BSA-2017-304

Security Advisory ID : BSA-2017-304 Component : Linux Kernel Revision : 1.0: Interim The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNELDS option is set, which allows local users to read or write to arbitrary kernel memo...

CVE-2017-8898

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announcecontent parameter in an index.php?/modcp/announcements/&action=create request. This is...

CVE-2017-8898

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announcecontent parameter in an index.php?/modcp/announcements/&action=create request. This is...

USN-3279-1 apache2 vulnerabilities

It was discovered that the Apache modsessioncrypto module was encrypting data and cookies using either CBC or ECB modes. A remote attacker could possibly use this issue to perform padding oracle attacks. CVE-2016-0736 Maksim Malyutin discovered that the Apache modauthdigest module incorrectly...

Weblate: 7BO: Binary Option Robot URL should be HTTPS

SUMMARY This is just for the awareness to use HTTPS everywhere, even for outgoing links - where it's possible. Treat this report with some salt, not as in hashes. Not really a security bug, but I think will be a good idea to add HTTPS on 7BO: Binary Option Robot Button. Navigate this URL:...

MediaWiki SyntaxHighlight extension option injection vulnerability

This module exploits an option injection vulnerability in the SyntaxHighlight extension of MediaWiki. It tries to create & execute a PHP file in the document root. The USERNAME & PASSWORD options are only needed if the Wiki is configured as private. This vulnerability affects any MediaWiki...

DEBIAN-CVE-2017-8064

drivers/media/usb/dvb-usb-v2/dvbusbcore.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIGVMAPSTACK option, which allows local users to cause a denial of service system crash or memory corruption or possibly have unspecified other impact by leveraging use ...

ISC BIND 9 DNS64 Server Denial of Service Vulnerability

ISC BIND is the United States Internet Systems Consortium ISC company maintains a set of open source software that implements the DNS protocol. A denial-of-service vulnerability exists in the ISC BIND 9 DNS64 server, which can be exploited by an attacker to affect DNS64 servers that use a DNS64...

Alienvault OSSIM/USM 5.3.4/5.3.5 - Remote Command Execution Exploit

Exploit for php platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'AlienVault USM/OSSIM API Command Execution', 'Description' = %q This modu...

kernel: Signed overflow for SO_{SND|RCV}BUFFORCE

A flaw was found in the Linux kernel's implementation of setsockopt for the SOSND|RCVBUFFORCE setsockopt system call. Users with non-namespace CAPNETADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative. This could adversely affect...

kernel: use after free in dccp protocol

A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol DCCP implementation freed SKB socket buffer resources for a DCCPPKTREQUEST packet when the IPV6RECVPKTINFO option is set on the socket. A local, unprivileged user could use this flaw to alter the...

Cross site request forgery (csrf)

D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery CSRF vulnerability. This enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated, as demonstrated by changing the Security option from WPA2 to None, or...

CVE-2017-7398

D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery CSRF vulnerability. This enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated, as demonstrated by changing the Security option from WPA2 to None, or...

MantisBT Cross-Site Scripting Vulnerability (CNVD-2017-04630)

MantisBT is an open-source issue management system developed in PHP and commonly used for internal collaboration within corporate teams. A cross-site scripting vulnerability exists in the admconfigreport.php page in MantisBT 1.2.16 and later versions, which can be exploited to inject arbitrary We...

CVE-2017-6463

CVE-2017-6463 affects ntp ntpd; remote authenticated users can crash the daemon by sending an invalid :config directive setting (unpeer option). It exists in ntp releases before 4.2.8p10 and 4.3.x before 4.3.94. Impact is a denial of service via daemon crash. Remediation from the public advisory ...

Faraday v2.4 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...

DEBIAN-CVE-2017-6318

saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANENETCONTROLOPTION packet...

ImageMagick memory corruption vulnerability (CNVD-2017-03842)

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. A memory corruption vulnerability exists in the 'IsOptionMember' function of the MagickCore/option.c file in versions ...

UBUNTU-CVE-2016-10252

Memory leak in the IsOptionMember function in MagickCore/option.c in ImageMagick before 6.9.2-2, as used in ODR-PadEnc and other products, allows attackers to trigger memory consumption...

CVE-2016-9245

In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default "Normalize URI" configuration options used in...