JSP Tickets, 1.1, SQL Injection

JSP Tickets from Joomla Service Provider, versions 1.1 and previous, SQL Injection Resolution: update to version 1.2.0 Update notice: http://www.joomlaserviceprovider.com/jspblog/jsp-tickets-1-2-security-release.html...

bro -- integer overflow allows remote DOS

Philippe Antoine of Catena cyber: This is a security release that fixes an integer overflow in code generated by binpac. This issue can be used by remote attackers to crash Bro i.e. a DoS attack. There also is a possibility this can be exploited in other ways. CVE pending...

Fedora 26 : clamav (2018-958b22c73f)

ClamAV 0.99.3 ============= This release is a security release and is recommended for all ClamAV users. Please see details below : 1. ClamAV UAF use-after-free Vulnerabilities CVE-2017-12374 --------------------------------------------------------------- The ClamAV AntiVirus software versions...

Fedora 27 : clamav (2018-cb339851e7)

ClamAV 0.99.3 ============= This release is a security release and is recommended for all ClamAV users. Please see details below : 1. ClamAV UAF use-after-free Vulnerabilities CVE-2017-12374 --------------------------------------------------------------- The ClamAV AntiVirus software versions...

Fedora 26 : wordpress (2018-19c693fd9a)

Upstream announcement : WordPress 4.9.2 is now available. This is a security and maintenance release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately. An XSS vulnerability was discovered in the Flash fallback files in MediaElement, a library that is...

Security update for clamav (important)

This update for clamav fixes the following issues: - Update to security release 0.99.3 bsc1077732 CVE-2017-12376 ClamAV Buffer Overflow in handlepdfname Vulnerability CVE-2017-12377 ClamAV Mew Packet Heap Overflow Vulnerability CVE-2017-12379 ClamAV Buffer Overflow in messageAddArgument...

Fedora 27 : wordpress (2017-aaefb84ff3)

Upstream announcement : WordPress 4.8.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.8.1 and earlier are affected by these security issues : - $wpdb-prepare can create unexpected and...

SilverStripe CMS 3.6.2 - CSV Excel Macro Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: SilverStripe CMS - 3.6.2 CSV Excel Macro Injection Vendor Homepage: https://www.silverstripe.org/ Software Link: https://www.silverstripe.org/download Discovered by: Ishaq Mohammed Contact: https://twitter.com/securityprince...

SilverStripe CMS 3.6.2 - CSV Excel Macro Injection

SilverStripe CMS 3.6.2 - CSV Excel Macro Injection Exploit Title: SilverStripe CMS - 3.6.2 CSV Excel Macro Injection Vendor Homepage: https://www.silverstripe.org/ Software Link: https://www.silverstripe.org/download Discovered by: Ishaq Mohammed Contact: https://twitter.com/securityprince Websit...

Next Gen Editor,2.1.0,SQL Injection

Next Gen Editor, 2.1.0, SQL Injection and multiple other vulnerabilities resolution: update to version 2.2.0 update notice: http://nextgeneditor.com/index.php/en/support/forum/installation-issues/3957-new-security-release...

December 2017 security update release

Today, we released security updates to provide additional protections against malicious attackers. By default, Windows 10 receives these updates automatically, and for customers running previous versions, we recommend they turn on automatic updates as a best practice. More information about this...

SS-2017-010: install.php discloses sensitive data by pre-populating DB credential forms

More info at https://www.silverstripe.org/download/security-releases/ss-2017-010/...

SS-2017-006: Session user agent change detection

More info at https://www.silverstripe.org/download/security-releases/ss-2017-006/...

Use-after-free vulnerability.

Description All versions of Samba from 4.0.0 onwards are vulnerable to a use after free vulnerability, where a malicious SMB1 request can be used to control the contents of heap memory via a deallocated heap pointer. It is possible this may be used to compromise the SMB server. Patch Availability...

Fedora 25 : 1:nodejs (2017-c582c1e728)

2017-10-24, Version 6.11.5 'Boron' LTS, @MylesBorins This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/oct-2017-dos/ for details on patched vulnerabilities. Notable Changes - zlib : - CVE-2017-14919 - In zlib...

WordPress Delivers Second Patch For SQL Injection Bug

A bug exploitable in WordPress 4.8.2 and earlier creates unexpected and unsafe conditions ripe for a SQL injection attack, exposing sites created on the content management system to takeover. WordPress released WordPress 4.8.3 Tuesday, which mitigates the vulnerability. “This is a security releas...

Apache James Deserialization RCE(CVE-2017-12628)

Analysis of CVE-2017-12628 This morning I spotted a tweet mentioning an “Apache James 3.0.1 JMX Server Deserialization” vulnerability, CVE-2017-12628, which caught my eye because I wrote a generic JMX deserialization exploit which is included in my RMI attack tool BaRMIe. A quick search for more...

Fedora 26 : wordpress (2017-4e01259678)

Upstream announcement : WordPress 4.8.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.8.1 and earlier are affected by these security issues : - $wpdb-prepare can create unexpected and...

Fedora 25 : wordpress (2017-3bf0bd9c0c)

Upstream announcement : WordPress 4.8.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.8.1 and earlier are affected by these security issues : - $wpdb-prepare can create unexpected and...

SS-2017-005: User enumeration via timing attack on login and password reset forms

More info at https://www.silverstripe.org/download/security-releases/ss-2017-005/...