Microsoft Office 2010 Service Pack 2 Defense in Depth Vulnerability (KB2553338)

This host is missing an important security update according to Microsoft KB2553338 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

AZL-44008 CVE-2015-2158 affecting package clucene 2.3.3.4-38

Off-by-one error in the pngcrushmeasureidat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted PNG file...

AZL-43846 CVE-2015-2158 affecting package fltk 1.3.5-4

Off-by-one error in the pngcrushmeasureidat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted PNG file...

AZL-44589 CVE-2015-2158 affecting package openjpeg2 2.3.1-12

Off-by-one error in the pngcrushmeasureidat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted PNG file...

Microsoft Office 2016 Defense in Depth Update (KB4011038)

This host is missing an important security update according to Microsoft KB4011038 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

PowerShell Obfuscation Detection Framework: Revoke-Obfuscation

Revoke-Obfuscation is an open-source PowerShell v3.0+ framework for detecting obfuscated PowerShell commands and scripts at scale. It relies on PowerShell’s AST Abstract Syntax Tree to rapidly extract thousands of features from any input PowerShell script and compare this feature vector against o...

Clustering and Dimensionality Reduction: Understanding the “Magic” Behind Machine Learning

These days we hear about machine learning and artificial intelligence AI in all aspects of life. We see machines that learn and imitate the human brain in order to automate human processes. There are autonomous cars that learn the road conditions to drive, personal assistants we can converse with...

Firing a Locked Smart Gun

The Armatix IP1 "smart gun" can only be fired by someone who is wearing a special watch. Unfortunately, this security measure is easily hackable...

WakaTime: Password token validation in https://wakatime.com/

Hi team, I noticed that when requesting multiple reset links at https://wakatime.com/resetpassword/ all tokens are valid and can be used. In numerous applications the following policy is adopted as an additional security measure: keep valid only that token with shorter lifetime last requested or...

SUSE SLES11 Security Update : kernel (SUSE-SU-2017:1628-1) (Stack Clash)

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000364: The default stack guard page was too small and could be 'jumped over' by userland programs using more than one page of stack in functions and ...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1618-1) (Stack Clash)

The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000364: The default stack guard page was too small and could be 'jumped over' by userland programs using more than one page of stack in functions and so...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:1617-1) (Stack Clash)

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000364: The default stack guard page was too small and could be 'jumped over' by userland programs using more than one page of stack in functions and ...

Weblate: Password token validation in https://demo.weblate.org/

Hi team, I noticed that when requesting multiple reset links at https://demo.weblate.org/ all tokens are valid and can be used. In numerous applications the following policy is adopted as an additional security measure: - keep valid only that token with shorter lifetime last requested or -...

Debian DSA-3854-1 : bind9 - security update

Several vulnerabilities were discovered in BIND, a DNS server implementation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2017-3136 Oleg Gorokhov of Yandex discovered that BIND does not properly handle certain queries when using DNS64 with the...

Gratipay: User Enumeration

Dear Gratipay Team, there is a Username Disclosure of a user in your web application's Source Code . For futher detail i have enclosed the screenshot of the vulnerability . Please find the attachment !! Preventive Measure:: hide username fromm sourcr code Encrypt the username...

Uber: Compromising Atlassian Confluence (team.uberinternal.com) via WordPress (newsroom.uber.com)

This issue has some relevance to most of my previous submissions so I thought it's clearer if I open a new ticket about it. I understood you've intended the various .uber.com WordPress sites to be isolated so that compromising them wouldn't impact Uber's internal network or user data. This has be...

[SECURITY] Fedora 23 Update: ansible1.9-1.9.6-1.fc23

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

[SECURITY] Fedora 22 Update: ansible1.9-1.9.6-1.fc22

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

ImageMeter - photo measure - Customized SSL, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application ImageMeter - photo measure published at the 'play' market has multiple vulnerabilities...

GPS Fields Area Measure - Dangerous filesystem permissions, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application GPS Fields Area Measure published at the 'play' market has multiple vulnerabilities...