Secret Sister scam returns in time for Christmas

The festive season may be imminent, but it’s a Facebook Secret Sister not Santa you have to steer clear of. Secret Sister has been a mainstay of Yuletide scams since at least 2015, and has come back around once more. But what is it? Your office probably has a Secret Santa scheme in place. You dra...

CVE-2018-19218

In LibSass 3.5-stable, there is an illegal address access at Sass::Parser::parsecssvariablevaluetoken that will lead to a DoS attack...

CVE-2018-19219

In LibSass 3.5-stable, there is an illegal address access at Sass::Eval::operator that will lead to a DoS attack...

CVE-2018-19218

In LibSass 3.5-stable, there is an illegal address access at Sass::Parser::parsecssvariablevaluetoken that will lead to a DoS attack...

Code injection

In LibSass 3.5-stable, there is an illegal address access at Sass::Parser::parsecssvariablevaluetoken that will lead to a DoS attack...

CVE-2018-19219

In LibSass 3.5-stable, there is an illegal address access at Sass::Eval::operator that will lead to a DoS attack...

CVE-2018-19218

In LibSass 3.5-stable, there is an illegal address access at Sass::Parser::parsecssvariablevaluetoken that will lead to a DoS attack...

CVE-2018-19219

CVE-2018-19219 affects LibSass 3.5-stable, where an illegal address access in the function Sass::Eval::operator can lead to a denial of service. The Connected documents consistently describe the same issue, with no public details on vulnerable configurations beyond LibSass 3.5-stable. Relevant im...

CVE-2018-19218

CVE-2018-19218 affects LibSass 3.5-stable. The vulnerability is an illegal address access in Sass::Parser::parse_css_variable_value_token, causing a denial of service. The connected documents confirm the component and root cause but do not provide a concrete patch/version for remediation. Exploit...

Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

The exception handling code in Eclipse Jetty prior to 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak...

Amazon Linux 2 : kernel (ALAS-2018-1100)

An issue was discovered in the procpidstack function in fs/proc/base.c in the Linux kernel. An attacker with a local account can trick the stack unwinder code to leak stack contents to userspace. The fix allows only root to inspect the kernel stack of an arbitrary task.CVE-2018-17972 A...

Code injection

In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure. Consequently, when small public exponents are being used, a remote attacker can generate purposefully crafted signatures and put them on X.50...

LuminosityLink Hacking Tool Author Gets 30-Months Prison Sentence

A 21-year-old Kentucky man who previously pleaded guilty to developing, marketing, and selling an infamous remote access trojan RAT called LuminosityLink has now been sentenced to 30 months in prison. According to a press release published Monday by U.S. Attorney's Office, Colton Grubbs, who used...

Fluxion - Set Up Fake AP, Fake DNS, And Create Captive Portal To Trick Users Into Giving You Their Password

Fluxion is a security auditing and social-engineering research tool. It is a remake of linset by vk496 with hopefully less bugs and more functionality. The script attempts to retrieve the WPA/WPA2 key from a target access point by means of a social engineering phishing attack. It's compatible wit...

Fedora 27 : php (2018-6f37f99641)

PHP version 7.1.20 19 Jul 2018 Core: - Fixed bug php76534 PHP hangs on 'illegal string offset on string references with an error handler. Laruence - Fixed bug php76502 Chain of mixed exceptions and errors does not serialize properly. Nikita Date: - Fixed bug php76462 Undefined property:...

Denial Of Service (DoS)

libtiff.so is vulnerable to denial of service attacks. The thumbnail command causes an illegal read to occur in the tagCompare function in tifdirinfo.c which results in a denial of service condition...

Microsoft Wireless Display Adapter Command Injection Vulnerability

A command injection vulnerability exists in the Microsoft Wireless Display Adapter MWDA when the Microsoft Wireless Display Adapter does not properly manage user input. For this vulnerability to be exploited, the attacker must be authenticated logged on to the target display. To exploit the...

Jiuan File Outgoing Bodyguard has a Denial of Service Vulnerability

JiuAn Outgoing File Bodyguard is a software from Chengdu JiuAn Technology Co., Ltd. that can encrypt and package outgoing files to prevent them from being leaked during the outgoing process. After installation, it has both file encryption and cipher text reading functions. A denial-of-service...

Memory Corruption Vulnerability in NA-VIEW

Nanda Aotuo Technology Jiangsu Co., Ltd. specializes in the research, development, production and sales of programmable logic controllers PLC, has formed a large and medium-sized PLC products as the main products, supplemented by small PLC products, remote measurement and control unit RTU, touch...

Memory Corruption Vulnerability in NAPro

Nanda Aotuo Technology Jiangsu Co., Ltd. specializes in the research, development, production and sales of programmable logic controllers PLC, has formed a large and medium-sized PLC products as the main products, supplemented by small PLC products, remote measurement and control unit RTU, touch...