Critical: Red Hat Security Advisory: dnsmasq security update

An update for dnsmasq is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Critical: Red Hat Security Advisory: dnsmasq security update

An update for dnsmasq is now available for Red Hat Enterprise Linux 7.2 Extended Update Support and Red Hat Enterprise Linux 7.3 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score,...

Critical: Red Hat Security Advisory: dnsmasq security update

An update for dnsmasq is now available for Red Hat Enterprise Linux 5 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Fixed in Apache Tomcat 8.5.23

Important: Remote Code Execution CVE-2017-12617 When running with HTTP PUTs enabled e.g. via setting the readonly initialisation parameter of the Default servlet to false it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any...

Fixed in Apache Tomcat 9.0.1

Important: Remote Code Execution CVE-2017-12617 When running with HTTP PUTs enabled e.g. via setting the readonly initialisation parameter of the Default servlet to false it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any...

WordPress 4.4-4.8.1 - Cross-Site Scripting (XSS) in oEmbed

Description A cross-site scripting XSS vulnerability was discovered in the oEmbed discovery. Reported by xknown of the WordPress Security Team...

WordPress 4.4-4.8.1 - Path Traversal in Customizer

Description A path traversal vulnerability was discovered in the customizer. Reported by Weston Ruter of the WordPress Security Team...

CVE-2017-8048: Cloud Controller API regression | Cloud Foundry

Severity Critical Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions capi-release versions 1.33.0 and later, prior to 1.42.0 cf-release versions 268 and later, prior to 274 Please note: due to a bug in 274, it is not recommended for production use. Deployments should use...

Skype Status - Moderately Critical - Cross Site Scripting - DRUPAL-SA-CONTRIB-2017-076

This module enables you to obtain the status for a user's Skype account The module doesn't sufficiently sanitize the user input for their Skype ID. This vulnerability is mitigated by the fact that an attacker must have an account on the site and be allowed to edit/input their Skype ID. CVE...

HackerOne: Report Private Links Leaks to Google Analytics via Query String Param

Hello HackerOne Team, According to HackerOne privacy HackerOne sometimes partners with third-party services which may use various tracking technologies to provide certain services or features, including targeted online marketing. These technologies allow a partner to recognize your computer or...

WordPress <=4.8.1 - Cross-Site Scripting (XSS) vulnerability (oEmbed)

Cross-Site Scripting XSS vulnerability found by xknown of the WordPress Security Team in WordPress oEmbed version 4.8.1 and earlier versions. Solution Update the WordPress to the latest available version at least 4.8.2...

Grab: Access Grab_Road BigData Database via Open Presto coordinator

A publicly accessible analytics database instance was identified, due to a firewall misconfiguration. The instance contained booking related information but did not contained any passenger or driver personal information. This vulnerability was discovered using Shodan search engine by Vinoth Kumar...

WordPress Cool Flickr Slideshow 1.0 Cross Site Scripting

| | Exploit Title: Wordpress cool-flickr-slideshow Plugin Cross Site Scriptingxss | Exploit Author: Ashiyane Digital security Team | Vendor Homepage:https://wordpress.org/plugins/cool-flickr-slideshow/ | Software Link: https://downloads.wordpress.org/plugin/cool-flickr-slideshow.1.0.zip | Version...

WordPress Cool Flickr Slideshow 1.0 Cross Site Scripting Vulnerability

WordPress Cool Flickr Slideshow plugin version 1.0 suffers from a cross site scripting vulnerability. | Exploit Title: Wordpress cool-flickr-slideshow Plugin Cross Site Scriptingxss | Exploit Author: Ashiyane Digital security Team | Vendor...

WordPress Contact Form 7 International SMS Integration 1.2 XSS Vulnerability

WordPress Contact Form 7 International SMS Integration plugin version 1.2 suffers from a cross site scripting vulnerability. | Exploit Title: Wordpress Contact Form 7 International Sms Integration Plugin Cross Site Scripting | Exploit Author: Ashiyane Digital security Team | Vendor Homepage :...

Commerce invoices - Highly Critical - SQL Injection and Cross Site scripting - DRUPAL-SA-CONTRIB-2017-070

Commerce Invoices allows you to enter an Invoice number, Company name and Amount and it will generate an Invoice that the client can pay on your site using any payment method supported by Drupal commerce. SQL Injection The module did not properly use Drupal's database API when querying the databa...

evince security update

CentOS Errata and Security Advisory CESA-2017:2388 An update for evince is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team: CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...

Pluck CMS 4.7.4 Cross Site Request Forgery

============================================== Exploit Title : pluck-cms vulnerability CSRF Reported Date : 8 - 10 - 2017 Exploit Author : Ashiyane Digital Security Team CWE: CSRF - 352 Tested On : kali Linux Vendor Homepage : https://www.pluck-cms.org/ Software Link :...

High Schooler Nets $10,000 For Google Bug

Google fixed a bug last month that could have let anyone access an internal Google website and in turn access sensitive data. The company awarded a hefty $10,000 bounty to the researcher that uncovered it, Ezequiel Pereira, an Uruguayan high school student, last Friday. Pereira stumbled upon the...