procps: Local privilege escalation in top

If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any security check. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of...

Azure Security Lab: a new space for Azure research and collaboration

Azure is exceptionally secure. To help keep it that way, we are doubling the top bounty reward for Azure vulnerabilities to $40,000. But we aren’t stopping there. To make it easier for security researchers to confidently and aggressively test Azure, we are inviting a select group of talented...

Azure Security Lab: a new space for Azure research and collaboration

Azure is exceptionally secure. To help keep it that way, we are doubling the top bounty reward for Azure vulnerabilities to $40,000. But we aren’t stopping there. To make it easier for security researchers to confidently and aggressively test Azure, we are inviting a select group of talented...

Vulnado - Purposely Vulnerable Java Application To Help Lead Secure Coding Workshops

This application and exercises will take you through some of the OWASP top 10 Vulnerabilities and how to prevent them. Up and running 1. Install Docker for MacOS or Windows. You'll need to create a Docker account if you don't already have one. 2. git clone git://github.com/ScaleSec/vulnado 3. cd...

top-side.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-904252 Security Researcher SecuNinja Helped patch 3413 vulnerabilities Received 12 Coordinated Disclosure badges Received 69 recommendations , a holder of 12 badges for responsible and coordinated disclosure, found a security vulnerability affecting top-side.de website and...

Microsoft Announces Top Contributing Partners in the Microsoft Active Protections Program (MAPP)

Today we announce the top organizational candidates for Vulnerability Top Contributors, Threat Indicator Top Submitters, and Zero-Day Top Reporting for the period of July 1, 2018 – June 30, 2019. The Microsoft Active Protections Program provides security and protection to customers through...

Microsoft Announces Top Contributing Partners in the Microsoft Active Protections Program (MAPP)

Today we announce the top organizational candidates for Vulnerability Top Contributors, Threat Indicator Top Submitters, and Zero-Day Top Reporting for the period of July 1, 2018 – June 30, 2019. The Microsoft Active Protections Program provides security and protection to customers through...

Smart cities, difficult choices: privacy and security on the grid

All is not well in the land of smart city planning, as the latest major planned development from Google's sister company Sidewalk Labs continues to run into problems in Toronto, Canada. A groundswell of support? Building a city “From the ground up” is apparently no longer a thing: at least some...

Google's Push to Close a Major Encrypted Web Loophole

By building security into top-level domains, Google makes it harder for HTTPS to fall short...

Executive hacked competitor’s website to steal students meal preferences

By Ryan De Souza Top Executive at Bay Area School Lunch Provider Arrested for Hacking into Competitor’s Website to Access Students Meal Preferences. Personal rivalry and competitiveness can compel people to get involved in all sorts of bizarre activities and the latest incident is clear proof of...

Fedora Update for wingpanel FEDORA-2019-27e7b92407

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Evil TeamViewer Attacks Under the Guise of the U.S. State Department

UPDATE A targeted, email-borne attack against embassy officials and government finance authorities globally is making use of a malicious attachment disguised as a top-secret U.S. document. It weaponizes TeamViewer, the popular remote-access and desktop-sharing software, to gain full control of th...

[SECURITY] Fedora 29 Update: wingpanel-2.2.3-2.fc29

Stylish top panel that holds indicators and spawns an application launcher...

New DNS Hijacking Attacks

DNS hijacking isn't new, but this seems to be an attack of unprecedented scale: Researchers at Cisco's Talos security division on Wednesday revealed that a hacker group it's calling Sea Turtle carried out a broad campaign of espionage via DNS hijacking, hitting 40 different organizations. In the...

MailCarrier 2.51 TOP Buffer Overflow

!/usr/bin/python Exploit Title: MailCarrier 2.51 - SEH Remote Buffer Overflow in "TOP" commandPOP3 Date: 14/04/2019 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: https://www.tabslab.com/ Version: 2.51 Software Link: N.A Contact: [email protected] Twitter: @telspacesystem...

Do High Vanity Bitrates Choke Your Live OTT Service Out of the Gate?

Studies show that video consumption demand is growing faster than capacity. While capacity overhead does exist, current trends suggest that we'll see more bottlenecking on last-hop connectivity, especially with regionally targeted content. By pushing "vanity bitrates" -- those topmost speeds that...

RIPS 3.1: TeamCity, LDAP and JSP Support

Compliance Management Compliance to industry standards is a major topic in todays product development strategies. We revised our compliance tab that now provides an efficient overview of all violations against industry standard requirements that were found during RIPS code analysis. Developers ca...

Top 10 VPN Services For 2019

By Zehra Ali VPN is a billion dollar industry and lately, it has become a vital part of users conscious about their online privacy - Here are the top 10 VPN services for 2019. If you are an Internet user, VPN should be part of your online life but choosing a reliable VPN can be a tough nut to...

Back To Top - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-040

This module enables you to add a button that hovers in the bottom of your screen and allows users to smoothly scroll up the page using jQuery. The module doesn't sufficiently sanitize the code that gets printed on pages leading to a Cross Site Scripting XSS issue. This vulnerability is mitigated ...

Skia - Incorrect Convexity Assumptions Leading to Buffer Overflows

I was looking into the root cause of https://bugs.chromium.org/p/chromium/issues/detail?id=850350. In that bug, due to precision errors, Skia generated a concave RRect, but declared it convex. Later, the RRect was transformed with an affine transform and used as a clipping region for drawing...