SUSE-SU-2019:3066-1 Security update for clamav

This update for clamav fixes the following issues: Security issue fixed: - CVE-2019-12625: Fixed a ZIP bomb issue by adding detection and heuristics for zips with overlapping files bsc1144504. - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors bsc1149458...

SUSE-SU-2019:3053-1 Security update for clamav

This update for clamav fixes the following issues: Security issue fixed: - CVE-2019-12625: Fixed a ZIP bomb issue by adding detection and heuristics for zips with overlapping files bsc1144504. - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors bsc1149458...

WordPress Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting Exploit Author: Unk9vvN Vendor Homepage: https://duplicate-post.lopo.it/ Software Link: https://wordpress.org/plugins/duplicate-post/ Version: 3.2.3 Tested on: Kali Linux CV...

OPENSUSE-SU-2019:1895-1 Security update for ledger

This update for ledger fixes the following issues: ledger was updated to 3.1.3: + Properly reject postings with a comment right after the flag bug 1753 + Make sorting order of lot information deterministic bug 1747 + Fix bug in tag value parsing bug 1702 + Remove the org command, which was always...

SUSE-SU-2019:1895-1 Security update for tomcat

This update for tomcat to version 9.0.21 fixes the following issues: Security issues fixed: - CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to streams with excessive numbers of SETTINGS frames bsc1131055. - CVE-2019-0221: Fixed a cross site scripting vulnerability...

Does Zero Trust Security Have to be Hard to be Effective?

The short answer is no. As expected, the long answer is a little more nuanced. But first, a quick refresher on Zero Trust security for those who haven't jumped on the bandwagon yet. For those who have, feel free to skip the next section. Zero Trust Security Recap We know that the defensible netwo...

The vulnerability of the Postgresql database management system in the Astra Linux operating system allows a perpetrator to gain access to confidential data and cause service interruptions.

The vulnerability of the Postgresql database management system in the Astra Linux operating system is related to an error in the interaction with LDAP via parsec calls when retrieving user security attributes. Exploiting this vulnerability allows a malicious actor to gain access to information...

As Predicted, Mobile Continued eCommerce Dominance Over the Holiday Weekend

Akamai predicted in September 2018 that mobile shopping would continue its growth this holiday shopping season. That prediction held true as we saw mobile devices increase their share of Black Friday online shopping traffic volume to 57.55%, with desktop traffic dropping to 35.91%. And for the...

How to Make the Payment Process Easy for Online Customers

By Carolina If you want to increase conversions and sales, a good place to start is to make it as easy as possible for them to pay for your services or products. If your checkout page isn’t easy to use, it won’t matter how good your products or services are. Your checkout page is where they get …...

Admidio 3.3.5 - Cross-Site Request Forgery (Change Permissions)

Exploit Title: Admidio 3.3.5 - Cross-Site Request Forgery Change Permissions Author: Nawaf Alkeraithe Date: 2018-09-01 Vendor Homepage: https://www.admidio.org/ Software Link: https://sourceforge.net/projects/admidio/files/Admidio/3.3.x/admidio-3.3.5.zip/download Version: 3.3.5 Tested on: PHP CVE...

Integer overflow

An integer overflow in the distributeBTR function of a smart contract implementation for Bitcoin Red BTCR, an Ethereum ERC20 token, allows the owner to accomplish an unauthorized increase of digital assets by providing a large address array, as exploited in the wild in May 2018, aka the...

CVE-2018-11687

An integer overflow in the distributeBTR function of a smart contract implementation for Bitcoin Red BTCR, an Ethereum ERC20 token, allows the owner to accomplish an unauthorized increase of digital assets by providing a large address array, as exploited in the wild in May 2018, aka the...

CVE-2018-11687

CVE-2018-11687 concerns Bitcoin Red (BTCR) ERC20 smart contracts. The issue is an integer overflow in the contract’s distributeBTR function, enabling the owner to unethically increase their balance by deploying a large address[] array. Descriptions in multiple sources confirm the vulnerability in...

CVE-2018-11687

An integer overflow in the distributeBTR function of a smart contract implementation for Bitcoin Red BTCR, an Ethereum ERC20 token, allows the owner to accomplish an unauthorized increase of digital assets by providing a large address array, as exploited in the wild in May 2018, aka the...

Integer overflow

An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER EETHER, an Ethereum ERC20 token, will lead to an unauthorized increase of an attacker's digital assets...

CVE-2018-11561

An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER EETHER, an Ethereum ERC20 token, will lead to an unauthorized increase of an attacker's digital assets...

CVE-2018-11561

CVE-2018-11561 affects the EETHER ERC20 smart contract; an integer overflow in the unprotected distributeToken function enables an attacker to illegitimately increase their digital assets. The vulnerability is described in multiple sources (NVD/CNVD) as a token-amount overflow in the distributeTo...

Keeping False Positives in Check

In 2017, seven out of ten organizations said their security risks increased significantly, according to a Ponemon Institute study. This is no surprise given that last year organizations suffered the largest ransomware outbreak in history WannaCry and vulnerabilities such as Meltdown and Spectre...

CVE-2018-12079

The mintToken function of a smart contract implementation for Substratum SUB, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...

Design/Logic Flaw

The mintToken function of a smart contract implementation for Target Coin TGT, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...