ALPINE-CVE-2017-5484

The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:sigprint...

CVE-2017-5329

Palo Alto Networks Terminal Services Agent before 7.0.7 allows local users to gain privileges via vectors that trigger an out-of-bounds write operation...

Out-of-bounds

Palo Alto Networks Terminal Services Agent before 7.0.7 allows local users to gain privileges via vectors that trigger an out-of-bounds write operation...

The vulnerability of the QEMU hardware emulation software, which allows a hacker to trigger a service failure

The vulnerability in the hw/9pfs/9p-proxy.c function of the virtualization cleanup service in the QEMU hardware emulation proxy backend is related to a memory leak. Exploiting this vulnerability allows an attacker, who operates locally and is also a user of the guest operating system, to cause a...

Oracle FLEXCUBE Core Banking Unauthorized Operation Vulnerability

Oracle FLEXCUBE Core Banking is a product of Oracle Corporation Oracle. Its application architecture supports agile and business process management using Business Process Execution Language BPEL, Service-Oriented Architecture SOA, and Web services-based models. An unauthorized operation...

Newly Discovered Mac Malware with Ancient Code Spying on Biotech Firms

Security researchers have discovered a rare piece of Mac-based espionage malware that relies on outdated coding practices but has been used in some previous real-world attacks to spy on biomedical research center computers. Dubbed Fruitfly, the malware has remained undetected for years on macOS...

Spora Ransomware Offers Unique Payment Options

Researchers are keeping close tabs on a new ransomware strain called Spora that offers victims unique payment options and comes with top-notch encryption. Spora was spotted last week by ransomware experts at BleepingComputer, who said after Spora encrypts files on your computer, it offers four...

Important: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CMS Made Simple Cross-Site Request Forgery Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site request forgery vulnerability exists ...

Integer overflow

An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to ...

CSRF vulnerability in icms backend

iCMS is an efficient content management system for small and medium-sized websites. A csrf vulnerability exists in the latest version of iCMS. Because the token is not validated in the /app/admincp/account.app.php dosave operation, an attacker can modify the administrator account password by...

Stolen Yahoo Data Sold to Spammers, One Government Client

A database of one billion stolen Yahoo accounts has been sold to at least three different buyers for $300,000 each, and the group selling the data and behind the 2013 intrusion—the largest data breach on record—is a criminal operation, not a state-sponsored attack group as Yahoo claims. Andrew...

APT-Repository Signature Bypass Vulnerability

APT-Repository is an installation package management library for Linux. APT-Repository suffers from a signature bypass vulnerability that stems from a memory allocation failure during apt-get upgrade, which can be exploited by an attacker to bypass security restrictions and perform unauthorized...

Apple macOS 10.12 16A323 XNU Kernel iOS 10.1.1 - set_dp_control_port Lack of Locking Use-After-Free

Apple macOS 10.12 16A323 XNU Kernel iOS 10.1.1 - setdpcontrolport Lack of Locking Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=965 setdpcontrolport is a MIG method on the hostprivport so this bug is a root-kernel escalation. kernreturnt setdpcontrolport hostpri...

Medium: 389-ds-base

Issue Overview: CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack It was found that 389 Directory Server was vulnerable to a remote password disclosure via timing attack. A remote attacker could possibly use this flaw to retrieve directory server password after many...

CVE-2016-5688

The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger 1 a heap-based buffer overflow in the SetPixelIndex function or an invali...

CVE-2016-5688

The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger 1 a heap-based buffer overflow in the SetPixelIndex function or an invali...

Europol arrests 34 Teenagers for using DDoS Attack Tools

Europol has announced that the law enforcement agencies from 13 countries around the globe have arrested 34 users of Netspoof DDoS attack tool and interviewed and warned 101 suspects in a global crackdown. According to the report published on the official website of Europol, law enforcement...

Schneider Electric Building Operation Automation Server Vulnerability

OVERVIEW Independent researcher Karn Ganeshen has identified a vulnerability in servers programmed with Schneider Electric’s StruxureWare Building Operation software. Schneider Electric has produced a new version to mitigate this vulnerability. This vulnerability could be exploited remotely...

Some Workspace Environment Management security settings are not getting applied

Some WEM-related security settings such as hiding the Run menu or blocking access to system drives are not being applied, and the Agent log throws errors such as these: Exception - VuemEnvironmentalSettingsController.ExecuteEntityPolicySettings : Attempted to perform an unauthorized operation...