Microsoft Team Foundation Server CVE-2019-0742 Cross Site Scripting Vulnerability

Description Microsoft Team Foundation Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to insert and display spoofed content and to execute arbitrary script code in the browser of an unsuspecting...

Microsoft Team Foundation Server CVE-2019-0743 Cross Site Scripting Vulnerability

Description Microsoft Team Foundation Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to insert and display spoofed content and to execute arbitrary script code in the browser of an unsuspecting...

KLA11419 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, spoof user interface, obtain sensitive information, gain privileges. Below is a complete list of vulnerabilities: 1. A...

tidy-html5/tidy_fuzzer: Crash in GetSurrogatePair

Project: https://github.com/htacg/tidy-html5.git Detailed report: https://oss-fuzz.com/testcase?key=5741081738608640 Project: tidy-html5 Fuzzer: libFuzzertidy-html5tidyfuzzer Fuzz target binary: tidyfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: UNKNOWN READ Crash Address...

CVE-2019-7632

CVE-2019-7632 affects LifeSize Team, Room, Passport, and Networker 220 devices. The issue is an authenticated remote OS command injection via shell metacharacters in the support/mtusize.php mtu_size parameter, with potential authentication via the default cli password noted in some cases. This yi...

Fixed in Apache Tomcat 8.5.38

Important: Denial of Service CVE-2019-0199 The HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's...

Debian DSA-4386-1 : curl - security update

Multiple vulnerabilities were discovered in cURL, an URL transfer library. - CVE-2018-16890 Wenxiang Qian of Tencent Blade Team discovered that the function handling incoming NTLM type-2 messages does not validate incoming data correctly and is subject to an integer overflow vulnerability, which...

The vulnerability of the Microsoft Team Foundation Server project management and version control system, related to errors in the data protection mechanism, allows a hacker to disclose protected information.

The vulnerability of the Microsoft Team Foundation Server project management and version control system is related to errors in processing protected variables. Exploiting this vulnerability can allow an attacker, operating remotely, to expose protected information by creating a task that contains...

RedELK - Easy Deployable Tool For Red Teams Used For Tracking And Alarming About Blue Team Activities As Well As Better Usability In Long Term Operations

Red Team's SIEM - easy deployable tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability for the Red Team in long term operations. Initial public release at BruCON 2018: Video: https://www.youtube.com/watch?v=OjtftdPts4g Presentation slides:...

open62541/fuzz_binary_decode: Heap-buffer-overflow in UInt32_encodeBinary

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=5709418484727808 Project: open62541 Fuzzer: libFuzzeropen62541fuzzbinarydecode Fuzz target binary: fuzzbinarydecode Job Type: libfuzzerasanopen62541 Platform Id: linux Crash Type:...

Debian DLA-1657-1 : debian-security-support enigmail end of life

debian-security-support, the Debian security support coverage checker, has been updated in jessie. This marks the end of life of the Enigmail package in jessie. After many months of work to try backporting the various changes and fixes required to ensure a secure Enigmail package compatible with...

envoy/config_fuzz_test: Heap-use-after-free in std::__1::__bucket_list_deallocator<std::__1::allocator<std::__1::__hash_node_ba

Project: https://github.com/envoyproxy/envoy.git Detailed report: https://oss-fuzz.com/testcase?key=5762646786179072 Project: envoy Fuzzer: libFuzzerenvoyconfigfuzztest Fuzz target binary: configfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

LOLBAS - Living Off The Land Binaries And Scripts (LOLBins And LOLScripts)

The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques. All the different files can be found behind a fancy frontend here: https://lolbas-project.github.io thanks @ConsciousHacker for this bit of eyecandy and the team ov...

ots/ots-fuzzer: Heap-buffer-overflow in ots::OpenTypeSTAT::Serialize

Project: https://github.com/khaledhosny/ots.git Detailed report: https://oss-fuzz.com/testcase?key=5702836548009984 Project: ots Fuzzer: libFuzzerotsots-fuzzer Fuzz target binary: ots-fuzzer Job Type: libfuzzerasanots Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

[SECURITY] [DLA-1657-1] debian-security-support enigmail end of life

Package : debian-security-support Version : 2019.02.01deb8u1 debian-security-support, the Debian security support coverage checker, has been updated in jessie. This marks the end of life of the Enigmail package in jessie. After many months of work to try backporting the various changes and fixes...

Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect Juniper EX Series Network Switches sold by IBM for use in IBM Products (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects Juniper EX Series Network Switches sold by IBM for use in IBM Products. Vulnerability Details Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affec...

readstat/fuzz_format_sas7bdat: Heap-buffer-overflow in sas_read2

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5667847940866048 Project: readstat Fuzzer: aflreadstatfuzzformatsas7bdat Fuzz target binary: fuzzformatsas7bdat Job Type: aflasanreadstat Platform Id: linux Crash Type: Heap-buffer-overflow READ ...

CIRTKit - Tools For The Computer Incident Response Team

One DFIR console to rule them all. Built on top of theViper Framework Documentation Please see the wiki for more information about CIRTKit and documentation Roadmap Future integrations Bit9 Palo Alto Networks EnCase/FTK Future modules Packet Analysis possibly Dshell Javascript...

A Six Flags Fingerprints Ruling, Supply Chain Hacks, and More Security News This Week

Google's elite security team, police scanner encryption, and more of the week's top security news...

Hacker demonstrates how to remotely Jailbreak iPhone X

By Waqas A China-based security researcher associated with the Qihoo 360 Vulcan Team has published a proof-of-concept exploit for a kernel vulnerability, which he claims to be the second stage of an exploit chain that he was successfully able to jailbreak iPhone X remotely. The researcher Qixun...