5953 matches found
DSA-3652-1 imagemagick - security update
Bulletin has no description...
PT-2016-7365 · Imagemagick +2 · Imagemagick +2
Name of the Vulnerable Software and Affected Versions: ImageMagick affected versions not specified Description: The issue allows remote attackers to cause a denial of service out-of-bounds read via a crafted file. This is due to a problem in the coders/meta.c file in ImageMagick. Recommendations:...
[SECURITY] Fedora 23 Update: kernel-4.6.7-200.fc23
The kernel meta package...
GitLab: XSS On meta tags in profile page
The profile page https://gitlab.com/u/ does not properly sanitize quotation marks, allowing for injection of attributes into the meta tags. This allows for redirection to phishing sites and other various nefarious things. I've managed to get my profile page to redirect to Bing by setting my bio t...
[SECURITY] Fedora 23 Update: kernel-4.6.6-200.fc23
The kernel meta package...
OLX: XSS on Meta Tag at https://m.olx.ph
Hi, There is improper validation at q parameter on https://m.olx.ph/ where it can be manipulated by an attacker to include his/her XSS payload to execute javascript code. As example: https://m.olx.ph/all-results?q=0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg"...
[SECURITY] Fedora 23 Update: kernel-4.6.5-200.fc23
The kernel meta package...
[SECURITY] Fedora 24 Update: kernel-4.6.5-300.fc24
The kernel meta package...
SecNews: Querying private posts and changing post meta
Summary --- Unauthenticated user can run arbitrary post queries and insert arbitrary numeric post meta via vulnerable /wp-content/themes/SecNews-NewCustom/functions/ajax.php file. I'm including two exploits in one report because the fix for both is the same, i.e. delete ajax.php. Run arbitrary po...
Torrentz.eu Shuts Down Forever! End of Biggest Torrent Search Engine
Over two weeks after the shutdown of Kickass Torrents and arrest of its admin in Poland, the world's biggest BitTorrent meta-search engine Torrentz.eu has apparently shut down its operation. The surprise shutdown of Torrentz marks the end of an era. Torrentz.eu was a free, fast and powerful...
OpenOffice Impress MetaActions Arbitrary Read/Write Vulnerability
OpenOffice.org is a cross-platform office software suite that runs on Windows, Linux, MacOS X X11 and Solaris. Openoffice has an out-of-bounds vulnerability in the handling of MetaActions. An attacker can trigger the vulnerability by causing out-of-bounds reads and writes with an Open Office...
Wireshark 'erf_meta_read_tag()' Remote Denial of Service Vulnerability
Wireshark is a suite of network packet analysis software developed by the Wireshark team. A security vulnerability in Wireshark 'erfmetareadtag' allows remote attackers to exploit the vulnerability to crash the affected application, resulting in a denial-of-service attack...
CVE-2016-5135
WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information inside an HTML document during a preload request, which allows remote attackers to bypass the Content Security Policy CSP protection mechanis...
[SECURITY] Fedora 24 Update: kernel-4.6.4-301.fc24
The kernel meta package...
[SECURITY] Fedora 23 Update: kernel-4.6.4-201.fc23
The kernel meta package...
PT-2016-3519
Name of the Vulnerable Software and Affected Versions Android versions prior to 2016-07-05 on Nexus 5 and 7 2013 devices Description The issue is related to the vid dec set meta buffers function in the Qualcomm components, which does not validate the number of buffers. This allows attackers to ga...
Whisper: Stored XSS in wis.pr
Hi, I detected a Stored XSS in wis.pr. These are the steps to reproduce the bug: 1. Create a new group named: Test"alert'test'; 2. Copy the sharing URL http://wis.pr/. 3. Open this URL in a browser. Please find the attached screenshots. Fix: Sanitize the output in twitter:description meta. Please...
[SECURITY] Fedora 23 Update: kernel-4.5.7-202.fc23
The kernel meta package...