Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-004

Users without "Administer comments" can set comment visibility on nodes they can edit. Less critical Users who have rights to edit a node, can set the visibility on comments for that node. This should be restricted to those who have the administer comments permission. Cross-site Scripting in http...

Putting Apple Bug Bounty Rewards in Perspective

Admittedly, the payouts for Apple’s bug bounty announced last week at Black Hat drew mixed reactions ranging from reasonable to raucously funny. Apple made a big splash at the annual hacker conference, first via a last-minute announcement that well-regarded Ivan Krstic would be giving a talk on...

Previewing Black Hat 2016, Ivan Krstic's on Apple, Kaminsky's Keynote, And More

Mike Mimoso, Tom Spring, and Chris Brook preview Black Hat 2016, including Ivan Krstic’s talk on Apple/iOS security, Dan Kaminsky’s keynote, IoT, PAC malware, and more. Download: ThreatpostBlackHat2016Preview.mp3 Music by Chris Gonsalves...

ivan-elkin.ru Open Redirect vulnerability

Open Bug Bounty ID: OBB-140577 Description| Value ---|--- Affected Website:| ivan-elkin.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

ivan-elkin.ru XSS vulnerability

Vulnerable URL: http://ivan-elkin.ru/go/message.php?mestype=1565 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 688823 Google Pagerank| 3 VIP website status:| No Check ivan-elkin.r...

Debian Security Advisory DSA 3332-1 (wordpress - security update)

Several vulnerabilities have been fixed in Wordpress, the popular blogging engine. CVE-2015-2213 SQL Injection allowed a remote attacker to compromise the site. CVE-2015-5622 The robustness of the shortcodes HTML tags filter has been improved. The parsing is a bit more strict, which may affect yo...

Vulnerability in OpenSSL - Invalid free in DTLS

This vulnerability does not affect current versions of OpenSSL. It existed in previous OpenSSL versions and was fixed in June 2014. If a DTLS peer receives application data between the ChangeCipherSpec and Finished messages, buffering of such data may cause an invalid free, resulting in a...

Updated python-dulwich packages fix security vulnerabilities

Updated python-dulwich package fixes security vulnerabilities: It was discovered that Dulwich allows writing to files under .git/ when checking out working trees. This could lead to the execution of arbitrary code with the privileges of the user running an application based on Dulwich...

PACTware Exceptional Conditions Vulnerability

OVERVIEW Ivan Sanchez from Nullcode Team has identified a handling of exceptional conditions vulnerability in PACTware Consortium’s PACTware application. PACTware Consortium has produced a new service pack that mitigates this vulnerability. Ivan Sanchez has tested the new version to validate that...

Mandriva Linux Security Advisory : yaml (MDVSA-2015:060)

Updated yaml packages fix security vulnerabilities : Florian Weimer of the Red Hat Product Security Team discovered a heap-based buffer overflow flaw in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a YAML document with a specially crafted tag that, when...

Security fix for the ALT Linux 8 package krb5 version 1.13-alt3

Feb. 8, 2015 Ivan A. Melnikov 1.13-alt3 - fix for MITKRB5-SA-2015-001 CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423...

Security fix for the ALT Linux 9 package krb5 version 1.13-alt3

Feb. 8, 2015 Ivan A. Melnikov 1.13-alt3 - fix for MITKRB5-SA-2015-001 CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423...

Security fix for the ALT Linux 7 package krb5 version 1.13-alt3

Feb. 8, 2015 Ivan A. Melnikov 1.13-alt3 - fix for MITKRB5-SA-2015-001 CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423...

Vulnerability in OpenSSL - Information leak in pretty printing functions

A flaw in OBJobj2txt may cause pretty printing functions such as X509nameoneline, X509nameprintex, to leak some information from the stack. Applications may be affected if they echo pretty printing output to the attacker. OpenSSL SSL/TLS clients and servers themselves are not affected. Found by...

SLMail 5.5 - Remote Buffer Overflow Exploit

No description provided by source. / SLMAIL REMOTE PASSWD BOF - Ivan Ivanovic Ivanov ????-????? ???????????????? 31337 Team / include string.h include stdio.h include winsock2.h include windows.h // bind 4444 unsigned char shellcode = \xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x...

Linux x86 - execve /bin/sh - 21 bytes

No description provided by source. / execve /bin/sh - x86/linux - 21 bytes . zeroed argv / envp [email protected] [email protected] thanks : ivan, milo, oldschool crew / int main char sc = \x6a\x0b // push byte +0xb \x58 // pop eax \x99 // cdq \x52 // push edx...

Vulnerability in OpenSSL - Anonymous ECDH denial of service

OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack. Found by Felix Gröbert and Ivan Fratrić Google...

Ubuntu Update for libyaml-libyaml-perl USN-2161-1

Check for the Version of libyaml-libyaml-perl OpenVAS Vulnerability Test $Id: gbubuntuUSN21611.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for libyaml-libyaml-perl USN-2161-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net Thi...

Ubuntu 12.04 LTS / 12.10 / 13.10 : libyaml-libyaml-perl vulnerabilities (USN-2161-1)

Florian Weimer discovered that libyaml-libyaml-perl incorrectly handled certain large YAML documents. An attacker could use this issue to cause libyaml-libyaml-perl to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2013-6393 Ivan Fratric discovered that...

Ubuntu 12.04 LTS / 12.10 / 13.10 : libyaml vulnerability (USN-2160-1)

Ivan Fratric discovered that LibYAML incorrectly handled certain malformed YAML documents. An attacker could use this issue to cause LibYAML to crash, resulting in a denial of service, or possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description...