Paragon Initiative Enterprises: Incomplete fix for #181225 (target=_blank vulnerability)

Hi, I believe the fix for 181225 is incomplete in the rules for Airship wysihtml parser rules. At https://github.com/paragonie/airship/blob/58f96aa0e5002b60e74456502d9bfc9483d77b3d/src/public/js/wysihtml5/parserrules/advancedandextended.js, the 'target' parameter for links is allowed to be...

HideMyAss Pro VPN Client for OS X 2.2.7.0 - Local Privilege Escalation

HideMyAss Pro VPN Client for OS X 2.2.7.0 - Local Privilege Escalation Source: https://www.securify.nl/advisory/SFY20170402/multiplelocalprivilegeescalationvulnerabilitiesinhidemyassprovpnclientv2xforosx.html Abstract Multiple local privilege escalation vulnerabilities were found in the helper...

Mobile Security Framework: MobSF

Mobile Security Framework is an intelligent, all-in-one open source mobile application Android/iOS automated pen-testing framework capable of performing static and dynamic analysis. We’ve been depending on multiple tools to carry out reversing, decoding, debugging, code review, and pen-test and...

CVE-2017-8217

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not blocked on any interface...

CVE-2017-3553

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware subcomponent: Rules Engine. The supported version that is affected is 11.1.2.3.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager...

CVE-2017-3553

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware subcomponent: Rules Engine. The supported version that is affected is 11.1.2.3.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager...

Buffer overflow

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware subcomponent: Rules Engine. The supported version that is affected is 11.1.2.3.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager...

CVE-2017-3553

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware subcomponent: Rules Engine. The supported version that is affected is 11.1.2.3.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager...

CVE-2017-3553

CVE-2017-3553 affects Oracle Identity Manager within Oracle Fusion Middleware (Rules Engine). Affected product/version: Oracle Identity Manager, 11.1.2.3.0. Root cause/impact: network-accessible, low-privilege attacker can compromise Oracle Identity Manager, with full takeover risk and confidenti...

DEBIAN-CVE-2016-5410

firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the 1 addPassthrough, 2 removePassthrough, 3 addEntry, 4 removeEntry, or 5 setEntries D-Bus API method...

Oracle Identity Manager Rules Engine Vulnerability (April 2017 CPU)

The remote host is missing the April 2017 Critical Patch Update for Oracle Identity Manager. It is, therefore, affected by an unspecified vulnerability in the Rules Engine subcomponent that allows an authenticated, remote attacker to impact confidentiality, integrity, and availability...

Malware Scanning Services Containers for Sensitive Business Information

SINT MAARTEN—Malware scanning services could be the next listening outpost for criminals and nation-state attackers as more of these services such as VirusTotal are becoming containers for personal, business and even classified information because of some organizations’ policy decision to upload...

Trump Signs Repeal of ISP Privacy Rules

President Trump signed congressional legislation late Monday that repeals the Federal Communications Commission’s rules that would have prevented broadband ISPs from tracking and selling its customers’ online information. Despite opposition from civil liberties groups, democrats who voted against...

Verizon Rebuts Critics of Data-Collecting App

Verizon broke its silence today on what many believed would be a controversial rollout of an app made by Evie Labs called AppFlash, that had been identified by privacy advocates as spyware. The wireless carrier and broadband ISP defended itself Friday saying its critics were flat-out wrong. Veriz...

Update: Vulnerability found in Apache Struts

Akamai has created two new WAF rules in response to new information about the Apache Struts2 vulnerability. The first rule, the most recent version of KRS Rule 3000014, is a standard part of the Kona Ruleset and protects against the many common attacks leveraging this vulnerability. This rule is...

pfsense 2.3.2: CSRF

Description: The easyrule.php script is vulnerable to CSRF, which allows an attacker to create or delete firewall rules via CSRF. Proof of Concept: GET /easyrule.php?action=pass&int=LAN&proto=any&src=192.168.1.1&dst=192.168.1.1&dstport=80&ipproto=inet...

GNU Libtasn1: Denial of service

Background A library that provides Abstract Syntax Notation One ASN.1, as specified by the X.680 ITU-T recommendation parsing and structures management, and Distinguished Encoding Rules DER, as per X.690 encoding and decoding functions. Description Libtasn1 does not correctly handle certain...

YARA File Scan (Linux)

Binary data linuxyarafilescan.nbin...

How to configure ADFS Claim Rules and StoreFront with Multiple Domains

How to configure ADFS Claim Rules and StoreFront with multiple domains?...

Protecting Your Web Apps with AppSpider Defend Until They Can Be Patched

AppSpider scans can detect exploitable vulnerabilities in your applications, but once these vulnerabilities are detected how long does it take your development teams to create code fixes for them? In some cases it could take several days to weeks before a fix/patch to resolve the vulnerability ca...