[slackware-security] tcpdump

New tcpdump packages are available for Slackware 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/tcpdump-4.9.1-i586-1slack14.2.txz: Upgraded. This update fixes an issue where tcpdump 4.9.0 allows remote...

[slackware-security] gd

New gd packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/gd-2.2.4-i586-1slack14.2.txz: Upgraded. Fixes security issues: gdImageCreate doesn't check for oversized images and as such is prone to Do...

[slackware-security] expat

New expat packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/expat-2.2.2-i586-1slack14.2.txz: Upgraded. Fixes security issues including: External entity infinite lo...

[slackware-security] mariadb

New mariadb packages are available for Slackware 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mariadb-10.0.31-i586-1slack14.2.txz: Upgraded. This update fixes bugs and security issues. For more information, see:...

[slackware-security] httpd

New httpd packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/httpd-2.4.27-i586-1slack14.2.txz: Upgraded. This update fixes two security issues: Read after free in...

[slackware-security] Slackware 14.0 kernel

New kernel packages are available for Slackware 14.0 to fix security issues. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/linux-3.2.90/: Upgraded. This kernel fixes security issues including "Stack Clash". The issues may result in denial-of-service conditions or may...

[slackware-security] bind

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/bind-9.10.5P2-i586-1slack14.2.txz: Upgraded. This update fixes a high severity security issue: An error ...

[slackware-security] openvpn

New openvpn packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/openvpn-2.3.17-i586-1slack14.2.txz: Upgraded. This update fixes several denial of service issues...

Web Hosting Company Pays $1 Million to Ransomware Hackers to Get Files Back

South Korean web hosting provider has agreed to pay $1 million in bitcoins to hackers after a Linux ransomware infected its 153 servers, encrypting 3,400 business websites and their data, hosted on them. According to a blog post published by NAYANA, the web hosting company, this unfortunate event...

[slackware-security] bind

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/bind-9.10.5P1-i586-1slack14.2.txz: Upgraded. Fixed denial of service security issue: Some RPZ...

Immunity Canvas: SPECIAL_LNK

Name| speciallnk ---|--- CVE| CVE-2017-8464 Exploit Pack| CANVAS Description| speciallnk Notes| References: 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464', 'http://paper.seebug.org/357/', 'http://www.vxjump.net/files/vulnanalysis/cve-2017-8464.txt' CVE Name:...

Input validation

IBM DOORS Next Generation DNG/RRC 4.0, 5.0 and 6.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124756...

[slackware-security] sudo

New sudo packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/sudo-1.8.20p1-i586-1slack14.2.txz: Upgraded. This update fixes a potential overwrite of arbitrary syste...

Zomato: Amazon S3 bucket misconfiguration (share)

Hi, Description I have discovered one of your Amazon S3 bucket and tested it via the AWS command line tool on Linux. It looks like permissions are not well configured and allow dangerous actions to everyone. The vulnerable bucket is: zomato-share PoC: aws s3 ls s3://zomato-share aws s3 cp test...

[slackware-security] kdelibs

New kdelibs packages are available for Slackware 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/kdelibs-4.14.32-i586-1slack14.2.txz: Upgraded. This update fixes a security issue with KAuth that can lead to...

Web Exploit Detector - Tool To Detect Possible Infections, Malicious Code And Suspicious Files In Web Hosting Environments

The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites. Running the application will generate a list of...

Fuze Patches Bug That Exposed Recordings of Private Business Meetings

Fuze, an enterprise-grade voice and video collaboration platform, has patched a vulnerability that exposed recordings of private meetings. A fix was made server-side by Fuze, and a patch was pushed to its endpoint client apps within 11 days of being privately notified by researchers at Rapid7...

wiktel.com XSS vulnerability

Open Bug Bounty ID: OBB-230126 Description| Value ---|--- Affected Website:| wiktel.com Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:...

Tuleap 9.6.99.86 Command Injection Vulnerability

Exploit for php platform in category web applications Tuleap - Command Injection in Project Wiki CVE: CVE-2017-7981 CVSSv3: 9.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C Versions affected: = 8.3 and = 9.6.99.86 Introduction Tuleap is a Libre suite to plan, track, code and...

Node.js Security Scanner: Web Exploit Detector

Node.js Security Scanner: Web Exploit Detector The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites...