link: http://resources.mybb.com/downloads/mybb1807.zip Vendor Website: http://www.mybb.com/ Vulnerability Type: SQL Injection Remote Exploitable: Yes...

Vulnerability of the microprogramming software of the Onecell G3100v2 and Onecell G3001 modems, allowing a intruder to gain access to the device

The vulnerability of the microprogrammed software of the Onecell G3100v2 and Onecell G3001 modems lies in the improper limitation on the number of authentication attempts. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device through a...

Internet Bug Bounty: SEH buffer overflow msgfmt_format_message

Upstream bug --------------- https://bugs.php.net/bug.php?id=73007 Fixed in PHP 7.0.11 and PHP 5.6.26 --------------- http://php.net/ChangeLog-5.php5.6.26 http://php.net/ChangeLog-7.php7.0.11 Patch ------- http://git.php.net/?p=php-src.git;a=commit;h=20fa323d53257a776bd7551ce7bdb2261cfe5420...

MGASA-2016-0305 Updated mediawiki packages fix security vulnerability

Check read permission when loading page content in ApiParse CVE-2016-6331 Make blocks log users out if $wgBlockDisablesLogin is true CVE-2016-6332 Make $wgBlockDisablesLogin also restrict logged in permissions CVE-2016-6332 Require login to preview user CSS pages CVE-2016-6333 Escape '' in inline...