eric-beisswenger.de XSS vulnerability

Open Bug Bounty ID: OBB-700573 Description| Value ---|--- Affected Website:| eric-beisswenger.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

eric-bompard.com XSS vulnerability

Open Bug Bounty ID: OBB-700108 Description| Value ---|--- Affected Website:| eric-bompard.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

HylaFAX 6.0.6 / 5.6.0 Uninitialized Pointer / Out Of Bounds Write Vulnerabilities

Multiple bugs were found in the code handling fax page reception in JPEG format that allow arbitrary writes to an uninitialized pointer by remote parties dialing in. When processing an specially crafted input, the issue could lead to remote code execution. HylaFAX versions 6.0.6 and 5.6.0 are...

Yubico PIV Tool 1.5.0 Buffer Overflow Vulnerability

A buffer overflow and an out of bounds memory read were identified in the yubico-piv-tool-1.5.0, these can be triggered by a malicious token. Multiple Vulnerabilities in Yubico Piv ====================================== Overview - -------- Confirmed Affected Versions: 1.5.0 Confirmed Patched...

Apple Smart Card Services Memory Corruption Vulnerability

Attackers with local access can exploit security issues in the smartcard driver. These result in memory corruptions, which might lead to code execution. Since smartcards can be used for authentication, the vulnerabilities may allow an attacker to login to the system without valid credentials as a...

OpenSC 0.18.0 Buffer Overflow / Out Of Bounds Read Vulnerability

Multiple issues have been identified in OpenSC, ranging from stack based buffer overflows to out of bounds reads and writes on the heap. They can be triggered by malicious smartcards sending malformed responses to APDU commands. Additionally to those fixes reported here, a lot of minor issues eg...

A Bug in Chrome Gives Bad Actors License to Play ‘20 Questions’ with Your Private Data

In a 2013 interview with The Telegraph, Eric Schmidt, then CEO of Google was quoted as saying: “You have to fight for your privacy or lose it.” Five years later, with the ‘Cambridge Analytica’ data breach scandal fresh in our memory, Eric Schmidt’s statement rings as a self-evident truth. Similar...

Unbreakable Enterprise kernel security update

4.14.35-1818.1.6 - ipv4: frags: handle possible skb truesize change Eric Dumazet Orabug: 28481663 CVE-2018-5391 4.14.35-1818.1.5 - inet: frag: enforce memory limits earlier Eric Dumazet Orabug: 28481663 CVE-2018-5391 - init/main.c: reorder bootcpustateinit/smppreparebootcpu Mihai Carabas Orabug:...

Silex Technology SX-500/SD-320AN or GE Healthcare MobileLink (Update B)

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION : Exploitable Remotely / Low skill level to exploit / Public exploits are available Vendors : Silex Technology, GE Healthcare Equipment : SX-500, SD-320AN, MobileLink Vulnerabilities : Improper Authentication, OS Command Injection 2. UPDATE INFORMATION...

ceric-eric.eu XSS vulnerability

Open Bug Bounty ID: OBB-531664 Description| Value ---|--- Affected Website:| ceric-eric.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Serial Swatter “SWAuTistic” Bragged He Hit 100 Schools, 10 Homes

The individual who allegedly made a fake emergency call to Kansas police last week that summoned them to shoot and kill an unarmed local man has claimed credit for raising dozens of these dangerous false alarms -- calling in bogus hostage situations and bomb threats at roughly 100 schools and at...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3640)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3640 advisory. - selinux: fix off-by-one in setprocattr Stephen Smalley Orabug: 27001717 CVE-2017-2618 CVE-2017-2618 CVE-2017-2618 - sysctl: Drop reference added ...

PSFTPd Windows FTP Server 10.0.4 Build 729 - Log Injection / Use-After-Free

X41 D-Sec GmbH Security Advisory: X41-2017-006 Multiple Vulnerabilities in PSFTPd Windows FTP Server ===================================================== Overview -------- Confirmed Affected Versions: 10.0.4 Build 729 Confirmed Patched Versions: None Vendor: Sergei Pleis Softwareentwicklung Vend...

VIDEO: Why We Need to Stop Calling Cybercriminals ‘Hackers’

Editor's Note: This article also appears on Cyberscoop. Carbon Black's National Security Strategist Eric O'Neill talks about what needs to change in the cybersecurity community if things are going to get better in 2018. The post VIDEO: Why We Need to Stop Calling Cybercriminals 'Hackers' appeared...

November 13, 2017 – Morning Cyber Coffee Headlines – “Eric O’ Neill” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! November 13, 2017 - Headlines Carbon Black in the News: Why we need to stop...

#CbChats: Eric O’ Neill Chats About Hacking as Espionage, His Time at the FBI & Ryan Phillippe

Today on CbChats, Carbon Black National Security Strategist Eric O' Neill talks about his time at the FBI, his relationship with "Breach" star Ryan Phillippe and how hacking is just the latest iteration of espionage. https://www.carbonblack.com/wp-content/uploads/2017/11/EONCbchats.mp3 About Eric...

FreeBSD : GitLab -- multiple vulnerabilities (418c172b-b96f-11e7-b627-d43d7e971a1b)

GitLab reports : Cross-Site Scripting XSS vulnerability in the Markdown sanitization filter Yasin Soliman via HackerOne reported a Cross-Site Scripting XSS vulnerability in the GitLab markdown sanitization filter. The sanitization filter was not properly stripping invalid characters from URL...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3609)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3609 advisory. - fs/exec.c: account for argv/envp pointers Kees Cook Orabug: 26638900 CVE-2017-1000365 CVE-2017-1000365 - dentry name snapshots Al Viro Orabug:...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3605)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3605 advisory. - dentry name snapshots Al Viro Orabug: 26630936 CVE-2017-7533 - KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings David...

Unbreakable Enterprise kernel security update

kernel-uek 4.1.12-94.5.9 - dentry name snapshots Al Viro Orabug: 26630936 CVE-2017-7533 4.1.12-94.5.8 - scsi: libiscsi: use kvzalloc for iscsipoolinit Kyle Fortin Orabug: 26621191 - mm: introduce kvmzalloc helpers Kyle Fortin Orabug: 26621191 - KEYS: Disallow keyrings beginning with '.' to be...