Nextcloud: Wordpress: Directory Traversal / Denial of Serivce

Hello Security team, While testing nextcloud.com i have found that you are not using the lastest version of wordpress you are using old version 4.5.3 which is vulnerable to Directory Traversal / Denial of Serivce Description : A path traversal vulnerability was found in the Core Ajax handlers of...

GNU Bash Information Disclosure Vulnerability

GNU Bash is a shell command language interpreter written by American software developer Brian J. Fox for the GNU Project. An information disclosure vulnerability exists in GNU Bash version 4.3, which can be exploited by an attacker to obtain sensitive information or possibly cause a denial of...

bash и ядро Linux в windows 10 anniversary update

Тут на днях 2 Августа подъехало новое обновление для Windows 10 "anniversary update" так вот самый интересной фишкой мне кажется будет bash в окнах. Обновление пока что доступно не всем регионам. По умолчанию bash не "включен". Если у вас версия ОС выше 1511 значит вы обладатель данного обновлени...

WordPress Core 4.5.3 - Directory Traversal / Denial of Service

Path traversal vulnerability in WordPress Core Ajax handlers Abstract A path traversal vulnerability was found in the Core Ajax handlers of the WordPress Admin API. This issue can potentially be used by an authenticated user Subscriber to create a denial of service condition of an affected...

Fedora 24 : pulp / pulp-docker / pulp-ostree / pulp-puppet / pulp-python / etc (2016-4373f7d32a)

2.8.6 is a security and bugfix release. Included in the list of fixed issues in 2.8.5 are two CVEs : - CVE-2016-3696: Leakage of CA key in pulp-qpid-ssl-cfg - CVE-2016-3704: Unsafe use of bash $RANDOM for NSS DB password and seed Several issues with database migrations are also addressed in this...

Pentmenu - A simple Bash Script for Recon and DOS Attacks

A bash script inspired by pentbox. Designed to be a simple way to implement various network pentesting functions, including network attacks, using wherever possible readily available software commonly installed on most linux distributions without having to resort to multiple specialist tools. Sud...

Windows 10 Attack Surface Grows with Linux Support in Anniversary Update

Microsoft’s release of Windows Anniversary Update last week included an optional feature called Windows Subsystem for Linux that allows native support for Linux binaries. That has some security experts concerned the Windows 10 attack surface has been expanded. The threat, according to Alex Ionesc...

NUUO NVRmini 2 3.0.8 - Remote Command Injection (Shellshock)

NUUO NVRmini 2 NE-4160 ShellShock Remote Code Execution Vendor: NUUO Inc. Product web page: http://www.nuuo.com Affected version: Firmware Version: 02.02.00 NVR Version: 02.02.0000.0040 Device Pack Version: 04.07.0000.0030 Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS...

How to run Graphical Ubuntu Linux from Bash Shell in Windows 10

You might be aware of Microsoft and Canonical's partnership to integrate "Bash on Ubuntu on Windows 10," which is typically a non-graphical Ubuntu running over Windows Subsystem for Linux. Windows 10 doesn’t officially support graphical Linux desktop applications. But, now we have noticed a very...

Alt Linux SPT Disable Functionality

Multiple vulnerabilities in the bash command-line interpreter of the Altron Linux SPT operating system are caused by errors in processing input data during syntax analysis of code. Exploiting these vulnerabilities allows a malicious individual to execute arbitrary commands with the privileges of...

Cisco Nexus 1000V Information Disclosure

The GNU Bash command shell, as of version 4.3 bash43-025, incorrectly handles lines that follow the declaration of a specially crafted function, which is exported as a variable. This allows a malicious actor to read and write arbitrary files, as well as perform other unconfirmed actions. Security...

PrinceXML Wrapper Class Command Injection

While grabbing a copy PrinceXML, I noticed the company also offered some wrapper classes in various languages for using prince in server applications web applications. http://www.princexml.com/download/wrappers/ Taking a quick look at the PHP class, there are likely numerous command injection...

Cisco Unified Communications Manager Information Disclosure

The GNU Bash command shell, as of version 4.3 bash43-025 and later, incorrectly handles lines that follow the declaration of a specially crafted function, which is exported as a variable. This allows a malicious actor to read and write arbitrary files, as well as perform other unconfirmed actions...

Cisco ACS Information Disclosure

The GNU Bash command shell, as of version 4.3 bash43-025, incorrectly handles lines that follow the declaration of a specially crafted function, which is exported as a variable. This allows a malicious actor to read and write arbitrary files, as well as perform other unconfirmed actions. Security...

Cisco Nexus 7000 Code Execution

The GNU Bash command shell, as of version 4.3 and later, incorrectly handles lines that follow the declaration of a function exported as a variable. This allows a malicious actor to execute arbitrary code by interfering with environment variables. Security researchers have confirmed that this...

Debian GNU/Linux Data Compromise

The multiple vulnerabilities in the Bash package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

Cisco Nexus 1000V Code Execution

The GNU Bash command shell, as of version 4.3 and later, incorrectly handles lines that follow the declaration of a function exported as a variable. This allows a malicious actor to execute arbitrary code by interfering with environment variables. Security researchers have confirmed that this...

Cisco IPS Code Execution

The GNU Bash command shell, as of version 4.3 and later, incorrectly handles lines that follow the declaration of a function exported as a variable. This allows a malicious actor to execute arbitrary code by manipulating environment variables. Security researchers have confirmed that this...

Cisco Nexus 5000 Code Execution

The GNU Bash command shell, as of version 4.3 and later, incorrectly handles lines that follow the declaration of a function exported as a variable. This allows a malicious actor to execute arbitrary code by interfering with environment variables. Security researchers have confirmed that this...

Cisco IPS Information Disclosure

The GNU Bash command shell, as of version 4.3 bash43-025, incorrectly handles lines that follow the declaration of a specially crafted function, which is exported as a variable. This allows a malicious actor to read and write arbitrary files, as well as perform other unconfirmed actions. Security...