Microsoft Windows 10 - SSPI Network Authentication Session 0 Privilege Escalation

Windows: SSPI Network Authentication Session 0 EoP Platform: Windows 10 1803/1809 not tested earlier versions Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: Session boundary Summary: Performing an NTLM authentication to the same machine results in a network...

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on: Ubuntu 18.04 CVE:...

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Date: 12/31/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on...

Microsoft Exchange Server Privilege Modification

The vulnerability of Microsoft Exchange Server is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor, operating remotely, to modify user profiles through a specially crafted request...

Christmas tech scams roundup

There’s a fair few Christmas tech scams floating around out there as 2018 winds up, and we thought it’d be a good time to warn you about them. It’s the usual mish-mash of phone antics, social media shenanigans, and click bait. Shall we begin? This scam looks divine BOOM reports on a collection of...

Apple iOS and tvOS Profiles Certificate Configuration Vulnerability

Apple iOS and tvOS are both products of Apple Inc. Apple iOS is an operating system for mobile devices; tvOS is an operating system for smart TVs. profiles are a component of profiles. A security vulnerability exists in the Profiles component in Apple iOS versions prior to 12.1.1 and tvOS version...

About the security content of tvOS 12.1.1

About the security content of tvOS 12.1.1 This document describes the security content of tvOS 12.1.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Malicious Cryptocurrency Theft

[email protected] is a malicious package. The package displays malicious activities when imported from event-stream, and when used with cryptocurrenty related libraries such as copay-dash where the malicious code in flatmap-stream steals "hot" wallet profiles that were stored from mobile apps,...

November 13, 2018—KB4464455 (OS Build 17763.107)

None None...

WordPress PeepSo 1.11.2 XSS / SQL Injection Vulnerabilities

Exploit for php platform in category web applications WordPress PeepSo 1.11.2 XSS / SQL Injection Vulnerabilities Author: Socket0x03 Alvaro J. Gene Software Link: https://wordpress.org/plugins/peepso-core/ Plugin: PeepSo Version: 1.11.2 File: Members Parameter: query Language: This application is...

X (Formerly Twitter): Global defaming of any twitter user

Private tweets can be used to keep any user's tweet secret from rest of twitter world. Once the user changes his setting from private tweets to public tweets, all his secret tweets become visible. This can become a major issue causing global distributed attacks Steps to Reproduce 1. Assume the...

FaceTime - readSPSandGetDecoderParams Stack Corruption

FaceTime - readSPSandGetDecoderParams Stack Corruption There are a variety of problems that occur when processing malformed H264 streams in readSPSandGetDecoderParams, leading to OOB read, OOB write and stackchk crashes. I think the root cause is stack corruption. This issue can occur if someone...

F5 Networks BIG-IP : TMM vulnerability (K34514540)

Malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default 'normalize URI' configuration options used in iRules and/or BIG-IP LTM policies...

F5 Networks BIG-IP : TMM vulnerability (K55102452)

Undisclosed sequence of packets sent to Virtual Servers with client or server SSL profiles using AES-GCM cipher suitesmay cause disruption of data plane services. CVE-2017-6140 This vulnerability affects the following BIG-IP platforms:2000s,2200s,4000s,4200v,i5600, i5800,i7600, i7800,i10600,...

F5 Networks BIG-IP : TMM vulnerability (K45611803)

F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.1 virtual servers with HTTP/2 profiles enabled are vulnerable to 'HPACK Bomb'. CVE-2018-5530 Impact HPACK bombs are designed to consume an abnormal amount of memory resources on a target system, which can result in a denial of service...

[SECURITY] Fedora 28 Update: sos-collector-1.5-3.fc28

sos-collector is a utility designed to capture sosreports from multiple nod es at once and collect them into a single archive. If the nodes are part of a cluster, profiles can be used to configure how the sosreport command is run on the nodes...

[SECURITY] Fedora 29 Update: sos-collector-1.5-3.fc29

sos-collector is a utility designed to capture sosreports from multiple nod es at once and collect them into a single archive. If the nodes are part of a cluster, profiles can be used to configure how the sosreport command is run on the nodes...

SUSE SLED12 / SLES12 Security Update : lcms2 (SUSE-SU-2018:3545-1)

This update for lcms2 fixes the following security issues : CVE-2016-10165: The TypeMLURead function allowed remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggered an out-of-bounds heap read bsc1021364. CVE-2018-16435...

October 9, 2018—KB4464330 (OS Build 17763.55)

None None...

[SECURITY] Fedora 29 Update: php-tcpdf-6.2.25-1.fc29

PHP class for generating PDF documents. no external libraries are required for the basic functions; all standard page formats, custom page formats, custom margins and units of measure; UTF-8 Unicode and Right-To-Left languages; TrueTypeUnicode, OpenTypeUnicode, TrueType, OpenType, Type1 and CID-0...