[slackware-security] mozilla-nss

New mozilla-nss packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-nss-3.40.1-i586-1slack14.2.txz: Upgraded. Upgraded to nss-3.40.1 and nspr-4.20. Mitigate cache side-channel...

6500 sites down after hackers wipe out database of dark web hosting firm

By Waqas Daniel's Hosting, one of the largest hosting service providers on Dark Web has come under a massive cyber attack forcing its website along with over 6,500 websites hosted on its server to go offline but the damage is way more than that. The hosting administrator, a German software...

[slackware-security] libssh

New libssh packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libssh-0.7.6-i586-1slack14.2.txz: Upgraded. Fixed authentication bypass vulnerability. For more information, see:...

11 million personal unprotected MongoDB records leaked online

By Uzair Amir Another day, another trove of sensitive data exposed online. This time, a MongoDB database containing a whopping 43.5GB of the dataset used in marketing campaigns has been left exposed for public access. The data was discovered by Bob Diachenko, an independent security researcher wh...

[slackware-security] Slackware 14.2 kernel

New kernel packages are available for Slackware 14.2 to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/linux-4.4.157/: Upgraded. This kernel removes the unnecessary vmacacheflushall code which could have led to a use-after-free situation and...

SSA-2018-0906074602

New mozilla-thunderbird packages are available for Slackware 14.2 to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-thunderbird-60.0-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more information,...

Slackware 14.2 mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 14.2 to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-thunderbird-60.0-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more information,...

DNS Rebinding Attack Framework: Singularity

Singularity of Origin is a tool to perform DNS rebinding attacks. It includes the necessary components to rebind the IP address of the attack server DNS name to the target machine’s IP address and to serve attack payloads to exploit vulnerable software on the target machine. It also ships with...

Automattic: Arbitrary File Download as Shopmanager

Due to a flaw in the way WooCommerce handles downloadable products, a shop manager can download arbitrary files on the server. The video shows the exploit and how simple it is: https://www.youtube.com/watch?v=bkrHpqht5SM The function responsible for validating the download file input is the...

[slackware-security] libX11

New libX11 packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libX11-1.6.6-i586-1slack14.2.txz: Upgraded. This update fixes some security issues: Fixed crash on invalid reply...

Input validation

Multiple IBM Rational products are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 135655...

CPU Side-Channel Information Disclosure Vulnerabilities: August 2018

5On August 14th, 2018, three vulnerabilities were disclosed by Intel and security researchers that leverage a speculative execution side-channel method referred to as L1 Terminal Fault L1TF that affects modern Intel microprocessors. These vulnerabilities could allow an unprivileged, local attacke...

GoDaddy Leaks ‘Map of the Internet’ via Amazon S3 Cloud Bucket Misconfig

UPDATE GoDaddy, the world’s largest domain name registrar, has exposed high-level configuration information for tens of thousands of systems and competitively sensitive pricing options for running those systems in Amazon AWS, thanks to yet another cloud storage misconfiguration. The documents wer...

Serve DLL via webdav server

This module simplifies the rundll32.exe Application Whitelisting Bypass technique. The module creates a webdav server that hosts a dll file. When the user types the provided rundll32 command on a system, rundll32 will load the dll remotly and execute the provided export function. The export...

Shipt: Sensitive Clickjacking on admin login page.

A researcher identified that the 3rd party hosted login page for an externally-facing company tool is externally frameable and therefore potentially a vector for clickjacking...

[slackware-security] file

New file packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/file-5.34-i586-1slack14.2.txz: Upgraded. Fixed a denial of service crash when processing a crafted ELF file. For more...

[slackware-security] Slackware 14.2 kernel

New kernel packages are available for Slackware 14.2 to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/linux-4.4.144/: Upgraded. This kernel update enables additional mitigations for spectrev2 IBPB and IBRSFW. It also enables reporting on the...

Rocket.Chat: Slack Token exposed over internet (Github)

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: Slack token is...

Internet Bug Bounty: linkinfo - openbasedir bypass on Windows PHP

Upstream bug - windows linkinfo lacks openbasedir check === https://bugs.php.net/bug.php?id=76459 Summary == Description: ------------ linkinfo function on windows doesn't implement openbasedir check, it can be seen by reviewing the source code. This could be abused to find files on paths outside...

[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.61.0-i586-1slack14.2.txz: Upgraded. This update fixes a buffer overflow in SMTP send. For more information, see:...