vim security update

CentOS Errata and Security Advisory CESA-2016:2972 An update for vim is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

vim: Lack of validation of values for few options results in code exection

A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user running vim...

RHEL 6 / 7 : vim (RHSA-2016:2972)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2972 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: A vulnerability was found in vim in how certain modeline...

ntopng Username Enumeration Vulnerability

ntopng is prone to a username enumeration vulnerability. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

CVE-2016-3841

It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service use-after-free and system crash via a crafted sendmsg system call...

Linux net/packet/af_packet Heap Buffer Overflow DoS

The vulnerability in the net/packet/afpacket.c component of the Linux operating system exists due to insufficient checking of resource states when resources are allowed to be shared among multiple processes. Exploiting this vulnerability can allow an attacker to increase their privileges or cause...

Denial of Service (DoS)

Overview ejs is a popular JavaScript templating engine. Affected versions of the package are vulnerable to Denial of Service by letting the attacker under certain conditions control and override the localNames option causing it to crash. You can read more about this vulnerability on the Snyk blog...

DPAT - Domain Password Audit Tool for Pentesters

This is a python script that will generate password use statistics from password hashes dumped from a domain controller and a password crack file such as oclHashcat.pot generated from the oclHashcat tool during password cracking. The report is an HTML report with clickable links. You can run the...

ShellcodeCompiler - Shellcode C/C++ Compiler for Windows

Shellcode Compiler is a program that compiles C/C++ style code into a small, position-independent and NULL-free shellcode for Windows. It is possible to call any Windows API function in a user-friendly way. Shellcode Compiler takes as input a source file and it uses it's own compiler to interpret...

Security update for java-1_8_0-openjdk (important)

OpenJDK Java was updated to jdk8u111 icedtea 3.2.0 to fix the following issues: Security fixes + S8146490: Direct indirect CRL checks + S8151921: Improved page resolution + S8155968: Update command line options + S8155973, CVE-2016-5542: Tighten jar checks bsc1005522 + S8156794: Extend data shari...

GNU Wget < 1.18 - Access List Bypass / Race Condition Vulnerabilities

Exploit for multiple platform in category remote exploits ''' ============================================= - Discovered by: Dawid Golunski - dawidatlegalhackers.com - https://legalhackers.com - https://legalhackers.com/advisories/Wget-Exploit-ACL-bypass-RaceCond-CVE-2016-7098.html - CVE-2016-709...

Debian DSA-3722-1 : vim - security update

Florian Larysch and Bram Moolenaar discovered that vim, an enhanced vi editor, does not properly validate values for the 'filetype','syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened. %NASLMINLEVEL 70300 C Tenab...

WS-2016-7098

In “Cloudera/Hue”, versions 3.10.0 to 3.11.0 and cdh5.7.0-pr1 to cdh5.9.3-release are vulnerable to XSS in the viewmodel options...

WS-2016-7095

Hue versions 3.10.0 to 3.11.0 and cdh5.7.0-pr1 to cdh5.9.3-release is vulnerable to XSS in the viewmodel options...

[SECURITY] Fedora 25 Update: dracut-044-78.fc25

dracut contains tools to create a bootable initramfs for 2.6 Linux kernels. Unlike existing implementations, dracut does hard-code as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as...

Authenticated WMI Exec Via Powershell

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/powershell' require 'msf/core/post/windows/priv' require 'msf/core/exploit/powershell/dotnet' class MetasploitModule...

LocalTapiola: Option method enabled (viestinta.lahitapiola.fi)

HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are supported by the web server, it represents a request for information about the communication options available on the request/response chain identified by the Request-URI. Domain :...

No payment necessary: Fighting back against ransomware

Note: Read our latest comprehensive report on ransomware: Ransomware 1H 2017 review: Global outbreaks reinforce the value of security hygiene. Any IT professional who’s ever had an experience with malware knows how fast an intrusive attack can happen, and how difficult it can be to educate...

openSUSE Security Update : mysql-community-server (openSUSE-2016-1283)

mysql-community-server was updated to 5.6.34 to fix the following issues : - Changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 34.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 33.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 32.html...

[SECURITY] Fedora 25 Update: pacemaker-1.1.15-3.fc25

Pacemaker is an advanced, scalable High-Availability cluster resource manager for Corosync, CMAN and/or Linux-HA. It supports more than 16 node clusters with significant capabilities for managing resources and dependencies. It will run scripts at initialization, when machines go up or down, when...