No updates from gateway servers

Challenge No data come from the gateway servers. The Svc.VeeamGateSvc.log on the Gateway server default path C:\ProgramData\Veeam\Backup contains the following entry: Failed to establish target connection to endpoint: xxx.xxx.xxx.xxx:9999 where xxx.xxx.xxx.xxx points to the Veeam Managed Backup...

CVE-2016-2154

admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule...

Design/Logic Flaw

admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule...

CVE-2016-2154

Moodle’s Event Monitor (admin/tool/monitor/lib.php) in versions 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not honor moodle/course:viewhiddencourses, allowing remote authenticated users to discover hidden course names by subscribing to a rule. Impact is partial confident...

Code injection

The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service application crash or possibly...

U.S. Supreme Court allows the FBI to Hack any Computer in the World

In Brief The US Supreme Court has approved amendments to Rule 41, which now gives judges the authority to issue search warrants, not only for computers located in their jurisdiction but also outside their jurisdiction. Under the original Rule 41, let’s say, a New York judge can only authorize the...

Pattern Matching Swiss Knife: YARA

YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families or whatever you want to describe based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strin...

HackerOne: Missing Certificate Authority Authorization rule

Certificate Authority Authorization supported by LetsEncrypt and other CAs allows a domain owner to specify which Certificate Authorities should be allowed to issue certificates for the domain. All CAA-compliant certificate authorities should refuse to issue a certificate unless they are the CA o...

SUSE-SU-2016:0923-1 Security update for libvirt

This update to libvirt 1.2.18.2 fixes the following minor security issue: - CVE-2015-5313: Directory traversal allowed privilege escalation bsc953110 The following bugs were fixed: - bsc952849: Don't add apparmor deny rw rule for 9P readonly mounts. - bsc960305: libxl: support parsing and...

Ebay INC (Magento) Web Security Bug Bounty: Directory Traversal / Local File Inclusion In magento.com

Little Insight: https://wiki.magento.com was vulnerable to a directory traversal / local file inclusion vulnerability. As a result, it was possible for an attacker to load web server-readable files from the local filesystem. well this LFI very interesting for me because when i am start my work i...

Fedora 23 : php-horde-horde-5.2.8-1.fc23 / php-horde-imp-6.2.11-1.fc23 / php-horde-ingo-3.2.7-1.fc23 / etc (2015-46c331cb4e)

horde 5.2.8 mjr SECURITY: Protect against CSRF attacks on various admin pages. jan Don't apply access keys to checkbox and radiobox rows in the sidebar Bug 14103. jan Send correct MIME type for non-statically cached JavaScript files. mjr Added configuration support for version 2 of...

Fedora 22 : php-horde-horde-5.2.8-1.fc22 / php-horde-imp-6.2.11-1.fc22 / php-horde-ingo-3.2.7-1.fc22 / etc (2015-37090f89d8)

horde 5.2.8 mjr SECURITY: Protect against CSRF attacks on various admin pages. jan Don't apply access keys to checkbox and radiobox rows in the sidebar Bug 14103. jan Send correct MIME type for non-statically cached JavaScript files. mjr Added configuration support for version 2 of...

Veris: Multiple Stored XSS

Hello Team, I have found multiple vulnerable fields which accepts malicious javascript inputs and reflects on another form which fails to sanitize the malicious javascript input. Vulnerable Input Form: Edit Group Details Reflects where: View Rule Book Payload used: 1 2 Browsers used: Mozilla...

Veris: Critical IDOR - Make Rule for Any Group & Any Venue remotely

Hello Team, I have found a critical IDOR vulnerability using which an attacker can make/create a rule for any group and any venue remotely by just changing the groupid and venueid in the request. Proof of Concept: Please find the attached screenshots. Best Regards, Hely H. Shah...

polkit: Memory corruption via javascript rule evaluation

A denial of service flaw was found in how polkit handled authorization requests. A local, unprivileged user could send malicious requests to polkit, which could then cause the polkit daemon to corrupt its memory and crash...

Government Promises Comment Period on Next Wassenaar Draft

It’s been months since the U.S. Commerce Department’s Bureau of Industry and Security pulled the U.S. implementation of the Wassenaar Arrangement off the table for an unusual rewrite of the rules governing so-called intrusion software. The overly broad rule drew the ire of security and privacy...

Raptor WAF - Web Application firewall to Train Attacks

Raptor is an Open Source Tool, yout focus is study of attacks and find intelligent ways to block attacks. Raptor is made in pure C, don’t use regex or other common ways to block attacks, yes is diferent and fast like a raptor dinosaur, Raptor follow principle KISS Keep It Simple, you can use Rapt...

CVE-2016-1233

An unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch before 2.9.5-1, and in sid before 2.9.5-1 sets world-writable permissions for the /dev/cuse character device, which allows local users to gain privileges via a character device in /dev, related to an...

CVE-2016-1233

An unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch before 2.9.5-1, and in sid before 2.9.5-1 sets world-writable permissions for the /dev/cuse character device, which allows local users to gain privileges via a character device in /dev, related to an...

Design/Logic Flaw

An unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch before 2.9.5-1, and in sid before 2.9.5-1 sets world-writable permissions for the /dev/cuse character device, which allows local users to gain privileges via a character device in /dev, related to an...