vBulletin 5.2.2 / 4.2.3 / 3.8.9 Server Side Request Forgery

============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-6483 - Release date: 05.08.2016 - Severity: High ============================================= I. VULNERABILITY ------------------------- vBulletin = 5.2....

Asterisk TLS Certificate Common Name NULL Byte Vulnerability (AST-2015-003)

Asterisk is prone to a certificate bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk"; if...

PoloMeeting Video Conferencing Software Elevation of Privilege Vulnerability

PoloMeeting video conferencing software is a network video conferencing system, the system supports full HD, distributed cluster architecture, the main features of the system include: remote audio and video communication, electronic whiteboard, document collaboration, file transfer, text...

Code injection

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses...

CVE-2016-2830

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses...

CVE-2016-2830: Exposure of Sensitive Information to an Unauthorized Actor

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses...

[SECURITY] Fedora 24 Update: python-autobahn-0.10.9-1.gitcf10233.fc24

Autobahn a networking library that is part of the Autobahn project and prov ides implementations of The WebSocket Protocol http://tools.ietf.org/html/rfc6455 The Web Application Messaging Protocol WAMP http://wamp.ws for Twisted and asyncio on Python 2 & 3 and for writing servers and clients...

Researchers Go Inside a Business Email Compromise Scam

LAS VEGAS – Poor operational security on the part of Nigerian scammers running a Business Email Compromise BEC scheme has given researchers a window into their operations. Dell SecureWorks today published a report at Black Hat USA 2016 on what the criminals involved call wire-wire, or “waya-waya....

Mozilla: Favicon network connection persists when page is closed (MFSA 2016-62)

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses...

Android Privilege Escalation

The multiple vulnerabilities of Android operating system media servers are caused by buffer overflows. Exploitation of these vulnerabilities can allow a malicious actor, operating remotely, to enhance their privileges through a specially created application...

WordPress ALO EasyMail Newsletter Plugin Cross-Site Request Forgery Vulnerability

The ALO EasyMail Newsletter plugin provides list management results, and it is necessary to read emails from the mail server, so this plugin also stores the login information of the mail server explicitly in the WordPress database. The WordPress Plugin ALO EasyMail Newsletter suffers from a...

CVE-2016-2830

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses...

golang: infinite loop in several big integer routines

A denial of service vulnerability was found in Go's verification of DSA public keys. An attacker could provide a crafted key to HTTPS client or SSH server libraries which would cause the application to enter an infinite loop...

Unmasking xDedic's Black Market for Servers and PCs

LAS VEGAS — Black market machine trading of PC and server resources is maturing at alarming speeds. Underground networks such as xDedic have fine-tuned their compute platform to the point where they are almost indistinguishable to legitimate networks such as Amazon Web Services and Rackspace. Tho...

New HTTPS URL Leakage Attack Leaves PCs, Macs, Linux Systems Vulnerable

LAS VEGAS — Researchers have found flaws in the Web Proxy AutoDiscovery protocol tied to DHCP and DNS servers that allow hackers spy on HTTPS-protected URLs and launch a myriad of different malicious attacks against Linux, Windows or Mac computers. According to the security firm SafeBreach, this...

CVE-2016-5672

Intel Crosswalk before 19.49.514.5, 20.x before 20.50.533.11, 21.x before 21.51.546.0, and 22.x before 22.51.549.0 interprets a user's acceptance of one invalid X.509 certificate to mean that all invalid X.509 certificates should be accepted without prompting, which makes it easier for...

CVE-2016-5672

CVE-2016-5672: Intel Crosswalk before 19.49.514.5, 20.x before 20.50.533.11, 21.x before 21.51.546.0, and 22.x before 22.51.549.0 mishandles an initial user acceptance of an invalid X.509 certificate, causing the app to permanently accept all future invalid certificates without further prompts. T...

PT-2016-6629

Name of the Vulnerable Software and Affected Versions Intel Crosswalk versions prior to 19.49.514.5 Intel Crosswalk versions 20.x prior to 20.50.533.11 Intel Crosswalk versions 21.x prior to 21.51.546.0 Intel Crosswalk versions 22.x prior to 22.51.549.0 Description The issue allows...

Using VPN in the UAE? You'll Be Fined Up To $545,000 If Get Caught!

If you get caught using a VPN Virtual Private Network in Abu Dhabi, Dubai and the broader of United Arab Emirates UAE, you could face temporary imprisonment and fines of up to $545,000 Dhs2 Million. Yes, you heard that right. Online Privacy is one of the biggest challenges in today's interconnect...

Oracle WebLogic Server Java Deserialization / RCE Vulnerability (CVE-2015-4852) - Active Check

Oracle WebLogic Server is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...