RedHat Update for glibc RHSA-2017:1916-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

gstreamer-plugins-bad-free: Use after free in gst_mini_object_unref / gst_tag_list_unref / gst_mxf_demux_update_essence_tracks

Multiple use-after-free vulnerabilities in the 1 gstminiobjectunref, 2 gsttaglistunref, and 3 gstmxfdemuxupdateessencetracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service crash via vectors involving stream tags, as demonstrated by 02785736.mxf...

glibc: Unbounded stack allocation in nan* functions

A stack overflow vulnerability was found in nan functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code...

The CIO Will Report to the CISO: The Why

Note: This article originally appeared on LinkedIn Pulse. If you disagree with me, please visit the LinkedIn post to join the comments we've gotten so far. As a community we need the open discussion to advance our collective thinking. If you agree, please like, comment and/or share the post. It’s...

Remote Code Execution (RCE)

Symfony is vulnerable to remote code execution RCE. A malicious user can pass a serialized PHP object to YAML:parse or Yaml\Parser::parse functions to inject and execute arbitrary code...

PT-2017-12178

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Event Log Analyzer versions 11.4 through 11.5 Description The issue concerns multiple persistent cross-site scripting XSS vulnerabilities. These vulnerabilities are found in the Event log parsing and Display functions, allowi...

CVE-2017-11687: Improper Neutralization of Input During Web Page Generation

Multiple Persistent cross-site scripting XSS vulnerabilities in Event log parsing and Display functions in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML via syslog...

Information Disclosure

Moodle is vulnerable to information disclosure. The library functions coreenrolgetcourseenrolmentmethods and enrolselfgetinstanceinfo don't check course visibility permissions, allowing a malicious user to access hidden courses...

REDDOX Multiple Vulnerabilities

REDDOXX Appliance is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:reddoxx:reddoxappliance";...

[SECURITY] Fedora 25 Update: glpi-9.1.5-1.fc25

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion Exploit

Exploit for windows platform in category dos / poc PvarGetArithVal; VAR arithv2 = v2-PvarGetArithVal; int resulttype = resultlookuptablev1-vartypev2-vartype; ifresulttype == 10 RaiseError...; ifresulttype == 2 ... else ifresulttype == 3 ... else ifresulttype == 4 ... v1-vartype = resulttype; wher...

Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion

Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion PvarGetArithVal; VAR arithv2 = v2-PvarGetArithVal; int resulttype = resultlookuptablev1-vartypev2-vartype; ifresulttype == 10 RaiseError...; ifresulttype == 2 ... else ifresulttype == 3 ... else ifresulttyp...

Security Bypass

jetpack is vulnerable to security bypass. The library does not properly restrict access to it's XMLRPC functions, allowing a malicious user to view confidential information or publish posts without the proper permissions...

New Point-of-Sale Malware LockPoS Hitches Ride with FlokiBot

Botnets distributing FlokiBot point-of-sale malware have awoken from months of slumber and are back in business spewing a new malware dubbed LockPoS. Researchers say the malware is still flying under the radar of many antivirus and intrusion detection systems because it’s so new. Currently, LockP...

deltafaucet.ca XSS vulnerability

Vulnerable URL: http://www.deltafaucet.ca/bath/collection/ara.html?"--!"=bath-tubshower Details: Description| Value ---|--- Patched:| No Latest check for patch:| 23.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 539057 VIP website status:| No Check...

ICSA-17-187-03F Siemens SIPROTEC 4 and SIPROTEC Compact (Update F)

CVSS v3 8.6 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: SIPROTEC 4 and SIPROTEC Compact Vulnerabilities: Improper Input Validation, Missing Authorization, Improper Authentication UPDATE INFORMATION This updated advisory is a follow-up to the updated...

Capability Bypass

Moodle is vulnerable to capability bypass. A malicious user can edit topics without the required permissions when using the course-editing functions...

The vulnerability of the FFmpeg multimedia library, which allows a hacker to perform recording beyond the memory limit

The vulnerability of the FFmpeg multimedia library arises from an overflow in the buffer in the dynamic memory. Exploiting this vulnerability allows a malicious actor to perform write operations beyond the memory boundaries, related to the function ipvideodecodeblockopcode0xA in...

PHPMailer Cross-Site Scripting Vulnerability

PHPMailer is a package of PHP functions for sending e-mail . A cross-site scripting vulnerability exists in PHPMailer. An attacker can exploit this vulnerability to obtain user login cookie information...

The vulnerability of DnD supervisor functions in VMware Fusion and VMware Workstation allows a hacker to execute arbitrary code.

The vulnerability of DnD supervisor functions in VMware Fusion and VMware Workstation arises from the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the operating system remotely...