CVE-2018-14636

The CVE-2018-14636 issue affects OpenStack Neutron components vulnerable to an eavesdropping risk during live migration. When live-migrated, the Open vSwitch integration bridge can remain connected to the guest being migrated, exposing traffic from all instances sharing the same OVS instance. The...

CVE-2018-14636

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due ...

mp3cool3.live XSS vulnerability

Open Bug Bounty ID: OBB-673571 Description| Value ---|--- Affected Website:| mp3cool3.live Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

How Live Query Will Change The Way You Do Vulnerability Management

It’s no secret that, without the right set of tools, vulnerability management can be tedious and exhausting. With slow, manual processes it can take weeks to identify and remediate issues. And the work itself is often dull, sifting and searching without yielding real results. Live Query...

Bumble: Расшифровка всех типов шифрованных ID

Привет! Обнаружил багу, которая позволяет очень серьезно обойти логику сайта. Данная уязвимость позволяет расшифровать любой зашифрованный ID, который идентифицирует профиль пользователя. Для каждого пользователя генерируется несколько видов ID, например для отображения в "Знакоства", "Live...

kingboss.live XSS vulnerability

Open Bug Bounty ID: OBB-667982 Description| Value ---|--- Affected Website:| kingboss.live Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CentOS 7 : qemu-kvm (CESA-2018:2462)

An update for qemu-kvm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Important: Red Hat Security Advisory: qemu-kvm security and bug fix update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Hardcoded credentials

Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

Security update for libvirt (moderate)

This update for libvirt fixes the following issues: Security issue fixed: - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka "Memory Disambiguation" bsc1092885. Bug fixes: - bsc1094325: Enable virsh blockresize for XEN guests...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2018:2304-1) (Spectre)

This update for libvirt fixes the following issues: Security issue fixed : - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka 'Memory Disambiguation' bsc1092885. Bug fixes : - bsc1094325: Enable virsh blockresize for XEN guests...

openSUSE Security Update : libvirt (openSUSE-2018-860) (Spectre)

This update for libvirt fixes the following issues : Security issue fixed : - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka 'Memory Disambiguation' bsc1092885. Bug fixes : - bsc1094325: Enable virsh blockresize for XEN guests...

SUSE-SU-2018:2304-1 Security update for libvirt

This update for libvirt fixes the following issues: Security issue fixed: - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka 'Memory Disambiguation' bsc1092885. Bug fixes: - bsc1094325: Enable virsh blockresize for XEN guests...

Case Study: A Cryptomining Attack — With an Assist From Advanced Malware Techniques

In Carbon Black's Quarterly Incident Response Threat Report QIRTR, some of the world’s leading incident response IR professionals reported seeing an uptick in lateral movement, counter incident response, and island-hopping attacks from motivated nation-states. In the case study below, Kroll notes...

Flaw in Swann smart security cameras allows access to user’s live stream

By Waqas Security cameras and other IoT devices have been frequently identified to be incompetent and plagued with a variety of built-in flaws that render them vulnerable to exploitation by hackers. The same has been proven yet again by a team of security researchers from Pen Test Partners...

Open redirect

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default by director listening on 0.0.0.0 all interfaces with no-authentication or encryption. Anyone able to make a TCP connection to any comput...

CVE-2017-2637

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default by director listening on 0.0.0.0 all interfaces with no-authentication or encryption. Anyone able to make a TCP connection to any comput...

CVE-2017-2637

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default by director listening on 0.0.0.0 all interfaces with no-authentication or encryption. Anyone able to make a TCP connection to any comput...

CVE-2017-2637

CVE-2017-2637 describes a design flaw in the Red Hat OpenStack Platform director’s use of TripleO for enabling libvirtd live-migration. Libvirtd is deployed by default and listens on 0.0.0.0 with no authentication or encryption. A remote actor who can reach any compute host IP (including localhos...

CVE-2017-2637

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default by director listening on 0.0.0.0 all interfaces with no-authentication or encryption. Anyone able to make a TCP connection to any comput...