3148 matches found
Amazon Linux AMI : openssh (ALAS-2019-1313)
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The-Middle attacker can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This...
Medium: openssh
Issue Overview: An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The-Middle attacker can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being...
Debian DSA-4533-1 : lemonldap-ng - security update
It was discovered that the Lemonldap::NG web SSO system did not restrict OIDC authorization codes to the relying party. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4533. The text itself is copyright C...
Razer: Race Condition in Oauth 2.0 flow can lead to malicious applications create multiple valid sessions
The tester discovered a flaw in the Razer ID authentication system that could allow multiple access tokens. This was a minor issue but could theoretically have led to extended access due to unexpired tokens. Razer thanks the tester for their diligence. Here is a write-up for similar bug:...
EulerOS 2.0 SP5 : openssh (EulerOS-SA-2019-1908)
According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The-Middle...
Joker Spyware Found in 24 Google Play Apps
A new spyware has been making the rounds in Android apps on Google Play, infecting victims post-download to steal their SMS messages, contact lists and device information. In addition to stealing victims’ information, the malware also stealthily signs them up for premium service subscriptions tha...
TrickBot Targets Verizon, T-Mobile, Sprint Users to Siphon PINs
The TrickBot malware, known previously for targeting U.S. banks, is now setting a bullseye on users of U.S.-based mobile carriers, including Verizon Wireless, T-Mobile and Sprint, to launch SIM swapping attacks. Researchers with Dell’s Secureworks research team warned that they have observed the...
ZEIT: Unauthorized admission to any team in zeit.co
step no.1: open : https://zeit.co/teams/invite/ XXXX and this is a code "CzKyCgbB" of joining in a team called "maxhacker" if we generate a list consists of 8 capital and small letters with any generate tools F565462 knowing that the invitation code of any team is constant...
CVE-2017-18538
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes...
CVE-2017-18538
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes...
CVE-2017-18540
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes...
Design/Logic Flaw
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes...
Design/Logic Flaw
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes...
Design/Logic Flaw
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes...
CVE-2017-18539
The CVE-2017-18539 entry concerns the WordPress WebLibrarian plugin. Affected component: weblibrarian plugin (WordPress) prior to version 3.4.8.6. Root cause: cross-site scripting (XSS) via front-end short codes. Impact: attacker can execute client-side code; exact impact details are described ac...
CVE-2017-18539
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes...
CVE-2017-18538
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes...
CVE-2017-18540: Improper Neutralization of Input During Web Page Generation
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes...
Webmin 1.920 Remote Root Exploit
Exploit for linux platform in category web applications !/usr/bin/perl -w Webmin 1.920 Remote Root Exploit Copyright 2019 c Todor Donev Disclaimer: This or previous programs are for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that...