DRIVE.NET, Inc.: Same site Scripting

Same site scripting I have found an error of some misconfigured DNS in a subdomain of yours which causes same site scripting. PoC 1 Open a terminal and type ping localhost.drive2.ru You would see that it resolves back to 127.0.0.1 A screenshot has been attached Impact This may cause security issu...

EasyBook < 1.2.2 - Multiple Vulnerabilities

Multiple vulnerabilities was discovered in the 'EasyBook – Directory & Listing WordPress Theme', tested version — v1.2.1: - Unauthenticated Reflected XSS - Authenticated Persistent XSS - IDOR December 27th, 2019 - Envato Contacted January 6th, 2020 - Envato Investigating January ??th, 2020 -...

USN-4234-1: Firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass Content Security Policy CSP restrictions, conduct cross-site...

openSUSE: Security Advisory for python-numpy (openSUSE-SU-2019:2227-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Debian: Security Advisory (DLA-2061-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 30 : wordpress (2019-da7b49a4b1)

WordPress 5.3.2 Maintenance Release Shortly after WordPress 5.3.1 was released, a couple of high severity Trac tickets were opened. The Core team scheduled this quick maintenance release to resolve these issues. Main issues addressed in 5.3.2 : - Date/Time: Ensure that getfeedbuilddate correctly...

Fedora 31 : wordpress (2019-e16ba9e54e)

WordPress 5.3.2 Maintenance Release Shortly after WordPress 5.3.1 was released, a couple of high severity Trac tickets were opened. The Core team scheduled this quick maintenance release to resolve these issues. Main issues addressed in 5.3.2 : - Date/Time: Ensure that getfeedbuilddate correctly...

[SECURITY] [DSA 4593-1] freeimage security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4593-1 [email protected] https://www.debian.org/security/ Hugo Lefeuvre December 27, 2019 https://www.debian.org/security/faq -...

FreeBSD : wordpress -- multiple issues (7b97b32e-27c4-11ea-9673-4c72b94353b5)

wordpress developers reports : Four security issues affect WordPress versions 5.3 and earlier; version 5.3.1 fixes them, so youll want to upgrade. If you havent yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues. -Props to Daniel Bachhuber for...

HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

Impact Waitress would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most...

Fedora 31 : chromium (2019-1a10c04281)

Update to Chromium 79. Fixes the usual giant pile of bugs and security issues. This time, the list is : CVE-2019-13725 CVE-2019-13726 CVE-2019-13727 CVE-2019-13728 CVE-2019-13729 CVE-2019-13730 CVE-2019-13732 CVE-2019-13734 CVE-2019-13735 CVE-2019-13764 CVE-2019-13736 CVE-2019-13737 CVE-2019-1373...

openSUSE Security Update : chromium (openSUSE-2019-2692)

This update for chromium fixes the following issues : Chromium was updated to 79.0.3945.79 boo1158982 - CVE-2019-13725: Fixed a use after free in Bluetooth - CVE-2019-13726: Fixed a heap buffer overflow in password manager - CVE-2019-13727: Fixed an insufficient policy enforcement in WebSockets -...

MGASA-2019-0391 Updated libgit2 packages fix security vulnerabilities

libgit2 has been updated to version 0.28.4 to fix several security issues: A carefully constructed commit object with a very large number of parents may lead to potential out-of-bounds writes or potential denial of service. CVE-2019-1348: the fast-import stream command "feature export-marks=path"...

wordpress -- multiple issues

wordpress developers reports: Four security issues affect WordPress versions 5.3 and earlier; version 5.3.1 fixes them, so youll want to upgrade. If you havent yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues. -Props to Daniel Bachhuber for findi...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3232-1)

This update for the Linux Kernel 4.4.121-92101 fixes several issues. The following security issues were fixed : CVE-2018-20856: Fixed a use-after-free in blkdrainqueue due to an improper error handling bsc1156331. CVE-2019-13272: Fixed a privilege escalation from user to root due to improper...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3228-1)

This update for the Linux Kernel 4.4.180-94100 fixes several issues. The following security issues were fixed : CVE-2018-20856: Fixed a use-after-free in blkdrainqueue due to an improper error handling bsc1156331. CVE-2019-13272: Fixed a privilege escalation from user to root due to improper...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3261-1)

This update for the Linux Kernel 4.4.121-92114 fixes several issues. The following security issues were fixed : CVE-2018-20856: Fixed a use-after-free in blkdrainqueue due to an improper error handling bsc1156331. CVE-2019-13272: Fixed a privilege escalation from user to root due to improper...

SUSE-SU-2019:3247-1 Security update for the Linux Kernel (Live Patch 9 for SLE 15)

This update for the Linux Kernel 4.12.14-15014 fixes several issues. The following security issues were fixed: - CVE-2019-15917: Fixed a use-after-free when hciuartregisterdev fails in hciuartsetproto bsc1156334. - CVE-2019-13272: Fixed a privilege escalation from user to root due to improper...

Xmas Light Security Improves… a bit

We've looked at smart Xmas lights before; whilst they were vulnerable, there was no consequence to the hack other than making them flash in a different order! In 2018 we looked at the all-new Twinkly smart festive lights. We found a number of security issues, reported them to the vendor and to a...

SUSE-SU-2019:3238-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk jdk8u232/icedtea 3.14.0 fixes the following issues: Security issues fixed bsc1154212: - CVE-2019-2933: Windows file handling redux - CVE-2019-2945: Better socket support - CVE-2019-2949: Better Kerberos ccache handling - CVE-2019-2958: Build Better Processes -...