WannaMine upgrade to V3. 0 version, the alert caught it! - Vulnerability warning-the black bar safety net

Recently, several companies feedback a large number of hosts and services, the presence of Cottonwood and blue screen phenomenon, in the quest for Sangfor assists after using EDR for the entire network scan found a large number of hosts infected by the same virus. Sangfor security team Research...

CVE-2018-16840

A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the Curlclose function, the library code first frees a struct without nulling the pointer and might then subsequently...

SUSE-SU-2018:3563-1 Security update for ardana-monasca, ardana-spark, kafka, kafka-kit, openstack-monasca-api

This update for ardana-monasca, ardana-spark, kafka, kafka-kit, openstack-monasca-api fixes the following issues: This update for ardana-monasca to version 8.0+git.1535031421.9262a47 fixes these issues: - Requests Apache to reload on change bsc1102662 - Avoids managing non-Monasca users bsc110266...

openSUSE: Security Advisory for pam_pkcs11 (openSUSE-SU-2018:3375-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : pam_pkcs11 (openSUSE-2018-1250)

This update for pampkcs11 fixes the following security issues : - It was possible to replay an authentication by using a specially prepared smartcard or token bsc1105012 - Prevent buffer overflow if a user has a home directory with a length of more than 512 bytes bsc1105012 - Memory not cleaned...

Security update for pam_pkcs11 (moderate)

This update for pampkcs11 provides the following fixes: Security issues fixed bsc1105012: - Fixed a logic bug in pampkcs11.c, leading to an authentication replay vulnerability - Fixed a stack-based buffer overflow in opensshmapper.c - Make sure memory is properly cleaned before invoking free Othe...

SUSE SLES11 Security Update : pam_pkcs11 (SUSE-SU-2018:2843-1)

This update for pampkcs11 fixes the following security issues : It was possible to replay an authentication by using a specially prepared smartcard or token bsc1105012 Prevent buffer overflow if a user has a home directory with a length of more than 512 bytes bsc1105012 Memory not cleaned properl...

SafeText - Script To Remove Homoglyphs And Zero-Width Characters To Allow For Safe Distribution Of Documents From Anonymous Sources

Tool to sanitize text to allow for safe distribution of documents from anonymous sources by removing zero-width characters and homoglpyhs. Individuals attempting to leak an email or other text file face the risk of identification through fingerprinting. Fingerprinting often occurs when the origin...

vistalcleaningproducts.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-643541 Description| Value ---|--- Affected Website:| vistalcleaningproducts.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

HP VAN SDN Controller Root Command Injection Exploit

This Metasploit module exploits a hardcoded service token or default credentials in HPE VAN SDN Controller versions 2.7.18.0503 and below to execute a payload as root. A root command injection was discovered in the uninstall action's name parameter, obviating the need to use sudo for privilege...

Mahara < 16.10.9, < 17.04.7, < 17.10.4 XSS Vulnerability

Mahara is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mahara:mahara";...

CVE-2018-6182

Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore, Mahara should not rely on TinyMCE's code stripping alone but also clean input on the server / PHP side as one can create own packets of...

PT-2018-17390

Name of the Vulnerable Software and Affected Versions Mahara versions 16.10 through 16.10.8 Mahara versions 17.04 through 17.04.6 Mahara versions 17.10 through 17.10.3 Description The issue arises when TinyMCE is bypassed by POST packages, allowing bad input to be processed. This occurs because...

CVE-2018-6182: Improper Neutralization of Input During Web Page Generation

Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore, Mahara should not rely on TinyMCE's code stripping alone but also clean input on the server / PHP side as one can create own packets of...

searchinquire.com XSS vulnerability

Open Bug Bounty ID: OBB-598789 Description| Value ---|--- Affected Website:| searchinquire.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The vulnerability of the gplotMakeOutput function in the Leptonica image processing library allows a hacker to execute any command they desire.

The vulnerability of the gplotMakeOutput function in the Leptonica image processing library is related to insufficient cleaning of input data. Exploiting this vulnerability allows a malicious actor to execute any command remotely using the argument gplot rootname...

The vulnerability of the dbman service of the HPE Intelligent Management Center PLAT software platform allows a perpetrator to execute arbitrary code.

The vulnerability of the dbman service of the HPE Intelligent Management Center PLAT software platform is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the DownloadServlet component in the SAP NetWeaver software integration platform allows a hacker to execute arbitrary JavaScript code on the client side.

The vulnerability of the DownloadServlet component in the SAP NetWeaver software integration platform exists due to insufficient data cleaning during the copying of requests into responses. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code on the client...

The vulnerability of the Ohcount source code counting tool lies in the lack of measures to clean input data, allowing a hacker to execute arbitrary code.

The vulnerability of the Ohcount source code counting tool is related to the lack of measures to clean input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code as the user who runs Ohcount, by using specially created file names containing metasymbols...

The vulnerability of Schneider Electric’s homeLYnk controller’s microprogramming software, related to insufficient data cleaning at the management level, allows attackers to execute commands with root privileges.

The vulnerability of Schneider Electric’s homeLYnk controller microprogramming software is related to the lack of data cleaning measures at the management level. Exploiting this vulnerability allows a malicious actor to execute commands with root privileges using specially crafted POST requests...