CVE-2018-14364

Removed by vendor...

Gitlab -- Remote Code Execution Vulnerability in GitLab Projects Import

Gitlab reports: Remote Code Execution Vulnerability in GitLab Projects Import...

CVE-2018-8172

A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka "Visual Studio Remote Code Execution Vulnerability." This affects Microsoft Visual Studio, Expression Blend 4...

Memory Corruption Vulnerability in TAS AP-PCLINK setup V1.5

The AP series is a new generation of programmable controllers PLCs newly developed by TSMC. A memory corruption vulnerability exists in AP-PCLINK setup V1.5 of TAS. The vulnerability is caused due to AP-PCLINK failing to validate the availability of a pointer to a function when reading a malforme...

[SECURITY] Fedora 27 Update: php-symfony-2.8.42-1.fc27

PHP framework for web projects...

DDoS-Happy ‘Bitcoin Baron’ Sentenced to Almost 2 Years in Jail

The Bitcoin Baron, a self-proclaimed vigilante responsible for DDoS attacks on civic networks in Madison, Wisc., San Marcos, Texas, and other sites in 2015, has been collared in Phoenix and sentenced to serve 20 months in prison. The conviction and sentencing is only for the former attack, in whi...

Ex-CIA employee charged with leaking 'Vault 7' hacking tools to Wikileaks

A 29-year-old former CIA computer programmer who was charged with possession of child pornography last year has now been charged with masterminding the largest leak of classified information in the agency's history. Joshua Adam Schulte, who once created malware for both the CIA and NSA to break...

Security Bulletin: Cross-site scripting vulnerability on the Projects page in IBM UrbanCode Build (CVE-2015-1983)

Summary IBM UrbanCode Build is vulnerable to cross-site scripting on the Projects page. Vulnerability Details CVE-ID: CVE-2015-1983 Description: IBM UrbanCode Build is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this...

Bypass Glitch Allows Malware to Masquerade as Legit Apple Files

Masquerading as an official Apple system file sounds like a wonderful way for malware to worm its way onto Macs – and a recently discovered code-signing bypass flaw allows bad code to do just that. The way some developers have implemented Apple’s official code-signing API can be exploited by...

CVE-2018-7688

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions...

[SECURITY] Fedora 28 Update: php-symfony-2.8.41-1.fc28

PHP framework for web projects...

'Zip Slip' Vulnerability Affects Thousands of Projects Across Many Ecosystems

Security researchers at British software firm Snyk have revealed details of a critical vulnerability that affects thousands of projects across many ecosystems and can be exploited by attackers to achieve code execution on the target systems. Dubbed "Zip Slip ," the issue is an arbitrary file...

ngi.msstate.edu XSS vulnerability

Open Bug Bounty ID: OBB-621978 Description| Value ---|--- Affected Website:| ngi.msstate.edu Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

[SECURITY] [DSA 4206-1] gitlab security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4206-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 21, 2018 https://www.debian.org/security/faq -...

cc.kebei:onion-expands-compress (>=3.0.0 <=3.0.6), com.aftia.plugin:aem-build-maven-plugin.core (>=1.1.1 <=1.2.2) +90 more potentially affected by CVE-2018-1002201 via org.zeroturnaround:zt-zip (>=1.10 <=1.12)

org.zeroturnaround:zt-zip MAVEN version =1.10, =3.0.0, =1.1.1, =5.0, =2.1.6, =3.6.1, =0.1.4, =1.0.3, =1.0.0, =1.0, =1.1 and more Source cves: CVE-2018-1002201 Source advisory: SNYK:JAVA-ORGZEROTURNAROUND-31681...

Your new friend, KLara

While doing threat research, teams need a lot of tools and systems to aid their hunting efforts – from systems storing Passive DNS data and automated malware classification to systems allowing researchers to pattern-match a large volume of data in a relatively short period of time. These tools ar...

CVE-2017-0920

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance...

CVE-2017-0920

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance...

Authorization

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance...

CVE-2017-0920

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance...