bluez security update

5.50-3 + bluez-5.50-3 - Bump the version 5.50-2 + bluez-5.50-2 - Fixing CVE-2018-10910 1606373...

SUSE SLES12 Security Update : libqt4 (SUSE-SU-2020:1021-1)

This update for libqt4 fixes the following issues : CVE-2018-15518: Fixed a double free in QXmlStreamReader bsc1118595 CVE-2018-19873: Fixed a segmantation fault via a malformed BMP file bsc1118596. CVE-2018-19869: Fixed an improper checking which might lead to a crach via a malformed url referen...

MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography ECC implementation. An attacker could potentially abuse these bugs to learn information about a server’s private ECC key a key...

bluez security update

5.44-6 - fixing CVE-2018-10910. Resolves: 1609340...

CVE-2020-9777

An issue existed in the selection of video file by Mail. The issue was fixed by selecting the latest version of a video. This issue is fixed in iOS 13.4 and iPadOS 13.4. Cropped videos may not be shared properly via Mail...

Security Bulletin: Directory Traversal vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-4240, CVE-2020-4209)

Summary IBM Spectrum Protect Plus could allow a remote attacker to traverse directories on the system which can result in the creation of arbitrary files on the system or files being overwritten. Vulnerability Details CVEID: CVE-2020-4240 DESCRIPTION: IBM Spectrum Protect Plus could allow a remot...

SUSE SLES12 Security Update : wicked (SUSE-SU-2020:0351-1)

This update for wicked fixes the following issues : Security issues fixed : CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options bsc1160903. CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IAPD option bsc1160904. CVE-2020-7216: Fixed a potential...

CVE-2013-4161

gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was improperly applied and it did not fixed the security issue...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3261-1)

This update for the Linux Kernel 4.4.121-92114 fixes several issues. The following security issues were fixed : CVE-2018-20856: Fixed a use-after-free in blkdrainqueue due to an improper error handling bsc1156331. CVE-2019-13272: Fixed a privilege escalation from user to root due to improper...

sudo security update

1.8.25p1-8 - RHEL-8.1.0 - fixed CVE-2019-14287 Resolves: rhbz1760696...

SUSE-SU-2019:1973-1 Security update for rmt-server

This update for rmt-server to version 2.3.1 fixes the following issues: - Fix mirroring logic when errors are encountered bsc1140492 - Refactor RMT::Mirror to download metadata/licenses in parallel - Check repo metadata GPG signatures during mirroring bsc1132690 - Add rmt-server-config subpackage...

Rockstar Games: CSRF Vulnerabiliy on Facebook Linkage Page Allows Full Account takerover of Socialclub Accounts.

In this report, the researcher identified a CSRF vulnerability in the account linking process that could have allowed attackers to link their Facebook account to the victim's Social Club account, giving the attacker access to the victim's Social Club account. This attack would have required a...

Memory corruption in SmallVec::grow()

Attempting to call grow on a spilled SmallVec with a value less than the current capacity causes corruption of memory allocator data structures. An attacker that controls the value passed to grow may exploit this flaw to obtain memory contents or gain remote code execution. Credits to @ehuss for...

fsindical.org.br Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8584 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting fsindical.org.br website and its users. Following...

One-Lin3r v2.0 - Gives You One-Liners That Aids In Penetration Testing Operations, Privilege Escalation And More

One-Lin3r is simple modular and light-weight framework gives you all the one-liners that you will need while penetration testing Windows, Linux, macOS or even BSD systems or hacking generally with a lot of new features to make all of this fully automated ex: you won't even need to copy the...

Ultimate Member < 2.0.52 - CSRF and Stored XSS issues

A CSRF vulnerability in adding/editing user roles in Ultimate Member 2.0.49. It also lead to stored XSS. Edit WPScanTeam: July 9th, 2019 - v2.0.50 released and still affected. Escalated to WP Plugins Team July 9th, 2019 - v2.0.51 released, fixing the CSRF but not the XSS July 11th, 2019 - Escalat...

Double-free and use-after-free in SmallVec::grow()

Attempting to call grow on a spilled SmallVec with a value equal to the current capacity causes it to free the existing data. This performs a double free immediately and may lead to use-after-free on subsequent accesses to the SmallVec contents. An attacker that controls the value passed to grow...

ParamPamPam - Brute Force Discover GET And POST Parameters

This tool for brute discover GET and POST parameters. Installation With Docker Install Docker git clone https://github.com/Bo0oM/ParamPamPam.git cd ParamPamPam docker build -t parampp . echo -e '!'"/bin/bash\ndocker run -ti --rm parampp $@" /usr/local/bin/parampp parampp -u "https://vk.com/login"...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM Spectrum Protect Backup-Archive Client NetApp Services (CVE-2018-0737, CVE-2018-0732, CVE-2018-0734)

Summary OpenSSL vulnerabilities were disclosed on April 16, 2018, June 16, 2018. and October 30, 2018 by the OpenSSL Project. OpenSSL, used by the IBM Spectrum Protect formerly Tivoli Storage Manager Backup-Archive Client for network connections with NetApp services, has addressed the applicable...

Security Bulletin: Password disclosure via trace file affects IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments (CVE-2018-1882)

Summary When tracing is enabled, the IBM Spectrum Protect Backup-Archive Client trace file may display the password in plain text. This affects the IBM Spectrum Protect formerly Tivoli Storage Manager Backup-Archive Client and IBM Spectrum Protect for Virtual Environments. Vulnerability Details...