kernel: kvm: reporting emulation failures to userspace

It was found that reporting emulation failures to user space could lead to either a local CVE-2014-7842 or a L2-L1 CVE-2010-5313 denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to access an I/O port. Please note that on certain...

DLA-463-1 ikiwiki - security update

Bulletin has no description...

Linux Foundation Badge Program Boost Open Source Security

The Linux Foundation says a new Core Infrastructure Initiative CII Best Practices Badge program launched Tuesday will help companies interested in adopting open source technologies evaluate projects based on security, quality and stability. The CII Best Practices Badge does not issue certificates...

Tsusen - Network Traffic Sensor

Tsusen 津波センサー is a standalone network sensor made for gathering information from the regular traffic coming from the outside i.e. Internet on a daily basis e.g. mass-scans, service-scanners, etc.. Any disturbances should be closely watched for as those can become a good prediction base of...

OnionScan - Onion Services Security Scan

The purpose of this tool is to make you a better onion service provider. You owe it to yourself and your users to ensure that attackers cannot easily exploit and deanonymize. Go Dependencies h12.me/socks - For the Tor SOCKS Proxy connection. github.com/xiam/exif - For EXIF data extraction...

APITest.IO: beta version reveals paths, environment variables and partially files contents

Hi guys! You should disable error reporting on beta version. It reveals lot of information and even files contents. How to reproduce: 1 Navigate to http://beta.apitest.io/newsletter, modify csrf-token "token" to any data. 2 input something to "email" and "name" fields. 3 submit the form. As resul...

Automated Security Assessment Reporting Tool: Guinevere

Automated Security Assessment Reporting Tool Automated Security Assessment Reporting Tool Guinevere works with Gauntlet to automate assessment reporting. Main features include: Generate Assessment Report Export Assessment Generate Retest Report Generate Pentest Checklist Generate Assessment Repor...

Deep Impact AD Reporting System Override Access Vulnerability

SINFOR AD is the latest application delivery series equipment launched by SINFOR, and its outstanding feature is the intelligent analysis function of SINFOR AD. SINFOR AD reporting system has an overstepping access vulnerability, which allows attackers to exploit the vulnerability to realize...

Cross-Site Scripting Vulnerability in Deep Impact AD Reporting System

SINFOR AD is the latest application delivery series equipment launched by SINFOR, and its outstanding feature is the intelligent analysis function of SINFOR AD. A cross-site scripting vulnerability exists in the SINFOR AD reporting system, allowing attackers to exploit the vulnerability to perfor...

mAIS - Ship Position Reporting - External URLs vulnerabilities

HackApp vulnerability scanner discovered that application mAIS - Ship Position Reporting published at the 'play' market has multiple vulnerabilities...

WordPress Photocart Link 1.6 Plugin - Local File Inclusion

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Photocart Link - Local File Inclusion Exploit Author: CrashBandicot @DosPerl Date: 2016-03-27 Google Dork : inurl:/wp-content/plugins/photocart-link/ Vendor Homepage:...

Release Notes for Veeam ONE 9.0 Update 1

Challenge Release Notes for Veeam ONE 9.0 Update 1 Cause Please confirm you are running Veeam ONE 9 prior to installing this update. You can check this under Help | About in Veeam ONE Monitor Client, the build number should be 9.0.0.xxx. After upgrading, your version build will be 9.0.0.2088. Thi...

Ever Wondered How Facebook Decides — How much Bounty Should be Paid?

Facebook pays Millions of dollars every year to researchers and white hat hackers from all around the world to stamp out security holes in its products and infrastructure under its Bug Bounty Program. Facebook recognizes and rewards bug hunters to encourage more people to help the company keep...

Mitre Tackles Its Critics: Set To Revamp CVE Vulnerability Reporting

Mitre Corporation will introduce a new pilot program for classifying Common Vulnerabilities and Exposures CVE in the coming weeks. The move is in response to a backlash in the security community where some critics contend Mitre is failing to keep pace with a massive influx in the number of report...

CentOS 5 / 6 / 7 : firefox (CESA-2016:0373)

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Mail.ru: SSRF/XSPA [parapa.mail.ru]

SSRF at parapa.mail.ru. On the moment of reporting, Extended scope was not covered with bug bounty, bounty was awarded as a bonus...

Debian DSA-3493-1 : xerces-c - security update

Gustavo Grieco discovered that xerces-c, a validating XML parser library for C++, mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. These flaws could lead to a denial of service in applications using the xerces-c library, o...

OS Detection Consolidation and Reporting

This script consolidates the OS information detected by several VTs and tries to find the best matching OS. Furthermore it reports all previously collected information leading to this best matching OS. It also reports possible additional information which might help to improve the OS detection. I...

[SECURITY] Fedora 23 Update: hamster-time-tracker-2.0-0.3.rc1.fc23

Project hamster is time tracking for individuals. It helps you to keep trac k on how much time you have spent during the day on activities you choose to tra ck. Whenever you change from doing one task to other, you change your current activity in hamster. After a while you can see how many hours...

The vulnerability of the IBM Tivoli Common Reporting system, a centralized data collection and analysis tool, allows a intruder to execute arbitrary commands.

The vulnerability of the InvokerTransformer class in the Apache Commons Collections library, used for centralized data collection and analysis in the IBM Tivoli Common Reporting system, is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to...