Google Android Qualcomm Closed Source Component Access Control Error Vulnerability

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. An access control vulnerability exists in the Qualcomm closed-source component of Android. An attacker could exploit the vulnerability to cause a provider to have no access to the phone...

Google Android Qualcomm Closed Source Component Buffer Overflow Vulnerability (CNVD-2019-24156)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. A buffer overflow vulnerability exists in the Qualcomm closed source component in Android. No details of the vulnerability are provided at this time...

WordPress article2pdf plugin <=0.27 - Multiple vulnerabilities

Multiple vulnerabilities found by Christian Lerrahn in WordPress article2pdf plugin versions =0.27. Solution 2019 March 28 - we were unable to find a patched version of this plugin. Last time updated ten years ago, closed by WordPress for security reasons...

Error: "The underlying connection was closed..." when querying the Monitor Service OData endpoint

Clients that attempt to access data OData or other Citrix Services with TLS versions 1.0 and 1.1 fail to establish a connection. Clients using .NET Framework may raise the following error: System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---...

The vulnerability of the Apache HTTP server relates to the use of memory after it is freed. This allows an attacker to access parts of the server’s memory, cause failures in the child process of httpd, or gain access to closed HTTP resources.

The vulnerability of the Apache HTTP server is related to the use of memory after it is freed during the processing of comments in the Allow and Deny directives of the .htaccess configuration file. Exploiting this vulnerability allows a remote attacker to cause a child process of the httpd to cra...

WordPress Easy Redirect Manager plugin 2.18.18 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by LS Team in WordPress Easy Redirect Manager plugin version 2.18.18. Solution 26 January 2019 - we were unable to find a patched version of this plugin. WordPress plugin repository message: "This plugin was closed on January 14, 2019 and is no longer...

WordPress JSmol2WP plugin <= 1.07 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability in WordPress JSmol2WP plugin versions = 1.07. Solution 08.01.2019 - we were unable to find a patched version of this plugin. According to WordPess.org plugin repository, this plugin was closed on January 7, 2019 and is no longer available for...

Valve: Specially Crafted Closed Captions File can lead to Remote Code Execution in CS:GO and other Source Games

With a specially crafted closed captions file, the parser calls CHudCloseCaption::GetNoRepeatValue which in turn calls CHudCloseCaption::SplitCommand which has no boundary checks allowing the on stack variables cmd and args to be overflowed which in turn allows Remote Code Execution. Buffer...

WordPress PropertyHive plugin <= 1.4.25 - Unvalidated Input to do_action()

Unvalidated Input to doaction vulnerability found in WordPress PropertyHive plugin versions = 1.4.25. Solution 2018 December 7 - This plugin was closed on November 30, 2018 and is no longer available for download...

WordPress Calendar plugin <= 1.3.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by boombyte in WordPress Calendar plugin versions = 1.3.10. Solution WordPress Calendar plugin was closed on 2018 November 2 and is no longer available for download. Please deactivate and uninstall plugin as soon as possible...

WordPress Media File Manager plugin <= 1.4.2 - Directory Traversal vulnerability

Directory Traversal vulnerability found by boombyte in WordPress Media File Manager plugin versions = 1.4.2. Solution WordPress Media File Manager plugin was closed on 2018 November 8 and is no longer available for download. Please deactivate and uninstall plugin as soon as possible...

Apple's New MacBook Disconnects Microphone "Physically" When Lid is Closed

Apple introduces a new privacy feature for all new MacBooks that "at some extent" will prevent hackers and malicious applications from eavesdropping on your conversations. Apple's custom T2 security chip in the latest MacBooks includes a new hardware feature that physically disconnects the...

Apple's New MacBook Disconnects Microphone "Physically" When Lid is Closed

Apple introduces a new privacy feature for all new MacBooks that "at some extent" will prevent hackers and malicious applications from eavesdropping on your conversations. Apple's custom T2 security chip in the latest MacBooks includes a new hardware feature that physically disconnects the...

Have Network, Need Network Security Monitoring

I have been associated with network security monitoring my entire cybersecurity career, so I am obviously biased towards network-centric security strategies and technologies. I also work for a network security monitoring company Corelight, but I am not writing this post in any corporate capacity...

Authentication flaw

A vulnerability in the MACsec Key Agreement MKA using Extensible Authentication Protocol-Transport Layer Security EAP-TLS functionality of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic through a Layer 3 interface of an affected...

Jibu Pro <= 1.7 - Stored XSS

The plugin is still affected and has been closed...

SSRF/XSPA in ImporterSetupPage

h2. A security bug has been found in Jira Server. Administrator users can test local IP addresses/ports and determine whether they're open or closed. To reproduce: h2. Initial setup - Download https://www.atlassian.com/software/jira/download, install, and start up Jira Software Server. Note: I...

OracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0237)

The remote OracleVM system is missing necessary patches to address critical security updates : - dm: fix race between dmgetfromkobject and dmdestroy Hou Tao CVE-2017-18203 - drm: udl: Properly check framebuffer mmap offsets Greg Kroah-Hartman Orabug: 27986407 CVE-2018-8781 - kernel/exit.c: avoid...

PT-2018-11813 · Erik De Castro Lopo +1 · Libsndfile +1

Name of the Vulnerable Software and Affected Versions: libsndfile version 1.0.28 Description: There is a reported memory leak in the psf allocate function in common.c, as demonstrated by sndfile-convert. However, the maintainer and third parties were unable to reproduce the issue and it has been...

VK.com: Доступ к администраторским faq

Просмотр некоторых закрытых статей FAQ. Уязвимость позволяла получить доступ к талмудам vk.com/tlmdXXX в которых хранится информация для администраторов и модераторов социальной сети ВКонтакте... Получение доступа к адм. информации... @ 500$...