Pulse Connect Secure 'logout.cgi' Cross-Site Request Forgery Vulnerability

Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure, a US-based company. A cross-site request forgery vulnerability in the logout.cgi file in PCS version 8.3R1 exists because the program fails to protect the administrator panel wit...

Threat Outbreak Alert RuleID29659: Email Messages Distributing Malicious Software on July 3, 2017

Medium Alert ID: 54347 First Published: 2017 July 3 18:11 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29659 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID29632: Email Messages Distributing Malicious Software on June 30, 2017

Medium Alert ID: 54340 First Published: 2017 July 3 14:38 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29632 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID29630: Email Messages Distributing Malicious Software on June 29, 2017

Medium Alert ID: 54328 First Published: 2017 June 29 16:55 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29630 may contain the following files: Name | Siz...

Fixed in Apache Tomcat 8.5.16

Important: Security Constraint Bypass CVE-2017-7675 The HTTP/2 implementation bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using an specially crafted URL. This was fixed in revision 1796091. The issue was...

Fixed in Apache Tomcat 9.0.0.M22

Important: Security Constraint Bypass CVE-2017-7675 The HTTP/2 implementation bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using an specially crafted URL. This was fixed in revision 1796090. The issue was...

Threat Outbreak Alert RuleID29568: Email Messages Distributing Malicious Software on June 21, 2017

Medium Alert ID: 54269 First Published: 2017 June 21 18:39 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29568 may contain the following files: Name | Siz...

gdal: Stack-buffer-overflow in var_create_dataset

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6512181791162368 Project: gdal Fuzzer: libFuzzergdalmitabtabfuzzer Fuzz target binary: mitabtabfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 8 Crash Addres...

FortiOS XSS vulnerabilities via User Groups & Config Revision Comments

Two XSS vulnerabilities were reported to us affecting FortiOS that can be exploited to load and run a remote malicious Javascript in a logged in browser...

Fastspot BigTree 'admin.php' File Denial of Service Vulnerability

Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A security vulnerability exists in the admin.php file in Fastspot BigTree 4.2.18 and earlier versions. A remote attacker can exploit this vulnerability to cause a denial of...

Threat Outbreak Alert RuleID29432: Email Messages Distributing Malicious Software on June 12, 2017

Medium Alert ID: 54169 First Published: 2017 June 12 12:29 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29432 may contain the following files: Name | Siz...

CVE-2017-9546

admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service inability to save revisions via XSS sequences in a revision name...

CVE-2017-9546

admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service inability to save revisions via XSS sequences in a revision name...

CVE-2017-9546: Improper Neutralization of Input During Web Page Generation

admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service inability to save revisions via XSS sequences in a revision name...

PT-2017-19008

Name of the Vulnerable Software and Affected Versions BigTree versions prior to 4.2.19 Description The issue allows remote authenticated users to cause a denial of service, specifically the inability to save revisions, by injecting XSS sequences in a revision name. Recommendations For BigTree...

gdal: Heap-buffer-overflow in _UncompressNextLine

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4630707714392064 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

wget2: Stack-buffer-overflow in getScriptContent

Project: https://gitlab.com/gnuwget/wget2.git Detailed report: https://oss-fuzz.com/testcase?key=4704516446355456 Project: wget2 Fuzzer: libFuzzerwget2libwgetxmlparsebufferfuzzer Fuzz target binary: libwgetxmlparsebufferfuzzer Job Type: libfuzzerasanwget2 Platform Id: linux Crash Type:...

Threat Outbreak Alert RuleID29372: Email Messages Distributing Malicious Software on June 1, 2017

Medium Alert ID: 54016 First Published: 2017 June 1 13:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29372 may contain the following files: Name | Size...

Debian DSA-3866-1 : strongswan - security update

Two denial of service vulnerabilities were identified in strongSwan, an IKE/IPsec suite, using Google's OSS-Fuzz fuzzing project. - CVE-2017-9022 RSA public keys passed to the gmp plugin aren't validated sufficiently before attempting signature verification, so that invalid input might lead to a...

gdal: Negative-size-param in NTFRecord::GetField

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4813983888441344 Project: gdal Fuzzer: libFuzzergdalshapefuzzer Fuzz target binary: shapefuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State:...