Cross site request forgery (csrf)

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies...

Facebook (Law Enforcement) - Filter Bypass Vulnerability

Document Title: =============== Facebook Law Enforcement - Filter Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1774 Release Date: ============= 2016-10-01 Vulnerability Laboratory ID VL-ID: ==================================== 177...

CVE-2016-5176

Google Chrome before 53.0.2785.113 allows remote attackers to bypass the SafeBrowsing protection mechanism via unspecified vectors...

CVE-2016-5176

Removed by vendor...

Apple Mac OS X Multiple Vulnerabilities-01 (Sep 2016)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-3375

The OLE Automation mechanism and VBScript scripting engine in Microsoft Internet Explorer 9 through 11, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow remote attackers to...

Google Chrome < 53.0.2785.113 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 53.0.2785.113. It is, therefore, affected by multiple vulnerabilities as referenced in the 201609stable-channel-update-for-desktop13 advisory. - Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.113...

Yelp: Bybass The Closing of the account and logged again to your account

Hello Details: All My accounts have been closed i dnot know the reason so i have played around and manged to bypass this mechanism using the last unused password token Steps: - go to forget password page and get new password reset token and dnot use it - go and make anything against the rules lea...

CVE-2016-4379

The TLS implementation in HPE Integrated Lights-Out 3 aka iLO3 firmware before 1.88 does not properly use a MAC protection mechanism in conjunction with CBC padding, which allows remote attackers to obtain sensitive information via a padding-oracle attack, aka a Vaudenay attack...

BlackHat issues resolved: Windows programs digital signature verification“vulnerability”-vulnerability warning-the black bar safety net

In this year's black hat conference, foreign a security researcher shows how by the Windows digital signature bypass for malicious code detection. Download the General Assembly of the presentation of the ppt probably looked at it, the report is divided into two parts, the first part shows the...

CVE-2016-5430

The RSA 1.5 algorithm implementation in the JOSEJWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...

The vulnerability of the Android operating system, which allows a hacker to trigger a service failure

The vulnerability of the Android operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to trigger a service failure through a specially created application that exploits the app-pinning mechanism...

The vulnerability of the Windows operating system, which allows a perpetrator to bypass the authentication process

The vulnerability of the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures by manipulating the system’s recovery mechanism, thereby enabling them to check the authenticity of the NTLM...

Zabbix SQL injection vulnerability analysis and solution-vulnerability warning-the black bar safety net

Vulnerability scope Where the use Zabbix2. 2. x, 3.0. x website in 3. 0. 4 version have repair may cause the sensitive data leakage, server by a malicious attacker to control and cause more harm. Zabbix description zabbix is a WEB-based interface to provide distributed system monitoring and netwo...

ISPconfig v3.0.5.4p6 - Input Validation Vulnerabilities

Document Title: =============== ISPconfig v3.0.5.4p6 - Input Validation Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1909 Release Date: ============= 2016-08-16 Vulnerability Laboratory ID VL-ID: ==================================== 19...

SonarQube Jenkins Password Disclosure

Advisory Information Title: SonarQube Jenkins Plugin - Plain Text Password Date published: 2013-12-05 Date of last update: 2013-12-05 Vendors contacted : SonarQube and Jenkins CI Discovered by: Christian Catalano Severity: High 2. Vulnerability Information CVE reference: CVE-2013-5676 CVSS v2...

PayPal Inc BB #127 - 2FA Bypass Vulnerability

Document Title: =============== PayPal Inc BB 127 - 2FA Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1903 Release Date: ============= 2016-08-12 Vulnerability Laboratory ID VL-ID: ==================================== 1903 Common...

qpid-cpp: anonymous access to qpidd cannot be prevented

It was discovered that the Qpid daemon qpidd did not restrict access to anonymous users when the ANONYMOUS mechanism was disallowed...

Kovter becomes almost file-less, creates a new file type, and gets some new certificates

Trojan:Win32/Kovter is a well-known click-fraud malware which is challenging to detect and remove because of its file-less persistence on infected PCs. In this blog, we will share some technical details about the latest changes we have seen in Kovter’s persistence method and some updates on their...

Lenovo Accelerator Application Insecure Update Mechanism

Lenovo Security Advisory: LEN-6718 Potential Impact: Remote code execution by an attacker with local network access Severity: High Scope of Impact: Lenovo products described below Summary Description: A vulnerability was identified in the Lenovo Accelerator Application software which could lead t...