wetalent.nl XSS vulnerability

On the 21.06.2017 security researcher reported a XSS vulnerability affecting the wetalent.nl website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 21 June, 2017 17:36 G...

horrengigant.nl XSS vulnerability

On the 20.06.2017 security researcher reported a XSS vulnerability affecting the horrengigant.nl website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 20 June, 2017 17:...

kartor.eniro.se XSS vulnerability

On the 18.06.2017 security researcher reported a XSS vulnerability affecting the kartor.eniro.se website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 18 June, 2017 21:...

vidm.nl XSS vulnerability

On the 18.06.2017 security researcher reported a XSS vulnerability affecting the vidm.nl website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 18 June, 2017 18:35 GMT...

Fedora 25 : php-horde-Horde-Mime-Viewer (2016-f5fda29032)

HordeMimeViewer 2.2.1 - jan SECURITY: Don't render SVG images in the browser to avoid XSS attacks Reported by Dawid Gounski via Beyond Security's SecuriTeam Secure Disclosure program. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

Hackers and Developers Need to Hug it Out

The divide between developers and hackers is real. So, apparently, is the effort to bring them together and make them play nicely. “It’s not just a knowledge gap, but an empathy gap,” said I Am The Cavalry founder Josh Corman during a panel discussion at last week’s RSA Conference. “One common...

Adobe Starts Vulnerability Disclosure Program on HackerOne

Update: Adobe is the latest tech vendor to begin a vulnerability disclosure program, but it seems they’re limping in at the outset. The program launched this week on the HackerOne platform, but there are no cash incentives being offered and certain Adobe products are not in scope for researchers...

Yahoo Fixes Trio of Bugs in Mail, Messenger, Flickr

Yahoo recently patched three remotely exploitable vulnerabilities in its services that could have let attackers inject malicious script and led to session hijacking, phishing, among other nefarious tricks. The vulnerabilities in Yahoo Mail, Messenger and its Flickr photo-sharing site qualified fo...

Oracle Linux 5 / 6 : rdesktop (ELSA-2011-0506)

The remote Oracle Linux 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2011-0506 advisory. 1.6.0-8.1 - Prevent remote file access 676252 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

SA-CORE-2012-003 - Drupal core - Arbitrary PHP code execution and Information disclosure

Multiple vulnerabilities were discovered in Drupal core. Arbitrary PHP code execution A bug in the installer code was identified that allows an attacker to re-install Drupal using an external database server under certain transient conditions. This could allow the attacker to execute arbitrary PH...

Fedora 13 : rdesktop-1.6.0-10.fc13 (2011-7694)

This update fixes a security issue in rdesktop 1.6.0. A directory traversal flaw was found in the way rdesktop shared a local path with a remote server. If a user connects to a malicious server with rdesktop, the server could use this flaw to cause rdesktop to read and write to arbitrary, local...

Fedora 14 : rdesktop-1.6.0-11.fc14 (2011-7697)

This update fixes a security issue in rdesktop 1.6.0. A directory traversal flaw was found in the way rdesktop shared a local path with a remote server. If a user connects to a malicious server with rdesktop, the server could use this flaw to cause rdesktop to read and write to arbitrary, local...