bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data...

PT-2021-2408

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 16.0.x through 16.0.1.1 BIG-IP versions 15.1.x through 15.1.2.1 BIG-IP versions 14.1.x through 14.1.4 BIG-IP versions 13.1.x through 13.1.3.6 BIG-IP versions 12.1.x through 12.1.5.3 BIG-IP versions 11.6.x through 11.6.5.3...

Depix - Recovers Passwords From Pixelized Screenshots

Depix is a tool for recovering passwords from pixelized screenshots. This implementation works on pixelized images that were created with a linear box filter. In this article I cover background information on pixelization and similar research. Example python depix.py -p...

SUSE-SU-2020:0087-1 Security update for libsolv, libzypp, zypper

This update for libsolv, libzypp, zypper fixes the following issues: Security issue fixed: - CVE-2019-18900: Fixed assert cookie file that was world readable bsc1158763. Bug fixes - Fixed removing orphaned packages dropped by to-be-installed products bsc1155819. - Adds libzypp API to mark all...

CVE-2019-15137

The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings instead of the permission expressions themselves, which can lead to unintended connections between participants in a Data Distribution Service DDS network...

UBUNTU-CVE-2009-5155

In the GNU C Library aka glibc or libc6 before 2.28, parseregexp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service assertion failure and application exit or trigger an incorrect result by attempting a regular-expression match...

zsh: Stack-based buffer overflow in gen_matches_files() at compctl.c

A buffer overflow flaw was found in the zsh shell auto-complete functionality. A local, unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use auto-complete to traverse the before mentioned path. If the user affect...

Munin - Online Hash Checker For Virustotal And Other Services

Munin is a online hash checker utility that retrieves valuable information from various online sources The current version of Munin queries the following services: Virustotal Malshare HybridAnalysis Note: Munin is based on the script "VT-Checker", which has been maintained in the LOKI repository...

A WordPress SPAMbot Wants You to Bet on the 2018 FIFA World Cup

Our researchers recently picked up on a spike in SPAM activity directed at sites powered by WordPress, which, naturally, led them to take a closer look. Turns out the attack was launched by a botnet and implemented in the form of comment SPAM - meaningless, generic text generated from a template...

PT-2022-2042

Name of the Vulnerable Software and Affected Versions zlib versions 1.2.11 through 1.2.12 Description The issue is related to memory corruption when deflating, i.e., when compressing, if the input has many distant matches. This can lead to a buffer overflow in memory. An attacker could potentiall...

CVE-2018-6465

The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php...

CVE-2018-6465: Improper Neutralization of Input During Web Page Generation

The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php...

PT-2018-17562

Name of the Vulnerable Software and Affected Versions PropertyHive plugin versions prior to 1.4.15 Description The issue allows for XSS via the body parameter to the "includes/admin/views/html-preview-applicant-matches-email.php" endpoint. Recommendations For versions prior to 1.4.15, update to...

hesport.com XSS vulnerability

Vulnerable URL: http://www.hesport.com/matches.html?season=aaaaa%22%3E%3C/title%3E%3C/script%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

CVE-2015-3217

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service stack-based buffer overflow via a crafted regular expression, as demonstrated by /^?:?1\.|^\\W?++$/...

CVE-2016-9850

An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 ar...

Google Chrome CSPSource::schemeMatches Information Disclosure Vulnerability

Google Chrome is a web browsing tool developed by Google. In the CSP implementation of Blink in versions of Google Chrome prior to 52.0.2743.82, the WebKit/Source/core/frame/csp/CSPSource.cpp/CSPSource::schemeMatches function does not apply the http :80 policy to the https : 443 URL, nor does it...

pcre: stack overflow caused by mishandled group empty match (8.38/11)

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service stack-based buffer overflow via a crafted regular expression, as demonstrated by /^?:?1\.|^\\W?++$/...

ntpd Information Disclosure Vulnerability

ntpd Network Time Protocol daemon is an operating system daemon that uses the Network Time Protocol NTP to keep synchronized with the system time of a time server. A security vulnerability exists in ntpd version 4.x before 4.2.8p7 and version 4.3 before 4.3.92. An attacker could exploit the...

Puzzles with Matches - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Puzzles with Matches published at the 'play' market has multiple vulnerabilities...