joola.io: SSH Port Wide Open

SSH port is wide open, this can give attackers additional information to coordinate an attack: Nmap scan report for joola.io 178.79.174.108 Host is up 0.033s latency. rDNS record for 178.79.174.108: li311-108.members.linode.com Not shown: 994 closed ports PORT STATE SERVICE 20/tcp filtered ftp-da...

Debian DSA-2925-1 : rxvt-unicode - security update

Phillip Hallam-Baker discovered that window property values could be queried in rxvt-unicode, resulting in the potential execution of arbitrary commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

Don't Fall for Fake Instagram Desktop Applications Offering 'Image Viewer'

Today, the estimated number of known computer threats like viruses, worms, backdoors, exploits, Trojans, spyware, password stealers, and other variants of potentially unwanted software range into millions. It has ability to create several different forms of itself dynamically in order to thwart...

Dimensions buy system sql vulnerability affects to the latest 4. Version 2-bug warning-the black bar safety net

Before using this buy system of the free don't know how to now start charging like This vulnerability also in several low version has always been there! Vulnerability file: app/source/articleshow.php ? php if $REQUEST "m" == "Article" && $REQUEST "a" == "showByUname" $uname = $REQUEST"uname"; //n...

perl-HTTP-Body: update to 1.19 release with security fixes (important)

perl-HTTP-Body was updated to 1.19 and also received a security fix for a potential remote code injection when upload files...

BigACE 2.7.5 - 'LANGUAGE' Directory Traversal

source: https://www.securityfocus.com/bid/66350/info BIGACE Web CMS is prone to an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker can exploit these vulnerabilities to compromise the application, access o...

FreeBSD : mutt -- denial of service, potential remote code execution (eb426e82-ab68-11e3-9d09-000c2980a9f3)

Beatrice Torracca and Evgeni Golov report : A buffer overflow has been discovered that could result in denial of service or potential execution of arbitrary code. This condition can be triggered by malformed RFC2047 header lines %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Potential XSS vector in multiple view helpers

More info at https://framework.zend.com/security/advisory/ZF2014-03...

Potential XSS vector in multiple view helpers

More info at https://framework.zend.com/security/advisory/ZF2014-03...

[Introspy] Security profiling for blackbox iOS

Blackbox tool to help understand what an iOS application is doing at runtime and assist in the identification of potential security issues. The tracer can be installed on a jailbroken device to hook and log security-sensitive iOS APIs called by applications running on the device. The tool records...

kernel: security and bugfix update (important)

The Linux kernel was updated to fix various bugs and security issues: - mm/page-writeback.c: do not count anon pages as dirtyable memory reclaim stalls. - mm/page-writeback.c: fix dirtybalancereserve subtraction from dirtyable memory reclaim stalls. - compatsysrecvmmsg X32 fix bnc860993...

unbreakable enterprise kernel security update

kernel-uek 2.6.32-400.33.4uek - kernel/signal.c: stop info leak via the tkill and the tgkill syscalls Emese Revfy Orabug: 17951083 CVE-2013-2141 - ipoutput: do skb ufo init for peeked non ufo skb as well Jiri Pirko Orabug: 17951078 CVE-2013-4470 - KVM: x86: Fix potential divide by 0 in lapic...

FreeBSD : mozilla -- multiple vulnerabilities (dd116b19-64b3-11e3-868f-0025905a4771)

The Mozilla Project reports : MFSA 2013-116 JPEG information leak MFSA 2013-105 Application Installation doorhanger persists on navigation MFSA 2013-106 Character encoding cross-origin XSS attack MFSA 2013-107 Sandbox restrictions not applied to nested object elements MFSA 2013-108 Use-after-free...

Debian DSA-2811-1 : chromium-browser - several vulnerabilities

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2013-6634 Andrey Labunets discovered that the wrong URL was used during validation in the one-click sign on helper. - CVE-2013-6635 cloudfuzzer discovered use-after-free issues in the InsertHTML and Indent DOM editing...

SuSE 11.2 Security Update : MozillaFirefox (SAT Patch Number 8545)

Mozilla Firefox was updated to the 17.0.10ESR release, fixing various bugs and security issues : - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption und...

Improperly initialized memory and overflows in some JavaScript functions — Mozilla

Compiler Engineer Dan Gohman of Google discovered a flaw in the JavaScript engine where memory was being incorrectly allocated for some functions and the calls for allocations were not always properly checked for overflow, leading to potential buffer overflows. When combined with other...

use-after-free in libxl_list_cpupool under memory pressure

ISSUE DESCRIPTION If realloc3 fails then libxllistcpupool will incorrectly return the now-free original pointer. IMPACT An attacker may be able to cause a multithreaded toolstack using this function to race against itself leading to heap corruption and a potential DoS. Depending on the malloc...

Debian Security Advisory DSA 2456-1 (dropbear - use after free)

Danny Fullerton discovered a use-after-free in the Dropbear SSH daemon, resulting in potential execution of arbitrary code. Exploitation is limited to users, who have been authenticated through public key authentication and for which command restrictions are in place. OpenVAS Vulnerability Test...

Fedora 18 : python-pip-1.3.1-4.fc18 (2013-13140)

Fix potential DOS with specially crafted malicious SSL certs. Backing out rename of pip binary to fix 958377 and updating package summary to match upstream's description. Backing out rename of pip binary to fix 958377 and updating package summary to match upstream's description. Note that Tenable...

Fedora 17 : python-pip-1.3.1-4.fc17 (2013-13213)

Fix potential DOS with specially crafted malicious SSL certs. Backing out rename of pip binary to fix 958377 and updating package summary to match upstream's description. Backing out rename of pip binary to fix 958377 and updating package summary to match upstream's description. Note that Tenable...