Newly Declassified Study Demonstrates Uselessness of NSA's Phone Metadata Program

The New York Times is reporting on the NSA's phone metadata program, which the NSA shut down last year: A National Security Agency system that analyzed logs of Americans' domestic phone calls and text messages cost $100 million from 2015 to 2019, but yielded only a single significant investigatio...

U.S. Pipeline Disrupted by Ransomware Attack

A ransomware attack has hit a natural gas compression facility in the U.S., the feds have warned. The attack resulted in a two-day pipeline shutdown as the unnamed victim worked to bring systems back online from backups. The attackers were able penetrate the IT portion of the facility’s network,...

SUSE-SU-2020:0424-1 Security update for rsyslog

This update for rsyslog fixes the following issues: Security issues fixed: - CVE-2019-17041: Fixed a heap overflow in the parser for AIX log messages bsc1153451. - CVE-2019-17042: Fixed a heap overflow in the parser for Cisco log messages bsc1153459. Non-security issues fixed: - Handle multiline...

Denial of Service

Overview Versions of @hapi/subtext prior to 6.1.3 or 7.0.3 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as...

Denial of Service

Overview All versions of ammo are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the...

IBM Tivoli Monitoring Service Denial of Service Vulnerability

IBM Tivoli Monitoring ITM is a suite of system monitoring software from IBM in the United States. The software supports the detection of system bottlenecks and potential problems, performance monitoring of basic system resources, and automatic recovery from critical situations. A security...

Exploit for Improper Resource Shutdown or Release in Microsoft

CVE-2018-8120 CVE-2018-8120 Windows LPE exploit Supports both x32 and x64. Tested on: Win7 x32, Win7 x64, Win2008 x32, Win2008 R2 x32, Win2008 R2 Datacenter x64, Win2008 Enterprise x64. Usage shell CVE-2018-8120 exploit by @unamerhttps://github.com/unamer Usage: exp.exe command Example: exp.exe...

The vulnerability in the driver/scsi/libsas/sas_discover.c component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the drivers/scsi/libsas/sasdiscover.c component in the Linux operating system is related to pointer assignment errors. Exploiting this vulnerability could allow an attacker to cause a service failure due to incorrect handling of port shutdown during detection, which is relate...

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2016-1028)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Tautulli v2.1.9 - Shutdown Denial of Service

Tautulli versions 2.1.9 and prior are vulnerable to denial of service via the /shutdown URL. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Tautulli v2.1.9 - Shutdown Denial of Service',...

Tautulli 2.1.9 - Denial of Service ( Metasploit )

Tautulli 2.1.9 - Denial of Service Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Tautulli v2.1.9 - Shutdown Denial of Service', 'Description' = 'Tautulli versions 2.1.9 and prior a...

Tautulli 2.1.9 Denial Of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Tautulli v2.1.9 - Shutdown Denial of Service', 'Description' = 'Tautulli versions 2.1.9 and prior are vulnerable to denial of service via the...

Tautulli 2.1.9 - Denial of Service (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Tautulli v2.1.9 - Shutdown Denial of Service', 'Description' = 'Tautulli versions 2.1.9 and prior are vulnerable to denial of service via the...

A week in security (December 16 – 22)

Last week on Malwarebytes Labs, we signalled that Mac threat detections have been on the rise in 2019, discussed how a new Consumer Online Privacy Rights Act COPRA would empower American users, warned that the Spelevo exploit kit debuts a new social engineering trick, and let our own Statler and...

CVE-2019-19833

In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. Also, anonymous access can be achieved in applications that do not have a user login area...

CVE-2019-19833

In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. Also, anonymous access can be achieved in applications that do not have a user login area...

PYSEC-2019-254

In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. Also, anonymous access can be achieved in applications that do not have a user login area...

Cross site request forgery (csrf)

In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. Also, anonymous access can be achieved in applications that do not have a user login area...

CVE-2019-19833

CVE-2019-19833 affects Tautulli (2.1.9 and earlier). A CSRF flaw in the /shutdown URI allows an attacker to remotely shut down the media server; some sources also note unauthenticated/shutdown via this endpoint in apps without login. The NVD/ATT&CK notes show impact as a shutdown/DoS risk with ne...

Tautulli 2.1.9 - Cross-Site Request Forgery (ShutDown) Vulnerability

Exploit for windows platform in category web applications Exploit Title: Tautulli 2.1.9 - Cross-Site Request Forgery ShutDown Exploit Author: Ismail Tasdelen Vendor Homepage: https://tautulli.com/ Software : https://github.com/Tautulli/Tautulli Product Version: v2.1.9 Platform: Windows 10...