Legal Robot: Rate limiting on Email confirmation link

Security researcher discovered a potential issue where no rate limiting was applied to sensitive functions, like email reconfirmation links...

Tor: [tor] pre-emptive defenses, potential vulnerabilities

Replacing all tormalloc calls with torcalloc and tormalloczero ============================================================== Zeroing memory upon allocating it will prevent vulnerabilities that consist of transmitting data buffers which are not wholly initialized with the intended data or contain...

HackerOne: Report title and issue information prepopulated

I think this may be N/A to the bounty program but I'm seeing a weird situation so just wanted to at least flag as I'm not sure what is causing it in the event it's something worth you looking into... Working through possible exploits on █████ last night, I entered some code to try and have their...

DLA-393-1 srtp - security update

Bulletin has no description...

SQL Injection Scanning Attempt (CVE-2022-27412)

Remote attackers use SQL injection scanning in order to locate potential SQL injection vulnerabilities on a target server, which could be later used for attacks...

softdebut.com Open Redirect vulnerability

Vulnerable URL: http://www.softdebut.com/CMSModules/BannerManagement/CMSPages/BannerRedirect.ashx?bannerID=244=http%3A%2F%2Fwww.xssposed.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly...

Integer overflow allocating extremely large textures — Mozilla

Security researcher Abhishek Arya Inferno of the Google Chrome Security Team used the Address Sanitizer tool to discover an integer overflow when when allocating textures of extremely larges sizes during graphics operations. This results in a potentially exploitable crash when triggered...

Adobe Flash Player Days Numbered

If there’s unanimity among security professionals in anything, it’s in their loathing of Adobe’s Flash Player. There’s yet to be an APT or exploit kit that hasn’t welcomed vulnerabilities in the development platform with open arms. And for all that misery tallied up in lost intellectual property...

[SECURITY] [DLA 349-1] python-django security update

Package : python-django Version : 1.2.3-3+squeeze15 CVE ID : CVE-2015-8213 It was discovered that there was a potential settings leak in date template filter of Django, a web-development framework. If an application allows users to specify an unvalidated format for dates and passes this format to...

Security Advisory - Information Leak Vulnerability in FusionCompute Products

There is a vulnerability in FusionCompute that enables common users to query unauthorized information. An attacker can exploit this vulnerability to query other users' information, leading to information leaks. Vulnerability ID: HWPSIRT-2015-10048 This vulnerability has been assigned Common...

Encrypt - Moderately Critical - Weak Encryption - SA-CONTRIB-2015-166

This module enables you to encrypt data within Drupal using a user-configurable encryption method and key provider. The module did not sufficiently validate good configurations and api usage resulting in multiple potential weaknesses depending on module usage. The default encryption method could...

iBackDoor: High-Risk Code Hits iOS Apps

Introduction FireEye mobile researchers recently discovered potentially “backdoored” versions of an ad library embedded in thousands of iOS apps originally published in the Apple App Store. The affected versions of this library embedded functionality in iOS apps that used the library to display...

nss and nspr security update

nspr 4.10.8-2 - Resolves: Bug 1269359 - CVE-2015-7183 - nspr: heap-buffer overflow in PLARENAALLOCATE can lead to crash under ASAN, potential memory corruption rhel-5.11.z nss 3.19.1-2 - Resolves: Bug 1269354 - CVE-2015-7182 CVE-2015-7181...

A Different Spin on the Air War Against IS

Sunday evening 60 Minutes aired a segment titled Inside the Air War. The correspondent was David Martin, whose biography includes the fact that he served as a naval officer during the Vietnam War. The piece concluded with the following exchange and commentary: On the day we watched the B-1 strike...

Twitter Open Sources 'Diffy' that Automatically Catches Potential Bugs in Code

After, Facebook open sourced Thrift Technology an internally used tool by Facebook in 2007, rival entity Twitter brings Diffy, an internal Twitter service to the world. Yesterday, Twitter introduced "Diffy," an open source tool, acting as a helping hand for the software developers to catch bugs,...

Microsoft Office 2007 - wwlib.dll Type Confusion (MS15-081)

Microsoft Office 2007 - wwlib.dll Type Confusion MS15-081 Source: https://code.google.com/p/google-security-research/issues/detail?id=423&can=1 The following crash was observed in Microsoft Office 2007 with Microsoft Office File Validation Add-In disabled and Application Verifier enabled for...

Discuz! X-Series remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

0x01 vulnerability root causes The root of the problem is that the api/uc. php file in the updatebadwords method, the code is as follows: function updatebadwords$get, $post global $G; if! APIUPDATEBADWORDS return APIRETURNFORBIDDEN; $data = array; ifisarray$post foreach$post as $k = $v...

Debian: Security Advisory (DSA-3332-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ShopEx服务器配置不当（可shell可泄漏内外信息）

简要描述： 第一次来玩这个站。。。 详细说明： fastcgi的9000端口问题，是shopex的爬虫服务器 然后确定ip地址 看看arp信息 虽然域名是sarShopEx 漏洞证明： 查看passwd文件。。。 通过hosts文件得知域名是sradar.cn下的二级域名，该域名也是属于shopEx的。。。...

OpenDNS BGP Stream Twitter Feed

Enterprises in the throes of a denial-of-service attack, or suspicious about the integrity of their Internet traffic, will soon have a free data feed available that cuts through the noise produced by normal Internet routing over BGP, the Border Gateway Protocol. During next month’s Black Hat...