MGASA-2018-0272 Updated glpi packages fix security vulnerability

Updated glpi package fixes security vulnerability: An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to create a malicious URL that, if opened by an authenticated user with debug privilege, will execu...

NAT32 HTTPD Cross-Site Request Forgery Vulnerability

NAT32 is a network sharing application. A cross-site request forgery vulnerability exists in the NAT32 HTTPD component, which allows remote attackers to exploit the vulnerability to construct malicious URIs, bait requests, and can be used in the target user context to perform malicious actions...

RIG Exploit Kit Rotator

RIG exploit kit rotator is a web exploit kit server that operates by delivering malicious URL's to the victim's computer. Successful infection will allow the attacker to download additional malware to the target...

CVE-2017-1000117

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim...

New Dridex Phishing Campaign Delivers Fake Accounting Invoices

A new variant of the banking trojan Dridex is part of a sophisticated phishing attack targeting users of the cloud-based accounting firm Xero. The global campaign is the latest in what security experts at Trustwave said is a wave of phishing attacks against Xero and other financial and accounting...

Apache Subversion Remote Command Execution Vulnerability(CVE-2017-9800)

Arbitrary code execution on clients through malicious svn+ssh URLs in svn:externals and svn:sync-from-url Summary: ======== A Subversion client sometimes connects to URLs provided by the repository. This happens in two primary cases: during 'checkout', 'export', 'update', and 'switch', when the...

git security update

1.8.3.1-12 - prevent command injection via malicious ssh URLs Resolves: CVE-2017-1000117...

IT threat evolution Q2 2017. Statistics

Q2 figures According to KSN data, Kaspersky Lab solutions detected and repelled 342, 566, 061 malicious attacks from online resources located in 191 countries all over the world. 33, 006, 783 unique URLs were recognized as malicious by web antivirus components. Attempted infections by malware tha...

Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager SQL Injection Vulnerabilities

Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network Manager EPNM are both products of the U.S. Cisco Cisco.PI is a set of solutions for wireless management through Cisco Prime LAN Management Solution LMS and Cisco Prime Network Control System NCS technologies; EPNM is a network...

Elasticsearch Kibana Cross-Site Request Forgery Vulnerability (CNVD-2017-15522)

Elasticsearch Kibana is a suite of open source, browser-based tools for analyzing and searching Elasticsearch dashboards. A cross-site request forgery vulnerability exists in Elasticsearch Kibana that allows remote attackers to construct malicious URIs, trick users into parsing them, and can targ...

Google Releases reCAPTCHA API for Android

Google announced today that it has made a new reCAPTCHA API available for Android. The API is part of Google Play Services, Google said, and developers can now add the verification to mobile applications to distinguish between bots and human users. The technology is more than a decade old and...

flatCore Cross-Site Request Forgery Vulnerability

flatCore is a web content management system based on PHP5 and SQLite3. A cross-site request forgery vulnerability exists in flatCore, which allows remote attackers to exploit the vulnerability to construct malicious URIs and trick users into parsing them, which can be used to cause the target use...

PSF-2017-10 urllib FTP protocol stream injection

FTP protocol stream injection via malicious URLs...

CVE-2017-6059

Modauthopenidc.c in the Ping Identity OpenID Connect authentication module for Apache aka modauthopenidc before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request...

Multiple Cross-Site Request Forgery Vulnerabilities in Zimbra

Zimbra is an open source collaborative office suite that includes WebMail, calendar, address book, Web document management and authoring. Zimbra suffers from multiple cross-site request forgery vulnerabilities that allow remote attackers to construct malicious URIs, trick users into parsing them,...

Wowza Streaming Engine 4.5.0 - Multiple Cross-Site Scripting Vulnerabilities

Wowza Streaming Engine 4.5.0 Multiple Cross-Site Scripting Vulnerabilities Vendor: Wowza Media Systems, LLC. Product web page: https://www.wowza.com Affected version: 4.5.0 build 18676 Platform: JSP Summary: Wowza Streaming Engine is robust, customizable, and scalable server software that powers...

Detection issue of malicious URLs in Anti-Bot / Anti-Virus after installing Take 143 of R77.30 Jumbo Hotfix Accumulator

...

CMS Made Simple Cross-Site Scripting Vulnerability

CMS Made Simple is an open source content management system. CMS Made Simple fails to properly handle the $SERVER variable, allowing remote attackers to construct malicious URIs, tricking users into parsing them, which can be used in the target user context to perform malicious actions...

WordPress Duplicator plugin cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports the hosting of personal blog sites on servers running PHP and MySQL.Duplicator is one of the extension plugins used to migrate/clone a site to another location. A cross-si...

WhatsApp Blocks Links to Telegram Messenger (Its biggest Competitor)

It seems like Facebook-owned popular messaging service WhatsApp is blocking links to rival messaging applications – at least Telegram app for now. Telegram users are noticing that WhatsApp is blocking any links to the privacy-oriented messaging service Telegram.me. Although users are free to send...