Malware Analysis System: Cuckoo Sandbox

Cuckoo Sandbox is an advanced, extremely modular, and 100% open source automated malware analysis system with infinite application opportunities. By default it is able to: Analyze many different malicious files executables, office documents, pdf files, emails, etc as well as malicious websites...

SQL Injection Vulnerability in Internet Behavior Audit Gateway of Chengdu Flying Fish Star Technology Development Co.

Chengdu Flying Fish Star Technology Co., Ltd. is dedicated to providing intelligent and easy-to-use network communication products and services. A SQL injection vulnerability exists in the Internet Behavior Audit Gateway of Chengdu Flyingfish Star Technology Development Co. An attacker is allowed...

RPISEC: Malware Analysis

This material was developed and used by RPISEC to teach Malware Analysis at Rensselaer Polytechnic Institute in Fall 2015. This was a university course developed and run solely by students, primarily using the Practical Malware Analysis book by Michael Sikorski and Andrew Honig, to teach skills i...

Capturing and Analyzing Network Flow Data: Joy

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring. Joy is a BSD-licensed libpcap-based software package for extracting data features from live network traffic or packet capture pcap files, using a flow-oriented mod...

DLA-382-1 sudo - security update

Bulletin has no description...

MGASA-2016-0003 Updated armagetron package fixes security vulnerabilities

A practically exploitable bug was fixed in the network error handling. In client mode, any received packet that causes an exception during processing would terminate the connection to the server. Another theoretically exploitable bug was fixed that allowed very short UDP packets to cause a memory...

Updated armagetron package fixes security vulnerabilities

A practically exploitable bug was fixed in the network error handling. In client mode, any received packet that causes an exception during processing would terminate the connection to the server. Another theoretically exploitable bug was fixed that allowed very short UDP packets to cause a memory...

PT-2015-7842

Name of the Vulnerable Software and Affected Versions libarchive versions prior to 3.2.0 Description The issue is related to multiple integer overflows in the get time t max and get time t min functions in archive read support format mtree.c. This can be triggered by a crafted mtree file, leading...

CVE-2015-8931

Multiple integer overflows in the 1 gettimetmax and 2 gettimetmin functions in archivereadsupportformatmtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior...

Jail Authorities Mistakenly Early Released 3,200 Prisoners due to a Silly Software Bug

Washington State Department of Corrections DoC is facing an investigation after it early released around 3,200 prisoners over the course of 13 years, since 2002, when a bug was introduced in the software used to calculate time credits for inmates' good behavior. The software glitch led to a...

惠尔顿上网行为管理系统命令执行漏洞

No description provided by source...

惠尔顿上网行为管理系统任意文件下载漏洞

No description provided by source...

HackerOne: Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports

Hi Team, Legend ====== AppSecBounty = Bug ProgramSandbox Program Hacker1001 = Bug Reporter BugAdmin = Program Admin BugMember = Team Member associated ProgramManagement Group ProgramManagement Group = Custom Group created with "Program Management Permission" Steps: 1. Hacker1001 reports a Bug to...

CVE-2015-6766

Use-after-free vulnerability in the AppCache implementation in Google Chrome before 47.0.2526.73 allows remote attackers with renderer access to cause a denial of service or possibly have unspecified other impact by leveraging incorrect AppCacheUpdateJob behavior associated with duplicate cache...

WhatsApp Blocks Links to Telegram Messenger (Its biggest Competitor)

It seems like Facebook-owned popular messaging service WhatsApp is blocking links to rival messaging applications – at least Telegram app for now. Telegram users are noticing that WhatsApp is blocking any links to the privacy-oriented messaging service Telegram.me. Although users are free to send...

MGASA-2015-0460 Updated python-cryptography packages fix security vulnerability

The OpenSSL backend prior to 1.0.2 made extensive use of assertions to check response codes where our tests could not trigger a failure. However, when Python is run with -O these asserts are optimized away. If a user ran Python with this flag and got an invalid response code this could result in...

PT-2015-7943

Name of the Vulnerable Software and Affected Versions OpenSSL backend versions prior to 1.0.2 python-cryptography versions prior to 1.0.2 python-cryptography-vectors versions prior to 1.0.2 python-pyasn1 versions prior to 0.1.8 Description The issue arises from the use of assertions in the OpenSS...

HackerOne: Pre-generation of 2FA secret/backup codes seems like an unnecessary risk

If you manage to get a malicious script running in HackerOne, requesting https://hackerone.com/settings/authentication/edit and parsing out the two factor authentication form will yield either… - the 2FA secret key and backup codes that will be used if 2FA is enabled for the first time this sessi...

Python 3.5 product_setstate() Out-Of-Bounds Read Vulnerability

Python versions 3.3 through 3.5 suffer from a vulnerability caused by the behavior of the productsetstate function. When called, the function loops over the state tuple provided and clamps each given index to a value within a range from 0 up to the max number of pools. Then, it loops over the poo...

USN-2766-1 spice vulnerabilities

Frediano Ziglio discovered multiple buffer overflows, undefined behavior signed integer operations, race conditions, memory leaks, and denial of service issues in Spice. A malicious guest operating system could potentially exploit these issues to escape virtualization. CVE-2015-5260, CVE-2015-526...