openSUSE Security Update : vlc (openSUSE-2016-755)

This update for vlc to version 2.1.6 fixes the following issues : These CVE were fixed : - CVE-2016-5108: Reject invalid QuickTime IMA files boo984382. - CVE-2016-3941: Heap overflow in processing wav files boo973354. These security issues without were fixed : - Fix heap overflow in decomp stream...

[SECURITY] Fedora 24 Update: expat-2.1.1-2.fc24

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

Capture Windows Kernel Activity: Fibratus

Capture Windows Kernel Activity: Fibratus Tool for exploration and tracing of the Windows kernel Fibratus is a tool which is able to capture the most of the Windows kernel activity – process/thread creation and termination, file system I/O, registry, network activity, DLL loading/unloading and mu...

IBM Storwize SSL/TLS RC4 Stream Cipher Key Invariance (Bar Mitzvah)

According to its self-reported version number, the IBM Storwize server running on the remote host is affected by a security feature bypass vulnerability, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase. A...

WordPress Social Stream 1.5.15 wp_options Overwrite

Vendor Homepage: Software Link: http://codecanyon.net/item/wordpress-social-stream/2201708?srank=15 Version: 1.5.15 Tested on: Debian 8, PHP 5.6.17-3 Type: Authenticated wpoptions overwrite Time line: Found 14-May-2016, Vendor notified 14-May-2016, Vendor fixed: v1.5.16 19/05/2016 Current Version...

WordPress Plugin Social Stream 1.5.15 - wp_options Overwrite

Vendor Homepage: Software Link: http://codecanyon.net/item/wordpress-social-stream/2201708?srank=15 Version: 1.5.15 Tested on: Debian 8, PHP 5.6.17-3 Type: Authenticated wpoptions overwrite Time line: Found 14-May-2016, Vendor notified 14-May-2016, Vendor fixed: v1.5.16 19/05/2016 Current Version...

WordPress Plugin Social Stream 1.5.15 - wp_options Overwrite

WordPress Plugin Social Stream 1.5.15 - wpoptions Overwrite Vendor Homepage: Software Link: http://codecanyon.net/item/wordpress-social-stream/2201708?srank=15 Version: 1.5.15 Tested on: Debian 8, PHP 5.6.17-3 Type: Authenticated wpoptions overwrite Time line: Found 14-May-2016, Vendor notified...

WordPress Social Stream Plugin 1.5.15 - "wp_options" Overwrite

This plugin is prone to "wpoptions" file overwrite vulnerability. Solution Upgrade the plugin...

WordPress Social Stream 1.5.15 Plugin - wp_options Overwrite

Exploit for php platform in category web applications Vendor Homepage: Software Link: http://codecanyon.net/item/wordpress-social-stream/2201708?srank=15 Version: 1.5.15 Tested on: Debian 8, PHP 5.6.17-3 Type: Authenticated wpoptions overwrite Time line: Found 14-May-2016, Vendor notified...

UBUNTU-CVE-2016-2061

Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service array overflow and memory corruption via a crafted...

CVE-2016-2061

Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service array overflow and memory corruption via a crafted...

Stream <= 3.0.5 - Unauthenticated Events Export

The Stream WordPress plugin allows unauthenticated users to export CSV or JSON of recent events. The code only checks to see if the proper GET variables are passed to a valid backend WordPress handler and will happily export logged entries. Reported to maintainers on 5/25/2016 and new version...

The vulnerability of the PHP interpreter allows a hacker to gain access to read files.

The vulnerability of the PHP interpreter lies in the lack of checks for the sequence “%00” in the path name. Exploiting this vulnerability allows an attacker, operating remotely, to read arbitrary files using specially crafted input data for the application that calls the function...

WordPress Stream Plugin <= 3.0.5 - Unauthenticated Events Export

Because of this vulnerability, unauthenticated users can export CSV or JSON of recent events. Solution Update the plugin...

Code injection

EMC Isilon OneFS 7.1.x and 7.2.x before 7.2.1.3 and 8.0.x before 8.0.0.1, and IsilonSD Edge OneFS 8.0.x before 8.0.0.1, does not require SMB signing within a DCERPC session over ncacnnp, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream, a...

The vulnerability of the Android operating system, which allows a hacker to increase their privileges

The vulnerability in the media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp component of the Android operating system’s mediaserver component is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges through ...

The vulnerability of the Android operating system allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the libFLAC/streamdecoder.c function in the Android operating system’s mediaserver component is due to buffer overflow. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure memory corruption by using a specially crafted...

Information disclosure

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows man-in-the-middle attackers to obtain sensitive cleartext information via vectors involving injection of cleartext data into the client-server data stream, aka "TLS/SSL Information Disclosure Vulnerability."...

cstrike.it XSS vulnerability

Vulnerable URL: http://www.cstrike.it/streams/multi?type=1&pos1;=1.v.%3Ciframe%20src=%22%22%3E%3C/iframe%3E%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 09:00 GMT Vulnerability type:| XSS...

OpenJDK: insufficient thread consistency checks in ObjectInputStream (Serialization, 8129952)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization...