Important: glibc

Issue Overview: Fragmentation attacks possible when EDNS0 is enabled The DNS stub resolver in the GNU C Library aka glibc or libc6 before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP...

Web Application Penetration Testing Tool: Tracy

Tracy is a pentesting tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner. tracy should be used during the mapping-the-application phase of the pentest to identify sources of input and their corresponding outputs. tracy...

Jenkins Multiple Vulnerabilities (Apr 2018) - Windows

Jenkins is prone to multiple vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2018-1172

it was found that Squid, when used as a reverse proxy, did not handle ESI responses properly. A malicious web server could use this flaw to crash Squid...

FreeBSD : jenkins -- multiple vulnerabilities (aaba17aa-782e-4843-8a79-7756cfa2bf89)

Jenkins developers report : The Jenkins CLI sent different error responses for commands with view and agent arguments depending on the existence of the specified views or agents to unauthorized users. This allowed attackers to determine whether views or agents with specified names exist. The...

SickRage Information Disclosure Vulnerability

SickRage is an automated video manager for managing and storing TV programs. A security vulnerability exists in versions prior to SickRage v2018.03.09-1, which stems from an HTTP response containing credentials in plaintext form. An attacker could exploit the vulnerability to obtain information...

Hardcoded credentials

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

CVE-2018-9160

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

CVE-2018-9160

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

CVE-2018-9160

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

PYSEC-2018-101

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

PYSEC-2018-101

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

CVE-2018-9160

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

GLSA-201803-10 : collectd: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201803-10 collectd: Multiple vulnerabilities Multiple vulnerabilities have been found in Gentoos collectd package. Please review the referenced CVE identifiers and bug entries for details. Impact : A local attacker, who either is...

USN-3600-1: PHP vulnerabilities

It was discovered that PHP incorrectly handled certain stream metadata. A remote attacker could possibly use this issue to set arbitrary metadata. This issue only affected Ubuntu 14.04 LTS. CVE-2016-10712 It was discovered that PHP incorrectly handled the PHAR 404 error page. A remote attacker...

dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server

An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use this flaw to crash dhclient processes running on DHCP client machines via a crafted DHCP response packet...

Ping Identity: Server-Side Request Forgery on SAML Application - Import via URL

Summary == The My Applications feature on PingOne Identity admin allows you to add new SAML applications to your account. One feature allows you to import metadata via URI instead of via upload. This uses Java 1.8 to make an external web request to the URI supplied. Typically this is hard to...

CVE-2016-0275

IBM Financial Transaction Manager FTM for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager FTM for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager FTM for Corporate Payment Services CPS for...

CVE-2016-0275

IBM Financial Transaction Manager FTM for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager FTM for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager FTM for Corporate Payment Services CPS for...

CVE-2016-0275

IBM Financial Transaction Manager FTM for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager FTM for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager FTM for Corporate Payment Services CPS for...