Electrum Python Console Security Vulnerability

Electrum is a lightweight Bitcoin client software, and Python console is one of the Python console programs.A security vulnerability exists in the Python console in Electrum versions 2.9.4 and earlier, and versions 3.x through 3.0.5. The vulnerability can be exploited by an attacker to steal...

DRUPAL-CONTRIB-2020-030

This module enables you to hand out permissions on a smaller subset, section or community of your website. The module used to leverage the node grants system but turned it off in its recent 8.x-1.0 release in favor of a system that works for ALL entity types, not just nodes. By doing so, some...

@balderdash/sails-edge (>=0.12.0-edge9 <=0.50.0), @fahslaj/test-1 (>=1.0.0 <=1.0.12) +96 more potentially affected by CVE-2018-21036 via sails-hook-sockets (>=0.12.3 <=1.4.3)

sails-hook-sockets NPM version =0.12.3, =0.12.0-edge9, =1.0.0, =1.1.8, =0.0.0, =0.0.0, =1.2.0, =1.2.26 - ctartist621-sails =0.12.3 and more Source cves: CVE-2018-21036 Source advisory: OSV:GHSA-F7F4-HQP2-7PRC...

Denial Of Service (DoS)

sails-hook-sockets is vulnerable to denial of service DoS. An attacker can send a WebSocket request with an empty string to the URL pathname variable to trigger an application crash as the error was not handled...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4413-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4413-1 advisory. Matthew Sheets discovered that the SELinux network label handling implementation in the Linux kernel could be coerced into de-referencing a NULL pointer....

USN-4390-1: Linux kernel vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform bounds checking on xattrs in some situations. A local attacker could possibly use this to expose...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:1599-1)

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called...

SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1603-1)

The SUSE Linux Enterprise 12 SP4 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which...

AndroidSecNotes

原文 by 瘦蛟舞 0x00 序 随着移动安全越来越火,各种调试工具也都层出不穷,但因为环境和需求的不同,并没有工具是万能的。另外工具是死的,人是活的,如果能搞懂工具的原理再结合上自身的经验,你也可以创造出属于自己的调试武器。因此,笔者将会在这一系列文章中分享一些自己经常用或原创的调试工具以及手段,希望能对国内移动安全的研究起到一些催化剂的作用。 文章中所有提到的代码和工具都可以在我的github下载到,地址是: https://github.com/zhengmin1989/TheSevenWeapons 0x01 利用函数挂钩实现native层的hook...

Node.js third-party modules: [commit-msg] RCE via insecure command formatting

I would like to report a RCE issue in the commit-msg module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: commit-msg version: 0.2.3 npm page: https://www.npmjs.com/package/commit-msg Module Description commit-msg is a customizable git commit message...

UBUNTU-CVE-2020-10751

A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages...

CVE-2020-10751

The issue CVE-2020-10751 affects the Linux kernel SELinux LSM hook. It incorrectly validates only the first Netlink message in an skb, causing subsequent messages in the same skb to be granted permissions without further processing. This could enable bypass of SELinux netlink restrictions and, pe...

Electrum Python Console Security Vulnerability

Electrum is a lightweight Bitcoin client software, and Python console is one of the Python console programs.A security vulnerability exists in the Python console in Electrum versions 2.9.4 and earlier, and versions 3.x through 3.0.5. The vulnerability can be exploited by an attacker to steal...

Runtime Mobile Security (RMS) - A Powerful Web Interface That Helps You To Manipulate Android Java Classes And Methods At Runtime

Runtime Mobile Security RMS , powered by FRIDA, is a powerful web interface that helps you to manipulate Android Java Classes and Methods at Runtime. You can easily dump all the loaded classes and relative methods, hook everything on the fly, trace methods args and return value, load custom scrip...

CVE-2019-7306

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

CVE-2019-7306

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

DEBIAN-CVE-2019-7306

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

UBUNTU-CVE-2019-7306

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

CVE-2019-7306

CVE-2019-7306 concerns Byobu, where the Apport hook may disclose sensitive information by auto-uploading the local user’s .screenrc (potentially exposing hostnames, usernames, and passwords). The connected OSV/Ubuntu entries confirm Byobu as the affected component and describe the disclosure risk...

CVE-2019-7306 Byobu apport hook uploads user's ~/.screenrc

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...