Integer overflow

The mintToken function of a smart contract implementation for IMM Coin IMC, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

[SECURITY] Fedora 28 Update: standard-test-roles-2.14-1.fc28

Shared Ansible roles to support the Standard Test Interface as described at https://fedoraproject.org/wiki/Changes/InvokingTestsAnsible...

wetboek-online.nl XSS vulnerability

Open Bug Bounty ID: OBB-639122 Description| Value ---|--- Affected Website:| wetboek-online.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Microsoft Windows: Turn off toast notifications on the lock screen

This test checks the setting for policy OpenVAS Vulnerability Test $Id: wintoastlockscreen.nasl 11344 2018-09-12 06:57:52Z emoss $ Check value for Turn off toast notifications on the lock screen users listed in HKU Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Case Manager (CVE-2017-1382)

Summary IBM WebSphere Application Server is shipped as a component of IBM Case Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin:...

Insecure Number Generator

libxslt.so is vulnerable to insecure number generation. The library does not use a random seed during random number generation which is not robust enough to withstand a cryptographic attack against it...

IOVLabs: DoS through PeerExplorer

Summary: The peer discovery implementation is vulnerable to a Denial of Service attack due to improper management of connections. Description: The two main files of interest in detailing this vulnerability are PeerExplorer.java and NodeChallengeManager.java. To explain the flow of execution I'll ...

Design/Logic Flaw

Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions =0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header...

Threat Outbreak Alert RuleID32845: Email Messages Distributing Malicious Software on May 29, 2018

Medium Alert ID: 57973 First Published: 2018 May 29 12:39 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32845 may contain the following files: Name | Size...

This Chrome extension reveals if your password has been breached

By Waqas Okta has introduced new password manager PassProtect in its latest, This is a post from HackRead.com Read the original post: This Chrome extension reveals if your password has been breached...

Joomla Full Social 1.1.0 SQL Injection

Exploit Title: Joomla! extension Full Social 1.1.0 - 'searchquery' SQL Injection Date: 2018-05-28 Exploit Author: L0RD or [email protected] Software Link: https://extensions.joomla.org/extension/full-social/ Vendor Homepage: https://www.joomlaextensions.co.in/ Version: 1.1.0 Tested on...

CVE-2018-11406: CSRF Token Fixation

More info at https://symfony.com/cve-2018-11406...

[SECURITY] Fedora 27 Update: procps-ng-3.3.10-16.fc27

The procps package contains a set of system utilities that provide system information. Procps includes ps, free, skill, pkill, pgrep, snice, tload, top, uptime, vmstat, w, watch and pwdx. The ps command displays a snapshot of running processes. The top command provides a repetitive update of the...

Backdoors in D-Link’s backyard

"If you want to change the world, start with yourself." In the case of security research this can be rephrased to: "If you want to make the world safer, start with the smart things in your home." Or, to be more specific, start with your router – the core of any home network as well as an...

Buffer overflow

In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash. This was addressed in epan/dissectors/packet-gsmadtap.c by fixing an off-by-one error that caused a buffer overflow...

CVE-2018-11245

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes...

Vanilla: Vanilla SQL Injection Vulnerability

Summary: There is a SQL injection vulnerability in the vanilla, an attacker can use this vulnerability to obtain database information. Description: We download the program from https://github.com/vanilla/vanilla and install. In applications/dashboard/controllers/class.profilecontroller.php:274 ph...

Intelbras NCLOUD 300 1.0 - Authentication bypass Exploit

Exploit for hardware platform in category web applications coding: utf-8 Exploit Title: Intelbras NCloud Authentication bypass Date: 16/05/2018 Exploit Author: Pedro Aguiar - email protected Vendor Homepage: http://www.intelbras.com.br/ Software Link:...

asc-shop.de XSS vulnerability

Open Bug Bounty ID: OBB-617091 Description| Value ---|--- Affected Website:| asc-shop.de Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A...

Cache poisoning and other dirty tricks

by @bo0om, Wallarm Research Caching is a great technology practice. It makes life better for everybody — clients get the data faster, servers expend fewer resources and so on. There is even a whole CDN industry that was built to deliver caching as a service. There are many examples of caching...