Web.com Data Breach

Update Florida-based web hosting company Web.com on Tuesday announced that it had suffered a data breach and payment card and personal information belonging to 93,000 customers was accessed. The company did not say in a statement or press release whether the stolen data was encrypted, nor how it...

[slackware-security] mozilla-nss

New mozilla-nss packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mozilla-nss-3.19.2-i486-1slack14.1.txz: Upgraded. This release contains security fixes and improvements. For more...

GTLVote 1.1 SQL Injection

Exploit Title: GTLVote 1.1 SQLi Injection Vulnerability. + Discovered By: Jackson Security Engineer @ Panel Solutions + Worried about being attacked by a 0day? We secure your web applications before an attack occurs @ Secure Hosting Solutionhttp://panelsec.com/ + My Homepage: http://panelsec.com/...

[SECURITY] Fedora 22 Update: fusionforge-5.3.2-4.fc22

FusionForge provides many tools to aid collaboration in a development project, such as bug-tracking, task management, mailing-lists, SCM repository, forums, support request helper, web/FTP hosting, release management, etc. All these services are integrated into one web site and managed through a...

redis -- EVAL Lua Sandbox Escape

Ben Murphy reports: It is possible to break out of the Lua sandbox in Redis and execute arbitrary code. This shouldn’t pose a threat to users under the trusted Redis security model where only trusted users can connect to the database. However, in real deployments there could be databases that can...

Vesta Control Panel Cross-Site Request Forgery Vulnerability

Vesta Control Panel is an open source web hosting control panel. A cross-site request forgery vulnerability exists in Vesta Control Panel. As the program fails to properly validate HTTP requests. An attacker could use this vulnerability to perform unauthorized actions on a user's logged in...

Multiple Vulnerabilities in ISPConfig

High-Tech Bridge Security Research Lab discovered two vulnerabilities in a popular hosting control panel ISPConfig. The vulnerabilities can be exploited to execute arbitrary SQL commands in application database, perform a CSRF attack and gain complete control over the web application. 1 SQL...

Several Factors Mitigate VENOM's Utility for Attackers

The divisive VENOM vulnerability—marketing logo and all—has been good for three solid days of debate and angst over its severity, ease of exploitation and risks. The first public proof-of-concept exploit, however, may aid in calming some of the anxiety around the bug, which is proving difficult t...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.1 and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mozilla-firefox-31.7.0esr-i486-1slack14.1.txz: Upgraded. This release contains security fixes and improvements. For more...

[slackware-security] seamonkey

New seamonkey packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/seamonkey-2.33.1-i486-1slack14.1.txz: Upgraded. This update contains security fixes and improvements. For more information,...

[slackware-security] libssh

New libssh packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/libssh-0.6.4-i486-1slack14.1.txz: Upgraded. This update fixes some security issues. For more information, see:...

Watcher v1.5.8 - Web Security Testing Tool and Passive Vulnerability Scanner

Watcher is a runtime passive-analysis tool for HTTP-based Web applications. Being passive means it won't damage production systems, it's completely safe to use in Cloud computing, shared hosting, and dedicated hosting environments. Watcher detects Web-application security issues as well as...

Weebly.com Insecure Direct Object Reference

Title: Hijack any website from weebly.com by just adding an administrator to their website. Insecure Direct Object Reference Vulnerability ===== Weebly is a web-hosting service that allows the user to “drag-and-drop” while using their website builder. As of August 2012, Weebly hosts over 20 milli...

[slackware-security] samba

New samba packages are available for Slackware 14.1 and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/samba-4.1.17-i486-1slack14.1.txz: Upgraded. This package fixes security issues since the last update: BUG 11077: CVE-2015-0240: talloc...

ec2-175-41-150-229.ap-southeast-1.compute.amazonaws.com XSS vulnerability

Open Bug Bounty ID: OBB-55196 Description| Value ---|--- Affected Website:| ec2-175-41-150-229.ap-southeast-1.compute.amazonaws.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediati...

The Pirate Bay Goes Down Again and Again... and Then Once Again

Since its return over a month ago, The Pirate Bay — the infamous peer-to-peer file sharing website that has provided only the finest in illegal torrents for more than a decade — has suffered a lot to keep the ship afloat. But, now TPB is experiencing yet more downtime. The Pirate Bay TPB torrent...

[slackware-security] patch

New patch packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/patch-2.7.4-i486-1slack14.1.txz: Upgraded. Patch no longer follows symbolic links to input and output files...

File Hosting Service RapidShare Shutting Down

Remember RapidShare? Once one of the world's most popular and first ever one-click online file hosting and cloud storage website on the Internet. The company has announced that it will shut down its business at the end of next month. RapidShare file hosting service announced its shut down Tuesday...

GoDaddy Vulnerability Allows Domain Hijacking

An Internet domain registrar and web hosting company GoDaddy has patched a Cross-Site Request Forgery CSRF or XSRF vulnerability that allowed hackers and malicious actors to hijack websites registered with the domain registration company. The vulnerability was reported to GoDaddy on Saturday by...

[slackware-security] openssl

New openssl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/openssl-1.0.1k-i486-1slack14.1.txz: Upgraded. This update fixes several security issues: DTLS segmentation...