Amazon Linux AMI : glibc (ALAS-2017-877)

Unbounded stack allocation in catopen function A stack based buffer overflow vulnerability was found in the catopen function. An excessively long string passed to the function could cause it to crash or, potentially, execute arbitrary code.CVE-2015-8779 Integer overflow in hcreate and hcreater An...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2017:1916 An update for glibc is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2015-5224

The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks...

Fedora 26 : php-horde-Horde-Core (2017-1929be4354)

HordeCore 2.30.0 - jan SECURITY: Fix XSS vulnerability with pathinfo component in Horde::selfUrl. - jan Deprecate Horde::redirect. - jan Add Horde::signUrl and Horde::verifySignedUrl. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

http-jsonp-detection NSE Script

Attempts to discover JSONP endpoints in web servers. JSONP endpoints can be used to bypass Same-origin Policy restrictions in web browsers. The script searches for callback functions in the response to detect JSONP endpoints. It also tries to determine callback function through URLcallback functi...

RedHat Update for glibc RHSA-2017:1916-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

gstreamer-plugins-bad-free: Use after free in gst_mini_object_unref / gst_tag_list_unref / gst_mxf_demux_update_essence_tracks

Multiple use-after-free vulnerabilities in the 1 gstminiobjectunref, 2 gsttaglistunref, and 3 gstmxfdemuxupdateessencetracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service crash via vectors involving stream tags, as demonstrated by 02785736.mxf...

glibc: Unbounded stack allocation in nan* functions

A stack overflow vulnerability was found in nan functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code...

The CIO Will Report to the CISO: The Why

Note: This article originally appeared on LinkedIn Pulse. If you disagree with me, please visit the LinkedIn post to join the comments we've gotten so far. As a community we need the open discussion to advance our collective thinking. If you agree, please like, comment and/or share the post. It’s...

Remote Code Execution (RCE)

Symfony is vulnerable to remote code execution RCE. A malicious user can pass a serialized PHP object to YAML:parse or Yaml\Parser::parse functions to inject and execute arbitrary code...

PT-2017-12178

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Event Log Analyzer versions 11.4 through 11.5 Description The issue concerns multiple persistent cross-site scripting XSS vulnerabilities. These vulnerabilities are found in the Event log parsing and Display functions, allowi...

CVE-2017-11687: Improper Neutralization of Input During Web Page Generation

Multiple Persistent cross-site scripting XSS vulnerabilities in Event log parsing and Display functions in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML via syslog...

Information Disclosure

Moodle is vulnerable to information disclosure. The library functions coreenrolgetcourseenrolmentmethods and enrolselfgetinstanceinfo don't check course visibility permissions, allowing a malicious user to access hidden courses...

REDDOX Multiple Vulnerabilities

REDDOXX Appliance is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:reddoxx:reddoxappliance";...

[SECURITY] Fedora 25 Update: glpi-9.1.5-1.fc25

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion Exploit

Exploit for windows platform in category dos / poc PvarGetArithVal; VAR arithv2 = v2-PvarGetArithVal; int resulttype = resultlookuptablev1-vartypev2-vartype; ifresulttype == 10 RaiseError...; ifresulttype == 2 ... else ifresulttype == 3 ... else ifresulttype == 4 ... v1-vartype = resulttype; wher...

Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion

Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion PvarGetArithVal; VAR arithv2 = v2-PvarGetArithVal; int resulttype = resultlookuptablev1-vartypev2-vartype; ifresulttype == 10 RaiseError...; ifresulttype == 2 ... else ifresulttype == 3 ... else ifresulttyp...

Security Bypass

jetpack is vulnerable to security bypass. The library does not properly restrict access to it's XMLRPC functions, allowing a malicious user to view confidential information or publish posts without the proper permissions...

New Point-of-Sale Malware LockPoS Hitches Ride with FlokiBot

Botnets distributing FlokiBot point-of-sale malware have awoken from months of slumber and are back in business spewing a new malware dubbed LockPoS. Researchers say the malware is still flying under the radar of many antivirus and intrusion detection systems because it’s so new. Currently, LockP...

deltafaucet.ca XSS vulnerability

Vulnerable URL: http://www.deltafaucet.ca/bath/collection/ara.html?"--!"=bath-tubshower Details: Description| Value ---|--- Patched:| No Latest check for patch:| 23.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 539057 VIP website status:| No Check...