USN-2869-1 openssh vulnerabilities

It was discovered that the OpenSSH client experimental support for resuming connections contained multiple security issues. A malicious server could use this issue to leak client memory to the server, including private client user keys...

[SECURITY] Fedora 21 Update: imapsync-1.644-2.fc21

imapsync is a tool for facilitating incremental recursive IMAP transfers from one mailbox to another. It is useful for mailbox migration, and reduces the amount of data transferred by only copying messages that are not present on both servers. Read, unread, and deleted flags are preser ved, and t...

PT-2015-7712

Name of the Vulnerable Software and Affected Versions ARM mbed TLS versions 1.3.x through 1.3.13 ARM mbed TLS versions 2.x through 2.1.1 Description The issue is related to a heap-based buffer overflow in ARM mbed TLS, which can be triggered by remote SSL servers. This occurs when a long session...

Threat Outbreak Alert RuleID17960: Email Messages Distributing Malicious Software on September 13, 2015

Medium Alert ID: 40988 First Published: 2015 September 14 13:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17960 may contain the following files: Name ...

Threat Outbreak Alert RuleID17941: Email Messages Distributing Malicious Software on September 11, 2015

Medium Alert ID: 40973 First Published: 2015 September 11 20:28 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17941 may contain the following files: Name ...

Threat Outbreak Alert RuleID17687: Email Messages Distributing Malicious Software on September 1, 2015

Medium Alert ID: 40760 First Published: 2015 September 2 13:41 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17687 may contain the following files: Name |...

Configuration Bypass During S3 Resume

Summary: System firmware of certain products does not completely protect platform configuration data. Description: During resume from sleep, system firmware needs to reinitialize hardware to a secured configuration. In order to protect against malware that has already compromised an OS, firmware...

Multiple Dell devices vulnerable

Dell Latitude, etc. are the products of the United States Dell Dell company.Dell Latitude and OptiPlex are notebook product models; Precision Mobile Workstation is a precision mobile workstation; Precision Workstation CS is a set of mobile workstation Client; BIOS Basic Input-Output System is a s...

PHPYun越权修改简历状态

简要描述： PHPYUN 未授权修改企业发布招聘 详细说明： 在wap/member/com.class.php 中的 function jobsetaction if$GET'status' $this-obj-updateonce'companyjob',array'status'=intval$GET'status',array'id'=intval$GET'id';//未授权修改企业发布招聘状态 $this-memberlog"修改职位招聘状态"; $this-waplayermsg"设置成功！"; 利用url如下...

php云人才系统越权替换简历

简要描述： RT 详细说明： 版本：PHPYUN人才招聘系统4.0beta 说明：简历创建的方式有两种，直接创建跟在线黏贴，问题出在，修改在线黏贴的简历 文件位置：\upload\member\user\model\expectq.class.php function saveaction if$POST'submit' $eid=int$POST'eid'; $data'doc'=strreplace"&","&",htmlentitydecode$POST'doc',ENTQUOTES,"GB2312"; $POST'lastupdate'=mktime;...

Apple OS X EFI Flash Modification Vulnerability

Apple Mac OS X is an operating system developed by Apple Inc. Apple Mac OS X has a security vulnerability that allows root privileged applications to modify EFI flash memory by failing to adequately lock the EIF flash memory when resuming from hibernation...

[SECURITY] Fedora 22 Update: curl-7.40.0-5.fc22

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[SECURITY] Fedora 22 Update: filezilla-3.11.0.2-1.fc22

FileZilla is a FTP, FTPS and SFTP client for Linux with a lot of features. - Supports FTP, FTP over SSL/TLS FTPS and SSH File Transfer Protocol SFT P - Cross-platform - Available in many languages - Supports resume and transfer of large files 4GB - Easy to use Site Manager and transfer queue - Dr...

[SECURITY] Fedora 21 Update: mingw-curl-7.42.0-1.fc21

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

Attackers Peddling Malware Through CareerBuilder

Attackers have recently taken to the job-search website CareerBuilder to spread Microsoft Word documents that appear to be job hopefuls’ resumes, but in reality, are laden with malware. Researchers at the firm Proofpoint discovered the campaign and discussed their findings in a blog post. In the...

嘉缘人才系统存储型xss

简要描述： rt 详细说明： 首先注册一个用户，然后新建一份简历。在简历的添加教育背景处插入xss payload 然后保存这份简历。 可以看到插入的数据 数据没有编码直接进入数据库了。 然后查看简历直接触发 在后台简历管理，也可触发。偷取管理员cookie。 漏洞证明： img src="https://images.seebug.org/upload/201502/22235042cdc7d743d84b93343ef1a5d9f476c06a.jpg" alt="4...

Knight talent system 7 ultra vires+2 at sql-vulnerability warning-the black bar safety net

wapuser.php: About the ultra vires is no uid involved, cause any modifications to the database any records First place: code area elseif$act == "resumeworkdel" //Override $smarty-cache = false; $id=intval$GET'workid'; $sql="delete from ". table"resumework"." where id=$id"; if$db-query$sql exit"ok...

PHPYun v3.2 /member/user/model/resume.class.php SQL注入漏洞

No description provided by source...

Bitstamp Bitcoin Exchange Hacked, $5 Million Stolen in Hack Attack

One of the biggest, reliable and most trusted Bitcoin exchange — Bitstamp — on Monday announced that it has been a target of a hacking attack, which lead to the theft of "less than 19,000 BTC" worth about $5 million in virtual currency; one BTC is about $270. Bitstamp issued a statement on its...

[SECURITY] Fedora 19 Update: curl-7.29.0-27.fc19

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...