Cisco Ultra Services Platform Elastic Services Controller Web Interface Information Disclosure Vulnerability

Cisco Ultra Services Platform is an intelligent online service delivery platform from Cisco, Inc. Elastic Services Controller ESC is an open source modular system. An information disclosure vulnerability exists in the ESC web interface in Cisco Ultra Services Platform version 21.0.v0.65839. A...

Google Removes Chrome Extension Used in Banking Fraud

Google has removed from the Chrome Web Store a malicious browser extension used by criminals in Brazil to target corporate users with the aim of stealing banking credentials. The twist is that the attackers did their homework on their targets, learning via social networks whom inside an...

Nextcloud: Information Exposure Through Directory Listing

Hello. I found open directories on the site https://apps.nextcloud.com, which can be viewed by any unauthorized user. There is an error at https://apps.nextcloud.com/static/. F212856 All directories and files in them, starting with /static/ can be viewed or downloaded with all the content. Perhap...

Play Protect: Android’s new security system is now available

Play Protect, a security suite for Android devices, was originally introduced in mid-May of this year during the Google I/O conference. And in just a couple of months, the tech giant has made it available for all their mobile users. Play Protect is the amalgamation of Google’s Android security...

Fedora 26 : webkitgtk4 (2017-dfaf0ca892)

Highlights of the 2.16.0 release : - Hardware acceleration is now enabled on demand to drastically reduce memory consumption. - CSS Grid Layout is enabled by default. - New WebKitSetting to set the hardware acceleration policy. - UI process API to configure network proxy settings. - Improved...

Cross-Site Scripting Vulnerability in Accessible Assisted Browsing

Accessibility Aids is an accessibility aid for government websites that focuses on information technology construction, web content accessibility and internet accessibility. Accessibility Assisted Browsing has a cross-site scripting vulnerability, as the program fails to filter the event...

CVE-2017-3948

Cross Site Scripting XSS in IMG Tags in the ePO extension in McAfee Data Loss Prevention Endpoint DLP Endpoint 10.0.x allows authenticated users to inject arbitrary web script or HTML via injecting malicious JavaScript into a user's browsing session...

How to Speed Up Firefox With Multi-Process, If It's Not Working By Default

After years of waiting, Mozilla last week launched Firefox 54 for Windows, Mac, Linux, and Android, with multi-process support — a "major improvement" to improve your browsing experience — but many users are still struggling to take advantage of this feature. Mozilla's multi-process support in...

Mozilla Fixes 32 Vulnerabilities in Firefox 54

Mozilla fixed 32 vulnerabilities, including a critical bug that could have resulted in a crash, with the release Tuesday of Firefox 54, the latest version of its flagship browser. The critical bug, a use-after-free vulnerability, was dug up by longtime bug hunter Nils. The vulnerability...

MSRT June 2017: Removing sneaky Xiazai

In the June release of the Microsoft Malicious Software Removal Tool MSRT, we’re adding Xiazai, a widespread family of browser modifiers that we have blocked and removed from millions of computers since 2015. Xiazai is a software bundler that can sneak in additional changes. Xiazai does not insta...

[SECURITY] Fedora 26 Update: pcmanfm-1.2.5-2.fc26

PCMan File Manager is an extremly fast and lightweight file manager which features tabbed browsing and user-friendly interface...

Google Adds New Behavior-Based Malware Scanner To Every Android Device

In order to keep its billions of users safe, Google has introduced another security defense for its Android devices, called Google Play Protect. Google Play Protect, which is part of the Google Play Store app, uses machine learning and app usage analysis to weed out the dangerous and malicious...

[SECURITY] Fedora 25 Update: pcmanfm-1.2.5-2.fc25

PCMan File Manager is an extremly fast and lightweight file manager which features tabbed browsing and user-friendly interface...

Delightful Downloads <= 1.6.6 - Unauthenticated Path Traversal

Since no authentication or authorisation checks for direct access to the jqueryFileTree.php are made, the vulnerability allows for browsing the file system on a host out of an unauthenticated context. Even though no file content can be exfiltrated this way, "hidden" files e.g. in the web...

Apple Safari WebKit JSString Use After Free Code Execution (CVE-2017-2491)

Safari is a web browsing application developed by Apple. Safari browsing functionality is built around the set of components called WebKit. WebKit is a development toolkit which allows third party developers to build applications that use Internet technologies such as HTML, HTTP, and others. A...

SHAREit for Windows and Android Vulnerabilities

Lenovo Security Advisory: LEN-4058 Potential Impact: Remote browsing of file system, and unauthorized access of files on Windows and Android denial of service attack that could crash the Windows SHAREit client Severity: High Lenovo SHAREit Application: End of Lenovo Support Summary: Vulnerabiliti...

SHAREit for Windows and Android Vulnerabilities - Lenovo Support US

No description provided...

Google Shuts Down Docs Phishing Spree

Google said it has disabled offending accounts involved in a widespread spree of phishing emails today impersonating Google Docs. The emails, at the outset, targeted journalists primarily and attempted to trick victims into granting the malicious application permission to access the user’s Google...

Input Validation Bypass

Apache Hadoop HDFS is vulnerable to input validation bypass. The attack is possible because it does not correctly handle the validation of the input to NameNode when it is sent as a query parameter during the interaction of the HDFS client with the DataNode in the HDFS namespace browsing. A user...

MyBB Directory Traversal Vulnerability (CNVD-2017-06579)

MyBB is a popular web-based very good free forum software developed with PHP and MySQL. A directory traversal vulnerability exists in the smilie module in MyBB versions prior to 1.8.11. The vulnerability can be exploited to browse files with the 'pathfolder' parameter...