CVE-2016-5347

CVE-2016-5347 describes an information-disclosure vulnerability in Qualcomm components, specifically in the CAF Android/Linux kernel audio driver. The issue allows leakage of kernel stack data to userspace via the audio driver, affecting Qualcomm-based Android devices using CAF-released kernels. ...

CVE-2016-5347

In all Qualcomm products with Android releases from CAF using the Linux kernel, kernel stack data can be leaked to userspace by an audio driver...

Debian DSA-3936-1 : postgresql-9.6 - security update

Several vulnerabilities have been found in the PostgreSQL database system : - CVE-2017-7546 In some authentication methods empty passwords were accepted. - CVE-2017-7547 User mappings could leak data to unprivileged users. - CVE-2017-7548 The loput function ignored ACLs. For more in-depth...

FILE buffer read out of bounds

When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user stdout or the application's provide callback, which could lead to other private data from the heap to...

CURL-CVE-2017-1000100 TFTP sends more than buffer size

When doing a TFTP transfer and curl/libcurl is given a URL that contains a long filename longer than about 515 bytes, the filename is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the original length. This too large value is then used in the...

SQL Injection Vulnerability in Agricultural Products Quality and Safety Monitoring Information System of Shanghai Fubo Agricultural Technology Co.

Agricultural products quality and safety monitoring information system is to make full use of Internet technology to the agricultural products food quality and safety testing stations points testing data networked centralized processing. Shanghai Fubo Agricultural Technology Co., Ltd. agricultura...

Engineering Firm Leaks Data on Dell, SBC and Oracle

A Texas-based firm called Power Quality Engineering publicly exposed sensitive electrical infrastructure data on the public internet. Firms impacted by the leak were Dell Technologies, SBC, Freescale, Oracle, Texas Instruments and the City of Austin. Chris Vickery, cyber risk analyst at security...

UBUNTU-CVE-2017-7890

The GIF decoding function gdImageCreateFromGifCtx in gdgifin.c in the GD Graphics Library aka libgd, as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read 700 bytes from the top of the...

CVE-2017-7890

A data leak was found in gdImageCreateFromGifCtx in GD Graphics Library used in PHP before 5.6.31 and 7.1.7. An attacker could craft a malicious GIF image and read up to 762 bytes from stack...

July 19, 2017 – Morning Cyber Coffee Headlines – “Rosetta Stone” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 19, 2017 - Headlines Cyberattack on Ukrainian Clinics, Pharmacies Worries...

WSTMart open source mall system payments.class.php there are arbitrary file read vulnerabilities

WSTMart open source mall , is a system that can help businesses and individuals to quickly build a community service system . WSTMart open source mall system payments.class.php there are arbitrary file reading vulnerabilities. Attackers can use this vulnerability to obtain sensitive information...

Experts Warn Too Often AWS S3 Buckets Are Misconfigured, Leak Data

A rash of misconfigured Amazon Web Services storage servers leaking data to the internet have plagued companies recently. Earlier this week, data belonging to anywhere between six million and 14 million Verizon customers were left on an unprotected server belonging to a partner of the...

ALPINE-CVE-2017-7529

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request...

DEBIAN-CVE-2017-7529

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request...

UBUNTU-CVE-2017-7529

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request...

XSS Vulnerability in OTCMSV2.56

OTCMS is a website article management system. OTCMSV2.56 suffers from an XSS vulnerability. An attacker can exploit this vulnerability to obtain sensitive information such as administrator cookies...

WP Statistics SQL Injection vulnerability

Security experts at Sucuri have discovered a SQL Injection vulnerability in WP Statistics, one of the most popular WordPress plugins, that is currently installed on over 300,000 websites. The SQL Injection vulnerability in WP Statistics could be exploited by attackers, with at least a subscriber...

Someone leaked 32TB of Windows 10 internal builds and source code

By Waqas It looks like Microsoft is in trouble again. This time not for its critical vulnerabilities in Windows operating system but for a massive data leak in which 32TB of highly sensitive Windows 10 related data has been dumped online. According to a report from TheRegister, it is believed tha...

Internet Bug Bounty: 4 severe remote + several minor OpenVPN vulnerabilities

CVE-2017-7521 Remote server crashes/double-free/memory leaks in certificate processing CVE-2017-7520 Remote including MITM client crash, data leak CVE-2017-7508 Remote server crash forced assertion failure CVE-2017-7522 Crash mbed TLS/PolarSSL-based server no cve Remote/mitm Null-pointer...

S-CMS V3.0 build20170601 has an arbitrary file download vulnerability

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS V3.0 build20170601 '/admin/download.asp' page has an arbitrary file download vulnerability, allowing attackers to exploit the vulnerability to download database information...