DDoS attacks in Q3 2019

News overview This past quarter we observed a new DDoS attack that confirmed our earlier hypothesis regarding attacks through the Memcached protocol. As we surmised, the attackers attempted to use another, rather exotic protocol to amplify DDoS attacks. Experts at Akamai Technologies recently...

Adive Framework 2.0.7 - Privilege Escalation Exploit

Exploit for php platform in category web applications Exploit Title: Adive Framework 2.0.7 - Privilege Escalation Exploit Author: Pablo Santiago Vendor Homepage: https://www.adive.es/ Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Windows 10 CVE :...

SUSE-SU-2019:2913-1 Security update for gdb

This update for gdb fixes the following issues: Update to gdb 8.3.1: jscECO-368 Security issues fixed: - CVE-2019-1010180: Fixed a potential buffer overflow when loading ELF sections larger than the file. bsc1142772 Upgrade libipt from v2.0 to v2.0.1. - Enable librpm for version librpm.so.3...

Policy Compliance Library Updates, October 2019

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

Low: unzip

Issue Overview: Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12.CVE-2018-18384 Affected Packages: unzip Note: This advisory is...

New Relic: [Bypass] Code injection to open redirect in https://insights.newrelic.com/accounts/2521182/dashboards/1026927

INTRODUCES: Overcoming mechanism of controlling url insertion, redirecting users to fake pages STEPS: Payload: Add dashboard note and insert code malicious. Code : Click link to view note detail : Impact Redirecting users to malicious pages, stealing user information such as fake scripts and user...

SQL Injection Vulnerability in the Front-end of the Intelligent Graphical Management System for Office Premises of New ChengSoft Technology Co.

The new ChengSoft intelligent graphic management system for office buildings adopts universal functional design, is a suitable for ministries and commissions, provinces, cities, districts and counties organ affairs management departments as well as large-scale enterprises, scientific research...

Medium: httpd

Issue Overview: A cross-site scripting vulnerability was found in Apache httpd, affecting the modproxy error page. Under certain circumstances, a crafted link could inject content into the HTML displayed in the error page, potentially leading to client-side exploitation.CVE-2019-10092 A...

Tor Browser v9.0 - Everything you Need to Safely Browse the Internet

Tor Browser 9.0 is the first stable release based on Firefox 68 ESR and contains a number of updates to other components as well including Tor to 0.4.1.6 and OpenSSL to 1.1.1d for desktop versions and Tor to 0.4.1.5 for Android. In addition to all the needed patch rebasing and toolchain updates, ...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2019-11253)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in the Kubernetes API server that exposes it to a denial of service attack via malicious YAML or JSON payloads CVE-2019-11253 Vulnerability Details CVE-ID: CVE-2019-11253 Description: The Kubernetes API server is...

Gustuff return, new features for victims

By Vitor Ventura with contributions from Chris Neal. Executive summary The Gustuff banking trojan is back with new features, months after initially appearing targeting financial institutions in Australia. Cisco Talos first reported on Gustuff in April. Soon after, the actors behind Gustuff starte...

CVE-2002-2439

Integer overflow in the new operator in gcc before 4.8.0 allows attackers to have unspecified impacts...

CVE-2002-2439

CVE-2002-2439 describes an integer overflow in the C++ operator new[] in the GNU GCC compiler before 4.8.0, potentially allowing unspecified impacts. Affected software: GCC versions prior to 4.8.0. Root cause: integer overflow while calculating allocation size for new[] allocations. Impact as sta...

CVE-2002-2439

Integer overflow in the new operator in gcc before 4.8.0 allows attackers to have unspecified impacts...

Russia’s Cozy Bear Hackers Resurface With Clever New Tricks

Largely out of the spotlight since 2016, Cozy Bear hackers have been caught perpetrating a years-long campaign...

U.S. Dept Of Defense: [HTA2] Receiving████ access request on @wearehackerone.com email address

Hi, Description I'm not exactly sure what happened, but it seems that my researcher email [email protected] has been added in a group that receives new user access request from MIDRP. ████████ ██████████ Steps to reproduce I'm honestly not sure what happened. I did test a few .███...

The vulnerability of Google Chrome, related to errors in inheriting security policies for new documents, allows a perpetrator to compromise the integrity of data.

The vulnerability of Google Chrome is related to errors in inheriting security policies for new documents. Exploiting this vulnerability can allow a malicious actor to compromise data integrity through a specially created HTML page...

DLA-1957-1 tzdata - new upstream version

Bulletin has no description...

WordPress new-contact-form-widget plugin SQL Injection Vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. new-contact-form-widget is a contact form builder plugin used in it. A SQL injection vulnerability exists in the WordPress...

How to Scale Addressable Advertising with Low Latency for Live Streaming

Written by: David Springfall, Founder and CTO of Yospace Under David's technical and strategic leadership, Yospace pioneered server-side ad insertion and established itself as the global leader in OTT stream monetisation. The Yospace technology supports full one-to-one personalisation and provide...