Debian DLA-1526-1 : 389-ds-base security update

It was discovered that the emergency logging system in 389-ds-base the 389 Directory Server is affected by a race condition caused by the invalidation of the concurrently used log file file descriptor without proper locking. This issue might be triggered by remote attackers to cause DoS crash and...

[SECURITY] [DLA 1526-1] 389-ds-base security update

Package : 389-ds-base Version : 1.3.3.5-4+deb8u3 CVE ID : CVE-2018-14624 It was discovered that the emergency logging system in 389-ds-base the 389 Directory Server is affected by a race condition caused by the invalidation of the concurrently used log file file descriptor without proper locking...

SUSE-SU-2018:2899-1 Security update for smt

This update for smt to 2.0.34 fixes the following issues: These security issues were fixed: - CVE-2018-12471: Xml External Entity processing in the RegistrationSharing modules allowed to read arbitrary file read bsc1103809 - CVE-2018-12470: SQL injection in RegistrationSharing module allows remot...

Ubuntu 18.04 LTS : UDisks vulnerability (USN-3772-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3772-1 advisory. It was discovered that UDisks incorrectly handled format strings when logging. A local attacker could possibly use this issue to cause a denial of service or obta...

Mail Security Tester - A Testing Framework For Mail Security And Filtering Solutions

A testing framework for mail security and filtering solutions. IMPORTANT: Don't do anything evil with this! Tests of cloud or otherwise hosted solutions should always be approved by the tested provider. Only use your own test accounts and don't annoy anyone with a load of test mails. Installation...

USN-3772-1 udisks2 vulnerability

It was discovered that UDisks incorrectly handled format strings when logging. A local attacker could possibly use this issue to cause a denial of service or obtain sensitive information...

SharpSploit - A .NET Post-Exploitation Library Written In C#

SharpSploit is a .NET post-exploitation library written in C that aims to highlight the attack surface of .NET and make the use of offensive .NET easier for red teamers. SharpSploit is named, in part, as a homage to the PowerSploit project, a personal favorite of mine! While SharpSploit does port...

Security update for liblouis (moderate)

This update for liblouis fixes the following issues: Security issues fixed: - CVE-2018-11440: Fixed a stack-based buffer overflow in the function parseChars in compileTranslationTable.c bsc1095189 - CVE-2018-11577: Fixed a segmentation fault in loulogPrint in logging.c bsc1095945 - CVE-2018-11683...

DEBIAN-CVE-2018-17336

UDisks 2.8.0 has a format string vulnerability in udiskslog in udiskslogging.c, allowing attackers to obtain sensitive information stack contents, cause a denial of service memory corruption, or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n...

UBUNTU-CVE-2018-17336

UDisks 2.8.0 has a format string vulnerability in udiskslog in udiskslogging.c, allowing attackers to obtain sensitive information stack contents, cause a denial of service memory corruption, or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n...

September 20, 2018—KB4457141 (OS Build 15063.1358)

None None...

Information disclosure

Elastic Cloud Enterprise ECE versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An attacker with access to t...

CVE-2018-3827

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure formerly elasticsearch-cloud-azure plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged...

CVE-2018-3828

Elastic Cloud Enterprise (ECE) prior to version 1.1.4 contains an information exposure vulnerability where certain exception conditions can leak encryption keys, passwords, and other sensitive headers to allocator logs. An attacker with access to the logging cluster could obtain leaked credential...

CVE-2018-3828

Elastic Cloud Enterprise ECE versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An attacker with access to t...

Mail Security Testing Framework

Mail Security Testing Framework is a testing framework for mail security and filtering solutions. The mail security testing framework works with with Python =3.5. Just pull this repository and go ahead. No further dependencies are required. Usage The script mail-tester.py runs the tests. Read the...

Storefront 3.15 | Storefront propagation fails.

Propagation fails on Server 2012R2 machine. In event logs: Log Name: Citrix Delivery Services Source: Citrix Configuration Replication An error occurred when starting the 'WAS' Windows service. System.ServiceProcess.TimeoutException, System.ServiceProcess, Version-4.0.0.0, Culture=neutral,...

Advanced Network Reconnaissance Toolkit: badKarma

badKarma is a python3 GTK+ toolkit that aim to assist penetration testers during all the network infrastructure penetration testing activity phases. It allow testers to save time by having point-and-click access to their toolkits, launch them against single or multiple targets and interacte with...

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution...

Moderate: Red Hat Enhancement Advisory: VDSM bug fix and enhancement update 4.2

Updated vdsm packages that fix several bugs and add various enhancements are now available. VDSM is a management module that serves as a Red Hat Virtualization Manager agent on Red Hat Virtualization Host or Red Hat Enterprise Linux hosts. Changes to the vdsm component: Previously, multipath...