EulerOS 2.0 SP1 : libgcrypt (EulerOS-SA-2016-1081)

According to the version of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A design flaw was found in the libgcrypt PRNG Pseudo-Random Number Generator. An attacker able to obtain the first 580 bytes of the PRNG output...

[BSA-114] Security update for wordpress

Craig Small [email protected] uploaded new packages for wordpress which fixed the following security problems: CVE-2016-10066, CVE-2016-10045 Potential Remote Command Execution RCE in PHPMailer CVE-2017-5488 Authenticated Cross-Site scripting XSS in update-core.php CVE-2017-5490 Stored Cross-Site...

CVE-2016-9154

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D All firmware versions V6.00.046 and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U All...

CVE-2016-9154

Siemens Desigo PX Web modules (PXA40-W0/W1/W2; PXA30-W0/W1/W2 for PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D, PXC00-U, PXC64-U, PXC128-U) are affected by CVE-2016-9154. The root cause is a pseudo-random number generator with insufficient entropy used to generate HTTPS certificates, enabling a r...

Entropy Insufficiency Vulnerability in Pseudo-Random Number Generation in SIEMENS Desigo PX Web Module

SIEMENS Building Automation Systems Desigo PX programmable automation station offers a flexible solution with the ability to signal alarms, time-based logging programs and trends that can be modified or expanded at any time. An entropy insufficiency vulnerability exists in the pseudo-random numbe...

Insecure Random Number Generator

django-simple-sso is vulnerable to brute force attacks due to it's insecure random number generator. The random number generator generates pseudo-random numbers rather than a cryptographically secure random number...

Scientific Linux Security Update : libgcrypt on SL6.x i386/x86_64 (20161108)

Security Fixes : - A design flaw was found in the libgcrypt PRNG Pseudo-Random Number Generator. An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes. CVE-2016-6313 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C...

libgcrypt: PRNG output is predictable

A design flaw was found in the libgcrypt PRNG Pseudo-Random Number Generator. An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes...

Interactive Disassembler: Plasma

Interactive disassembler for x86/ARM/MIPS. Generates indented pseudo-code with colored syntax code. PLASMA is an interactive disassembler. It can generate a more readable assembly pseudo code with colored syntax. You can write scripts with the available Python api. The project is still in big...

Picking Up Where Neutrino Left Off: RIG Pushing CrypMIC Ransomware

When an exploit kit fades away, it usually doesn’t take long for another to take its place in the limelight, especially when the kit is an integral part of the ransomware ecosystem. That’s exactly what’s happened over the past few weeks as researchers say they’ve seen an uptick in RIG Exploit Kit...

Medium: libgcrypt, gnupg

Issue Overview: A design flaw was found in the libgcrypt PRNG Pseudo-Random Number Generator. An attacker who can obtain the first 580 bytes of the PRNG output can trivially predict the following 20 bytes. Affected Packages: libgcrypt, gnupg Issue Correction: Run yum update libgcrypt or yum updat...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1703-1)

qemu was updated to fix 29 security issues. These security issues were fixed : - CVE-2016-4439: Avoid OOB access in 53C9X emulation bsc980711 - CVE-2016-4441: Avoid OOB access in 53C9X emulation bsc980723 - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation bsc981266 - CVE-2015-8817: Avo...

Generalized SQL Injection Vulnerability in CMS of Shenyang Woodman Culture Communication Co.

Shenyang Woodman Culture Communication Co., Ltd. is a website construction, mobile client app, customized system application software, e-commerce development and operation of the technology company. There is a generic SQL injection vulnerability in the CMS of Shenyang Woodman Culture Communicatio...

CryptXXX Ransomware Updates Ransom Note, Payment Site

For the second time since June 1, the handlers of CryptXXX ransomware have changed their ransom note and Tor payment site. More importantly to those developing detection signatures and administrators, this update no longer makes changes to the file extensions of encrypted files. “To make it more...

Security update for qemu (important)

qemu was updated to fix 29 security issues. These security issues were fixed: - CVE-2016-4439: Avoid OOB access in 53C9X emulation bsc980711 - CVE-2016-4441: Avoid OOB access in 53C9X emulation bsc980723 - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation bsc981266 - CVE-2015-8817: Avoi...

The Changing Face of Pseudo-Darkleech

The pseudo-Darkleech campaign is one of the most notorious and ongoing attacks of recent years, making use of major exploit kits to deliver primarily different strains of ransomware. The campaign has been a bit of chameleon since it was disclosed in March 2015 by researchers at Sucuri. The latest...

The vulnerability of the Linux operating system, which allows a malicious individual to trigger a service failure or increase their privileges.

A condition of the race in the Pty layer that may lead to service failure or increased privileges...

The vulnerability of the Firefox browser allows a hacker to gain access to a full list of disabled plugins.

The vulnerability of Firefox browsers is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to gain access to a complete list of disabled plugins, by using cascading style sheets and pseudo-classes...

Linux kernel in a recursive exploit-vulnerability warning-the black bar safety net

6 on 1 Number, I have submitted a linux kernel in any recursion vulnerability. If the installed Ubuntu system when choosing a home directory encryption, the vulnerability to by a local user to trigger. If you want to know the exploit code and a short bit of the vulnerability report, please visit...

ImageMagick Unauthorized File Moving (CVE-2016-3716)

An Unauthorized File Moving vulnerability exists in ImageMagick. A remote attacker may exploit this issue by using one of ImageMagick's pseudo protocols. Successful exploitation would allow attackers to move an uploaded file to a location where it might be later executed, resulting in remote...