CVE-2016-8009

Privilege escalation vulnerability in Intel Security McAfee Application Control MAC 7.0 and 6.x versions allows attackers to cause DoS, unexpected behavior, or potentially unauthorized code execution via an unauthorized use of IOCTL call...

CVE-2017-6874

Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows local users to cause a denial of service use-after-free and system crash or possibly have unspecified other impact via crafted system calls that leverage certain decrement behavior that causes incorrect interaction betwee...

Android Package Inspector: Inspeckage

Inspeckage is a tool developed to offer dynamic analysis of Android applications. By applying hooks to functions of the Android API, Inspeckage will help you understand what an Android application is doing at runtime. Inspeckage will let you interact with some elements of the app, such as...

F5 Networks BIG-IP : OpenSSL vulnerability (K23873366)

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service integer overflow and application crash or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3srvr....

Yelp: One of yelp.com url is redirecting to domain which is not yet purchased

One of yelp.com url is redirecting to domain which is not yet purchased, so anyone would buy that domain and host any stuff which yelp.com does not support. A malicious user can take advantage of this and send the link to users, and people will it is secured domain as link originates from yelp.co...

Fedora 24 : phpMyAdmin (2017-294c23bb1d)

Welcome to phpMyAdmin 4.6.6, a release containing security and bug fixes. This release includes many security fixes of various levels of severity. We recommend all users upgrade to this release immediately. For full information on the vulnerabilities fixed and mitigation factors for users who are...

Internet Bug Bounty: Incorrect GC behavior in xxlimited could lead to use-after-free

Issue submitted: http://bugs.python.org/issue29398 xxlimited module exist only in Python3.6 compiled on Linux. Starting program: /usr/bin/python3.6 xlimited.py Thread debugging using libthreaddb enabled Using host libthreaddb library "/usr/lib/libthreaddb.so.1". Program received signal SIGSEGV,...

CVE-2016-0320

CVE-2016-0320 affects IBM UrbanCode Deploy. Description: an authenticated user could modify UCD objects via multiple REST endpoints that do not properly authorize edits, potentially altering behavior of legitimately triggered processes. Affected versions include UrbanCode Deploy 6.0 through 6.2.x...

Unchecked Error Condition

ImageMagick is vulnerable to unchecked error condition. The library doesn't check for null exceptions when reading a DCM image, allowing a malicious user to use it to cause unintended behavior...

Explained — What's Up With the WhatsApp 'Backdoor' Story?

What is a backdoor? By definition: "Backdoor is a feature or defect of a computer system that allows surreptitious unauthorized access to data, " either the backdoor is in encryption algorithm, a server or in an implementation, and doesn't matter whether it has previously been used or not...

Fedora 24 : libpng10 (2016-1a7e14d084)

This update fixes an old NULL pointer dereference bug in pngsettext2 discovered and patched by Patrick Keshishian CVE-2016-10087. The potential 'NULL dereference' bug has existed in libpng since version 0.71 of June 26, 1995. To be vulnerable, an application has to load a text chunk into the png...

Microsoft Windows Installer Elevation of Privilege (MS16-149: CVE-2016-7292)

An elevation of privilege vulnerability exists in the Windows Installer. The vulnerability is due to the Windows Installer failing to properly sanitize input leading to an insecure library loading behavior. A attacker could run arbitrary code with elevated system privileges...

German Industrial Giant Victim of Cyber Espionage

German industrial conglomerate ThyssenKrupp disclosed last week that technical trade secrets were stolen in a cyberattack that dates back to February. Adversaries, ThyssenKrupp said, engaged in “organized, highly professional hacker activities” and launched their attack from the Southeast Asian...

OracleVM 3.3 / 3.4 : sudo (OVMSA-2016-0170)

The remote OracleVM system is missing necessary patches to address critical security updates : - Update noexec syscall blacklist - Fixes CVE-2016-7032, CVE-2016-7076 Resolves: rhbz1391937 - RHEL-6.8 erratum - fixed a bug causing that non-root users can list privileges of other users Resolves:...

Security update for MozillaThunderbird (important)

This update for MozillaThunderbird fixes some potential security issues and bugs. The following security flaws cannot be exploited through email because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts: - CVE-2016-9079: SVG Animation Remote Co...

Deception Technology: Can It Detect Intruders Earlier in their Attack Chain?

Every infosec conference is chatting about the Attack Chain, a visual mapping of the steps an intruder must take to breach a network. If you can detect traces of an attack earlier, you not only have more time to respond, but can stop the unauthorized access to monetizable data and its exfiltratio...

tomcat: directory disclosure

It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that...

SQL Injection Vulnerability in Digital China Internet Behavior Management System's page_group Parameter

Digital China Internet Behavior Management System is an Internet behavior logging system that fully owns the network behavior analysis management system, integrating hardware and software architecture, behavior analysis engine, management and control policies, analyzing network activities in real...

SQL Injection Vulnerability in Digital China Internet Behavior Management System Announcement_starttime Parameter

Digital China Internet Behavior Management System is an Internet behavior logging system that fully owns the network behavior analysis management system, integrating hardware and software architecture, behavior analysis engine, management and control policies, analyzing network activities in real...

SQL Injection Vulnerability in Digital China Internet Behavior Management System's cgi_div_id Parameter

Digital China Internet Behavior Management System is an Internet behavior logging system that fully owns the network behavior analysis management system, integrating hardware and software architecture, behavior analysis engine, management and control policies, analyzing network activities in real...