SUSE-SU-2016:0341-1 Security update for Kernel live patch 10

This kernel live patch for Linux Kernel 3.12.51-52.34.1 fixes one security issue: - A reference leak in keyring handling with joinsessionkeyring could lead to local attackers gain root privileges. bsc962075, CVE-2016-0728...

ffmpeg: information leakage

A vulnerability in the way FFmpeg handles the concat CVE-2016-1897 and subfile CVE-2016-1898 protocols in a HTTP Live Streaming HLS M3U8 file allows a remote attacker to conduct a cross-origin attacks, and to access arbitrary local files on the vulnerable host. The attack uses a crafted M3U8 file...

CVE-2016-1898

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file...

CVE-2016-1897

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file...

CVE-2016-1897

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file...

DEBIAN-CVE-2016-1898

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file...

CVE-2016-1898

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file...

CVE-2016-1897

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file...

CVE-2016-1897

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file...

CVE-2016-1898

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file...

CVE-2016-1898

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file...

PT-2016-1144 · FFmpeg +1 · Ffmpeg +1

Name of the Vulnerable Software and Affected Versions: FFmpeg versions 2.x Description: The issue allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file. This leads to an external HTTP request where the...

UBUNTU-CVE-2016-1897

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file...

HackerOne: HackerOne is still prone to Internet Explorer UXSS

Hi, I have managed to leverage CVE 2015-0072, so that the attack will work with any framed resource protected by X-Frame-Options: DENY header. According to 103787, only https://hackerone.com/cdn-cgi/trace was unprotected and now its already fixed. In my PoC I used several X-Frame-Options protecte...

VK.com: Изменение текстов вариантов ответа в опросах

Работает в профилях/группах с открытой стеной и на любых публичных страницах. 1 При помощи wall.getById получаем ид нужного опроса 2 При помощи wall.post отправляем пост с нужным опросом в предложенные новости паблика или на стену профиля/группы непосредственно изначально создавших опрос. 3...

GoAutoDial CE 3.3 - Multiple Vulnerabilities

Exploit for php platform in category web applications Title : GoAutoDial CE 3.3 Multiple SQL injections, Command Injection Date : 06/12/2015 Author : R-73eN Tested on : goautodial-32bit-ce-3.3-final Software : http://goautodial.org/ | | / | / | / \ | | | || ' | | / | | / \ ' \ / \ | | | || | | |...

Hackers Plan to Ruin Christmas Eve for Millions of PlayStation and Xbox Live Gamers

Remember the notorious hacker group Lizard Squad that spoiled last Christmas holidays of many game lovers by knocking the PlayStation Network and Xbox Live offline with apparent Distributed Denial of Service DDoS attacks? But, Will you be able to Play Xbox and PlayStation Game this Christmas?...

Shopify: [livechat.shopify.com] Cookie bomb at customer chats

When we visit the https://livechat.shopify.com/customer/chats/new page the ref and ssid URL parameters are used to set cookie values the way as follows: var getURLParameter = functionname return decodeURIComponentnew RegExp'?|&' + name + '=' + '^&;+?&||;|$'.execlocation.search||,""1.replace/+/g,...

Microsoft Windows Xbox Live Certificate Disclosure Vulnerability

Microsoft windows is a popular operating system. The private key used for .xboxlive.com SSL/TLS certificates on Microsoft Windows systems has been compromised, allowing remote attackers to exploit the vulnerability for man-in-the-middle attacks...

Adobe Flash HLS Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of HTTP...