Updated openssh packages fix security vulnerability

The dosetupenv function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pamenvironment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as...

SUSE SLES11 Security Update : pam (SUSE-SU-2016:1645-1)

This update for pam fixes two security issues. These security issues were fixed : - CVE-2015-3238: pamunix in conjunction with SELinux allowed for DoS attacks bsc934920. - CVE-2013-7041: Compare password hashes case-sensitively bsc854480. The update package also includes non-security fixes. See...

Warning — Bitcoin Users Could Be Targeted by State-Sponsored Hackers

Another day, another bad news for Bitcoin users. A leading Bitcoin information site is warning users that an upcoming version of the Blockchain consolidation software and Bitcoin wallets could most likely be targeted by "state-sponsored attackers." Recently, one of the world's most popular...

uTorrent Forums User List Stolen

BitTorrent has warned users of its uTorrent client to change their passwords after a third-party breach allowed hackers to walk off with a list of its forum users. “On June 6th, 2016, BitTorrent was made aware of a security issue involving the vendor which powers our forums,” the company said in ...

File Replication Pro Information Disclosure Vulnerability

File Replication Pro is a file management solution for backing up, copying files from different network nodes. An information disclosure vulnerability exists in File Replication Pro version 7.2.0 and earlier. As File Replication Pro allows a malicious user to access arbitrary files on a remote...

Open Real Estate SQL Injection Vulnerability

Open Real Estate CMS is a PHP-based content management system. Open Real Estate suffers from a SQL injection vulnerability that allows unauthenticated users to download database content, including password hashes and client details...

Heuristics File System Secret Search: blueflower

blueflower is a command-line tool that looks for secrets such as private keys or passwords in a file structure. Interesting files are detected using heuristics on their names and on their content. Unlike some forensics tools, blueflower does not search in RAM, and does not attempt to identify...

CVE-2016-2289

Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors...

Directory traversal

Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors...

CVE-2016-2289

Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors...

CVE-2016-2289

ICONICS WebHMI (versions 9 and earlier) suffers a directory traversal flaw (CWE-22) that enables remote attackers to read configuration files and obtain password hashes. Multiple sources (NVD CVE-2016-2289; CNVD-2016-01984; PRION/CVE-2016-2289; ICSA-16-091-01) describe the vulnerability as exploi...

CVE-2016-2289

Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors...

Uber: SQLi in love.uber.com

@iad found an SQL Injection vulnerability in one of our Wordpress blog's plugins the website being love.uber.com. This blog was hosted at WPEngine and did not contain any of our user's information. However due to our previously vague bug bounty rules we decided to reward the maximum of 3,000$ sin...

Machinae - Security Intelligence Collector

Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints. It was inspired by Automater , another excellent tool for collecting information. The Machinae...

Security Intelligence Collector: Machinae

Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints. It was inspired by Automater , another excellent tool for collecting information. The Machinae...

Cerberus Helpdesk User Hash Disclosure

This module extracts usernames and password hashes from the Cerberus Helpdesk through an unauthenticated access to a workers file. Verified on Version 4.2.3 Stable Build 925 and 5.4.4 Module Options msf use auxiliary/gather/cerberus/helpdeskhashdisclosure msf undefinedhelpdeskhashdisclosure show...

Fedora 23 : prosody-0.9.9-2.fc23 (2016-38e48069f8)

Prosody 0.9.9 ============= A summary of changes: Security fixes -------------- Fix path traversal vulnerability in modhttpfiles CVE-2016-1231 Fix use of weak PRNG in generation of dialback secrets CVE-2016-1232 Bugs ---- Improve handling of CNAME records in DNS Fix traceback when deleting a user...

Fedora 22 : prosody-0.9.9-2.fc22 (2016-e289f41b76)

Prosody 0.9.9 ============= A summary of changes: Security fixes -------------- Fix path traversal vulnerability in modhttpfiles CVE-2016-1231 Fix use of weak PRNG in generation of dialback secrets CVE-2016-1232 Bugs ---- Improve handling of CNAME records in DNS Fix traceback when deleting a user...

The vulnerability of the web server for visualizing BACnet/IP network controllers, SAUTER moduWeb Vision, allows a intruder to bypass the authentication process.

The vulnerability of the BACnet/IP network controller visualization web server from SAUTER moduWeb Vision is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures by utilizing knowledge of password hashes without knowi...

Open Real Estate 1.15.1 XSS / SQL Injection / Weak Hashing

Introduction: Open Real Estate is an open source CMS for managing estate agent websites. It is written in PHP and uses the YII CMF. It supports multiple languages. It is supported by MonoRay.net The product has a number of commercial support offerings available and an internal market for...