Workarounds Available for Flaws in Siemens RUGGEDCOM Gear

Update Siemens industrial VPN and firewall appliances used in severe environments remain unpatched after an advisory from ICS-CERT on Tuesday disclosed that a number of serious vulnerabilities exist in the gear. Siemens has made a number of recommendations for workarounds, but it’s unknown whethe...

shopify-scripts: sprintf gem - format string combined attack

In the sprintf gem, NOT included in mruby-engine, there are severe vulnerabilities, including information leak, and heap buffer overflow. Here are the technical details. Technical Error 1: ============== The CHECKl macro can sometimes receive negative values, that will bypass the size checks, sin...

Incorrect serialized string parsing

PMASA-2016-70 Announcement-ID: PMASA-2016-70 Date: 2016-11-25 Updated: 2016-12-06 Summary Incorrect serialized string parsing Description Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMAsafeUnserialize function. Severity We consider this...

Username rule matching issues

PMASA-2016-61 Announcement-ID: PMASA-2016-61 Date: 2016-11-25 Updated: 2016-12-06 Summary Username rule matching issues Description A vulnerability in username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution tim...

MySQL / MariaDB / PerconaDB - mention the rights/conditions of competition vulnerability(POC)-vulnerability warning-the black bar safety net

Vulnerability found person: Dawid Golunski Vulnerability level: severe CVE number: CVE-2 0 1 6-6 6 6 3 / CVE-2 0 1 6-5 6 1 6 Vulnerability impact: MariaDB 5.5.52 10.1.18 10.0.28 MySQL = 5.5.51 = 5.6.32 = 5.7.14 Percona Server 5.5.51-38.2 5.6.32-7 8-1 5.7.14-8 Percona XtraDB Cluster 5.6.32-25.17...

Tracking Devices Latest Privacy Risk to Users

Update: TrackR has responded to Rapid7’s disclosure. First, it said it has addressed the authentication issue months ago, but the deprecated call remained online even though it was no longer used by its apps. “We are grateful that Rapid7 brought this possible point of confusion to our attention; ...

LocalTapiola: Oracle Webcenter Sites administrative and hi-privilege access available directly from the internet (/cs/Satellite)

Issue The reporter found several severe and highly critical issues in the Oracle Webcenter Sites affecting www.lahitapiola.fi. The reporter used publicly available information for finding out information relevant to performing the research. Default installation paths, URL's and privileged usernam...

See how I use LastPass to get to all your password-vulnerability warning-the black bar safety net

! Please note:the manufacturer has successfully fixed this issue,and the relevant information to inform a Lastpass user. Vulnerability status:has been fixed Repair time frame:9 0 days Vulnerability level:severe Manufacturer:LastPass Product:LastPass Report Date:2 0 1 6 7 2 6, Vulnerability overvi...

secofi-sniim.gob.mx XSS vulnerability

Vulnerable URL: http://www.secofi-sniim.gob.mx/sniim-mercadosexterior/granos/precios1v2.asp?precios=15/07/2016%27%22%28%29%26%25%3Cacx%3E%3Cimg%20src=x%20onerror=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:...

OLX: Updating and Deleting any Ads on OLX Philippines

Hi, I reported it directly to OLX Philippines they fixed it already but I still want to report it here to gain 7 points. Here's the original write-up about this issue: https://medium.com/@atom/severe-bug-on-olx-philippines-updating-and-deleting-any-ads-ea6a81a3327a.r0n5m7em8 I found a Severe Bug ...

GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution

Exploit for linux platform in category remote exploits ============================================= - Release date: 06.07.2016 - Discovered by: Dawid Golunski - Severity: High - CVE-2016-4971 ============================================= I. VULNERABILITY ------------------------- GNU Wget 1.18...

Verizon appears again seriously flawed, resulting in email accounts compromised-the vulnerability warning-the black bar safety net

I used to and Verizon cooperation many times,are in the event of a serious security vulnerability,including in the MyFiOS application of the API in a fatal vulnerability,the vulnerability will reveal all the user's e-mail account. Recently in my research Verizon webmail portal,I found that the...

Severe Weather! - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Severe Weather! published at the 'play' market has multiple vulnerabilities...

Bumble: Broken Authentication on Badoo

Please watch the attached video. It contains all necessary steps and demo of this vulnerability. Please fix this issue as soon as possible, it is highly severe. Looking forward for reply. Best Regards, Darshit varotaria...

Google released the Android key on the media process and the root vulnerability patch-vulnerability warning-the black bar safety net

Google for Nexus smartphones and tablets, released a batch of new security patches,solved by a vicious e-mail, web pages and multimedia invasion the Android device's vulnerability. Google in the security Bulletin said: the firmware update is applied the radio update promotion to support Nexus...

SUSE: Security Advisory for java-1_7_1-ibm (SUSE-SU-2015:1331-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2015:1504-1)

Mozilla Firefox was updated to 38.2.1 ESR, fixing two severe security bugs. bsc943608 - MFSA 2015-94/CVE-2015-4497 bsc943557: Use-after-free when resizing canvas element during restyling - MFSA 2015-95/CVE-2015-4498 bsc943558: Add-on notification bypass through data URLs Note that Tenable Network...

SUSE-SU-2015:1504-1 Security update for MozillaFirefox

Mozilla Firefox was updated to 38.2.1 ESR, fixing two severe security bugs. bsc943608 MFSA 2015-94/CVE-2015-4497 bsc943557: Use-after-free when resizing canvas element during restyling MFSA 2015-95/CVE-2015-4498 bsc943558: Add-on notification bypass through data URLs...

Microsoft Internet Explorer 缓冲区溢出漏洞 ms15-093

当 Internet Explorer 不正确地访问内存中的对象时，存在远程执行代码漏洞。此漏洞可能以一种攻击者可以在当前用户的上下文中执行任意代码的方式损坏内存。攻击者可能拥有一个旨在通过 Internet Explorer 利用此漏洞的经特殊设计的网站，然后诱使用户查看该网站，则该漏洞可能允许远程执行代码。成功利用此漏洞的攻击者可以获得与当前用户相同的用户权限。如果当前用户使用管理用户权限登录，成功利用此漏洞的攻击者便可完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。频繁使用 Internet Explorer...

Google Chrome < 44.0.2403.89 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities as referenced in the 201507stable-channel-update21 advisory. - The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore ...