Using the CTS for vulnerability detection and principles of analysis-vulnerability warning-the black bar safety net

360 Vulpecker team Membership 360 Information Security Department, committed to the Android application and the system-layer vulnerability discovery as well as other Android security research. We passed on the CTS frame of the research, the preparation of a vulnerability detection aspect of the...

Thousands of Security Experts Work Together to Collectively Combat Petya / NotPetya Ransomware Attack

On Tuesday, Carbon Black’s community of security experts began working together with Carbon Black Threat Research to rapidly analyze the new ransomware family that was hitting organizations from Russia to Britain. More than 100 customers and partners communicated IOCs as the attack hit. “I heard...

merton.org XSS vulnerability

Vulnerable URL: http://www.merton.org/Research/Manuscripts/search1.asp?phrase=1"...

litmir.me XSS vulnerability

Vulnerable URL: http://www.litmir.me/bs?Formats=a%27aa%22--%3E%3C/title%3E%3C/script%3E%3Cimg%20src=x%20onerror=prompt%27OPENBUGBOUNTY%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 21.09.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alex...

[SECURITY] [DSA 3886-2] linux regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3886-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 27, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DLA 993-2] linux regression update

Package : linux Version : 3.2.89-2 Debian Bug : 865303 The security update announced as DLA-993-1 caused regressions for some applications using Java - including jsvc, LibreOffice and Scilab - due to the fix for CVE-2017-1000364. Updated packages are now available to correct this issue. For...

Alpine Linux: From vulnerability discovery to code execution

I’ve recently uncovered two critical vulnerabilities in Alpine Linux’s package manager, assigned CVE-2017-9669 and CVE-2017-9671. These vulnerabilities could potentially lead to an attacker executing malicious code on your machines, if you are using Alpine knowingly or implicitly. Alpine Linux is...

Another RCE Vulnerability Patched in Microsoft Malware Protection Engine

Google Project Zero continues to scrape away at the ubiquitous Microsoft Malware Protection Engine at the core of many security products embedded in Windows, and it continues to discover new critical vulnerabilities. The latest, another remote code execution flaw, was patched on Friday after it w...

Microsoft Skype v7.3.6 - Stack Overflow Vulnerability

Document Title: =============== Microsoft Skype v7.3.6 - Stack Overflow Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2071 MSRC ID: 38778 TRK ID: 0461000724 Vulnerability Magazine:...

PT-2018-32: Arbitrary Code Execution in NCR S1

The specialists of the Positive Research center have detected an Arbitrary Code Execution vulnerability in NCR S1. Vulnerability in the NCR S1 Dispenser controller, related to insufficient protection of the memory write mechanism, allows unauthenticated, remote attackers to execute arbitrary code...

RHEL 5 : kernel (RHSA-2017:1482)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1482 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A flaw was found in the way memory was...

Important: Red Hat Security Advisory: Red Hat Container Development Kit 3.0.0 security update

An update is now available for Red Hat Container Development Kit 3.0.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CentOS 7 : kernel (CESA-2017:1484) (Stack Clash)

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CentOS 6 : glibc (CESA-2017:1480) (Stack Clash)

An update for glibc is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Arbitrary File Download Vulnerability in Research Journal General Cms

Research Journal General cms is a research journal content management system of Beijing Magtech Technology Development Co. The cms is vulnerable to an arbitrary file download vulnerability. An attacker can exploit this vulnerability to obtain system information...

CentOS 6 : kernel (CESA-2017:1486) (Stack Clash)

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2017:1484 An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2017:1481 An update for glibc is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2017:1480 An update for glibc is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Tales from the MSRC: from pixels to POC

Is this thing still on? It’s been a while since we’ve posted to this blog and we think it’s time to start posting deep technical content about Security Research & Defense SRD again. For readers who are new or may have forgotten, this blog is the home of the MSRC Vulnerabilities & Mitigations...