[SECURITY] [DSA 3735-1] game-music-emu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3735-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 15, 2016 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-3735-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Chrome (Fedora 25 Ubuntu 16.04) - tracker-extract gnome-video-thumbnailer + totem Drive-By Download

Google Chrome Fedora 25 Ubuntu 16.04 - tracker-extract gnome-video-thumbnailer + totem Drive-By Download Source: https://scarybeastsecurity.blogspot.com/2016/12/redux-compromising-linux-using-snes.html Overview Full reliable 0day drive-by exploit against Fedora 25 + Google Chrome, by breaking out...

[20161204] - Misc. Security Hardening

Joomla! 3.6.5 includes additional security hardening mechanisms prepared by the JSST, thanks in part to issue reports from Fotis Evangelou and Nicholas Dionysopoulos, which restricts a user's ability to make potentially damaging configuration changes. This includes restricting the ability to set...

Ian Dunn: constant cache_page_secret in regolith

in: https://github.com/iandunn/regolith/blob/master/config/plugins/wp-super-cache.phpL28 $cachepagesecret = 'ad270361c39c428c9465313363b02559'; there usage of static $cachepagesecret, as regolith is installation template. it's better to generate the secret for each installation instead of using...

attorneys.superlawyers.com XSS vulnerability

Vulnerable URL: http://attorneys.superlawyers.com/search?ls===%22autofocus/onfocus=alert/XSSPOSED///=a Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

Post Indexer 3.0.6.1 SQL Injection Vulnerability

Post Indexer version 3.0.6.1 suffers from a remote SQL injection vulnerability. Details ================ Software: Post Indexer Version: 3.0.6.1 Homepage: http://premium.wpmudev.org/project/post-indexer/ Advisory report:...

CVE-2016-9268

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified...

CVE-2016-9268

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified...

CVE-2016-9268

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified...

PHP Business Directory - Multiple Vulnerabilities

Exploit Title: PHP Business Directory - Multiple Vulnerabilities Date: 2016-10-16 Exploit Author: larrycompress Contact: [email protected] Type: webapps Platform: PHP Vendor Homepage: http://www.pagereactions.com/product.php?pku=4 Software Link:...

PHP Image Database - Multiple Vulnerabilities

PHP Image Database - Multiple Vulnerabilities Exploit Title: PHP Image Database - Multiple Vulnerabilities Date: 2016-10-16 Exploit Author: larrycompress Contact: [email protected] Type: webapps Platform: PHP Vendor Homepage: http://www.pagereactions.com/product.php?pku=3 Software Link:...

PHP Telephone Directory - Multiple Vulnerabilities

Exploit Title: PHP Telephone Directory - Multiple Vulnerabilities Date: 2016-10-16 Exploit Author: larrycompress Contact: [email protected] Type: webapps Platform: PHP Vendor Homepage: http://www.pagereactions.com/product.php?pku=2 Software Link:...

PHP Press Release Cross Site Request Forgery

Exploit Title : PHP Press Release - Cross-Site Request Forgery Add Admin - Super User Author : Besim Google Dork : - Date : 09/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.pagereactions.com/product.php?pku=1 Software link :...

PHP Press Release - Cross-Site Request Forgery (Add Admin)

PHP Press Release - Cross-Site Request Forgery Add Admin Exploit Title : PHP Press Release - Cross-Site Request Forgery Add Admin - Super User Author : Besim Google Dork : - Date : 09/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.pagereactions.com/product.php?pku=1 Software...

PHP Press Release - Cross-Site Request Forgery (Add Admin)

Exploit for php platform in category web applications Exploit Title : PHP Press Release - Cross-Site Request Forgery Add Admin - Super User Author : Besim Google Dork : - Date : 09/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.pagereactions.com/product.php?pku=1 Software link...

MSI - NTIOLib.sys WinIO.sys Local Privilege Escalation

MSI - NTIOLib.sys WinIO.sys Local Privilege Escalation Exploit Title: MSI NTIOLib.sys, WinIO.sys local privilege escalation Date: 2016-09-26 Exploit Author: ReWolf Vendor Homepage: http://www.msi.com Version: too many Tested on: Windows 10 x64 TH2, RS1 Full description:...

PHPCMS V9 version of the background design flaws lead to arbitrary code execution vulnerability

Source link: http://www.cnbraid.com/ 0x01 background Since the default after installation requires Super administrator privileges, so the vulnerability is very tasteless, but the feeling should be in other cms, there are also, so the main share under the mining idea PS: using the test environment...

CVE-2016-5422

The web console in Red Hat JBoss Operations Network JON before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request...

JON3: privilege escalation via improper authorization

It was found that JBoss Operations Network allowed regular users to add a new super user by sending a specially crafted request to the web console. This attacks allows escalation of privileges...