Encrypt - Moderately Critical - Weak Encryption - SA-CONTRIB-2015-166

This module enables you to encrypt data within Drupal using a user-configurable encryption method and key provider. The module did not sufficiently validate good configurations and api usage resulting in multiple potential weaknesses depending on module usage. The default encryption method could...

iBackDoor: High-Risk Code Hits iOS Apps

Introduction FireEye mobile researchers recently discovered potentially “backdoored” versions of an ad library embedded in thousands of iOS apps originally published in the Apple App Store. The affected versions of this library embedded functionality in iOS apps that used the library to display...

nss and nspr security update

nspr 4.10.8-2 - Resolves: Bug 1269359 - CVE-2015-7183 - nspr: heap-buffer overflow in PLARENAALLOCATE can lead to crash under ASAN, potential memory corruption rhel-5.11.z nss 3.19.1-2 - Resolves: Bug 1269354 - CVE-2015-7182 CVE-2015-7181...

A Different Spin on the Air War Against IS

Sunday evening 60 Minutes aired a segment titled Inside the Air War. The correspondent was David Martin, whose biography includes the fact that he served as a naval officer during the Vietnam War. The piece concluded with the following exchange and commentary: On the day we watched the B-1 strike...

Twitter Open Sources 'Diffy' that Automatically Catches Potential Bugs in Code

After, Facebook open sourced Thrift Technology an internally used tool by Facebook in 2007, rival entity Twitter brings Diffy, an internal Twitter service to the world. Yesterday, Twitter introduced "Diffy," an open source tool, acting as a helping hand for the software developers to catch bugs,...

Microsoft Office 2007 - wwlib.dll Type Confusion (MS15-081)

Microsoft Office 2007 - wwlib.dll Type Confusion MS15-081 Source: https://code.google.com/p/google-security-research/issues/detail?id=423&can=1 The following crash was observed in Microsoft Office 2007 with Microsoft Office File Validation Add-In disabled and Application Verifier enabled for...

Discuz! X-Series remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

0x01 vulnerability root causes The root of the problem is that the api/uc. php file in the updatebadwords method, the code is as follows: function updatebadwords$get, $post global $G; if! APIUPDATEBADWORDS return APIRETURNFORBIDDEN; $data = array; ifisarray$post foreach$post as $k = $v...

Debian: Security Advisory (DSA-3332-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ShopEx服务器配置不当（可shell可泄漏内外信息）

简要描述： 第一次来玩这个站。。。 详细说明： fastcgi的9000端口问题，是shopex的爬虫服务器 然后确定ip地址 看看arp信息 虽然域名是sarShopEx 漏洞证明： 查看passwd文件。。。 通过hosts文件得知域名是sradar.cn下的二级域名，该域名也是属于shopEx的。。。...

OpenDNS BGP Stream Twitter Feed

Enterprises in the throes of a denial-of-service attack, or suspicious about the integrity of their Internet traffic, will soon have a free data feed available that cuts through the noise produced by normal Internet routing over BGP, the Border Gateway Protocol. During next month’s Black Hat...

Apache security vulnerabilities

DoS, few potential vulnerabilities...

openSUSE Security Update : rubygem-rack-1_3 (openSUSE-2015-499)

rubygem-rack-13 was updated to fix one security issue. This security issue was fixed : - CVE-2015-3225: Potential Denial of Service Vulnerability in Rack bsc934797. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Fedora 21 : php-htmLawed-1.1.20-1.fc21 (2015-10169)

1.1.20 - 9 June 2015. Fix for a potential security vulnerability arising from unescaped double-quote character in single-quoted attribute value of some deprecated elements when tag transformation is enabled; recognition for non-HTML4 standard 'allowfullscreen' attribute of 'iframe.' Note that...

Fedora 22 : php-htmLawed-1.1.20-1.fc22 (2015-10139)

1.1.20 - 9 June 2015. Fix for a potential security vulnerability arising from unescaped double-quote character in single-quoted attribute value of some deprecated elements when tag transformation is enabled; recognition for non-HTML4 standard 'allowfullscreen' attribute of 'iframe.' Note that...

PolarSSL -- Security Fix Backports

Paul Bakker reports: PolarSSL 1.2.14 fixes one remotely-triggerable issues that was found by the Codenomicon Defensics tool, one potential remote crash and countermeasures against the "Lucky 13 strikes back" cache-based attack...

Debian DLA-250-1 : libclamunrar security update

Upstream published version 0.98.5. This update updates sqeeze-lts to the latest upstream release in line with the approach used for other Debian releases. This update corrects a double-free error that existed within the 'unrarextractnextprepare' function libclamunrariface/unrariface.c when parsin...

Apexis IP CAM Information Disclosure Vulnerability (Jun 2016) - Active Check

Apexis IP Cameras are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 21 : xen-4.4.2-5.fc21 (2015-9466)

Potential unintended writes to host MSI message data field via qemu XSA-128, CVE-2015-4103, PCI MSI mask bits inadvertently exposed to guests XSA-129, CVE-2015-4104, Guest triggerable qemu MSI-X pass-through error messages XSA-130, CVE-2015-4105, Unmediated PCI register access in qemu XSA-131,...

es.trabajo.org XSS vulnerability

Open Bug Bounty ID: OBB-66920 Description| Value ---|--- Affected Website:| es.trabajo.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat She...

Debian DLA-242-1 : imagemagick security update

This update fixes a large number of potential security problems due to insufficient data validation when parsing different input formats. Most of those potential security problems do not have a CVE number assigned. While the security implications of all of these problems are not all fully known, ...