libdwarf Heap Buffer Overflow Vulnerability

libdwarf is a set of tools for reading and writing DWARF2 debugging information. A heap-based buffer overflow vulnerability exists in libdwarf. An attacker could exploit this vulnerability by using a malformed dwarf file to obtain sensitive information or cause a denial of service...

SUSE-SU-2016:2936-1 Security update for qemu

This update for qemu fixes the following issues: - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE12 - Change package post script udevadm trigger calls to be device specific bsc1002116 - Address various security/stability issues Fix OOB access in xlnx.xpx-ethernetlite...

SUSE SLES11 Security Update : kvm (SUSE-SU-2016:2902-1)

This update for kvm fixes the following issues : - Address various security/stability issues - Fix OOB access in xlnx.xpx-ethernetlite emulation CVE-2016-7161 bsc1001151 - Fix OOB access in VMware SVGA emulation CVE-2016-7170 bsc998516 - Fix DOS in ColdFire Fast Ethernet Controller emulation...

SUSE-SU-2016:2902-1 Security update for kvm

This update for kvm fixes the following issues: - Address various security/stability issues Fix OOB access in xlnx.xpx-ethernetlite emulation CVE-2016-7161 bsc1001151 Fix OOB access in VMware SVGA emulation CVE-2016-7170 bsc998516 Fix DOS in ColdFire Fast Ethernet Controller emulation CVE-2016-79...

WordPress Plugins Leave Online Shoppers Vulnerable

Researchers are calling into question the safety of some of the top WordPress e-commerce plugins used on over 100,000 commercial websites prepping for Black Friday and Cyber Monday online sales. In reviewing the top 12 WordPress e-commerce plugins, application security testing firm Checkmarx foun...

Debian Security Advisory DSA 3709-1 (libxslt - security update)

Nick Wellnhofer discovered that the xsltFormatNumberConversion function in libxslt, an XSLT processing runtime library, does not properly check for a zero byte terminating the pattern string. This flaw can be exploited to leak a couple of bytes after the buffer that holds the pattern string...

Websites of Indian Embassy in 7 Countries Hacked; Database Leaked Online

Indian embassy websites in seven different countries have been hacked, and attackers have leaked personal data, including full name, residential address, email address, passport number and phone number, of Indian citizens living abroad. This incident is extremely worrying because it involves...

The vulnerability of the SSH network protocol, related to the disclosure of information, allows a perpetrator to gain access to confidential data.

The vulnerability of the SSH network protocol is related to an error in password hashing. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data remotely...

CVE-2016-5495

Unspecified vulnerability in the Oracle Discoverer component in Oracle Fusion Middleware 11.1.1.7.0 allows remote attackers to affect confidentiality via vectors related to EUL Code & Schema...

SQL Injection Vulnerability in DBSHOP_0.9.3_Beta goodsSearchAction Function

DBShop is an open source e-commerce online store system developed using endFramework. DBSHOP0.9.3Beta goodsSearchAction function SQL injection vulnerability . After obtaining the parameters timesort, clicksort, pricesort, the key name and key value will be spliced into the sql statement to bring ...

Google Android - Binder Generic ASLR Leak

Google Android - Binder Generic ASLR Leak Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=889 The interaction between the kernel /dev/binder and the usermode Parcel.cpp mean that when a binder object is passed as BINDERTYPEBINDER or BINDERTYPEWEAKBINDER, a pointer to that object...

CVE-2016-3924

services/audioflinger/Effects.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not validate EFFECTCMDSETPARAM and EFFECTCMDSETPARAMDEFERRED commands, which allows attackers to obtain sensitive information...

HackerOne: Researcher gets email updates on a private program after he/she quits that program.

Summary: I found out that after I quit private program, I still gets update about that program, e.g. new scope changes/amount of money and etc. Description Include Impact: I noticed that if I quit program I still gets email updates about the private program, private data can be leak on that email...

VulnCheck KEV: CVE-2014-0160

The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information...

The vulnerability of the Flash Player software allows attackers to obtain confidential information or circumvent existing access restrictions.

The vulnerability of the Flash Player software is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to bypass existing access restrictions or obtain confidential information using uncertain vectors...

CVE-2 0 1 6-4 7 5 8:for Safari browser UXSS vulnerability analysis-vulnerability warning-the black bar safety net

! Foreword In this article, I'm ready to share with you about Vulnerability CVE-2 0 1 6-4 7 5 8 details. This vulnerability is a Safari in a UXSS vulnerability. The so-called UXSS, i.e., a universal cross-site scripting attacks. Currently, Apple has in Safari 1 0. fixes this vulnerability. The...

CVE-2016-6146

The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226...

kensoft CMS SQL Injection Vulnerability

kensoft CMS is a content management system. A SQL injection vulnerability exists in the ft parameter of the dispatch.php page of kensoft Cms, which can be exploited by attackers to obtain sensitive information...

Wordpress plugin bordeaux theme upload shell vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An upload vulnerability exists in the WordPress plugin bordeaux theme, which can be exploited by an attacker ...

SUSE-SU-2016:2325-1 Security update for openstack-keystone, openstack-nova, and openstack-swift

This update for openstack-keystone, openstack-nova, and openstack-swift fixes the following issues: - Fix hybrid backend from keystone v3 bsc967356 - Fix cleanup when block migration fails bsc960015 - Avoid host data leak bsc960601, CVE-2015-7548 - Fix init script for openstack-swift-object-expir...