Western Digital My Cloud File Upload

File upload vulnerability in Western Digital My Cloud multiuploadify.php Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

[SECURITY] [DLA 1231-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u16 CVE ID : CVE-2017-17498 CVE-2017-17500 CVE-2017-17501 CVE-2017-17502 CVE-2017-17503 CVE-2017-17782 CVE-2017-17912 CVE-2017-17915 Debian Bug : 884905 The NSFocus Security Team discovered multiple security issues in Graphicsmagick, a collection ...

team-lab.com XSS vulnerability

Open Bug Bounty ID: OBB-499189 Description| Value ---|--- Affected Website:| team-lab.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

AMD PSP fTPM Remote Code Execution Vulnerability

AMD PSP suffers from an fTPM remote code execution vulnerability that can be performed through a crafted EK certificate. Introduction ============ AMD PSP 1 is a dedicated security processor built onto the main CPU die. ARM TrustZone provides an isolated execution environment for sensitive and...

libreoffice/fodsfuzzer: Heap-use-after-free in cppu::_destructData

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4963204691132416 Project: libreoffice Fuzzer: libFuzzerlibreofficefodsfuzzer Fuzz target binary: fodsfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

The First Question(s) Today’s CEOs Should Ask (& Know the Answers To)

In a previous blog, we discussed Commander's Intent for CEOs and introduced 10 questions CEOs should be asking their teams. In this blog series, I am going to take a deeper dive into each question and break them down one at a time. We will discuss why CEOs should care about each question and the...

Updated perl packages fix security vulnerability

John Lightsey and Todd Rinaldo reported that the opportunistic loading of optional modules can make many programs unintentionally load code from the current working directory which might be changed to another directory without the user realising and potentially leading to privilege escalation...

Joomla SP Movie Database 1.4 SQL Injection

Exploit Title: SP Movie Database - SQL Injection Vulnerability Google Dork: inurl:option=comspmoviedb Date: 29.12.2017 Author: pwny Source Component : https://extensions.joomla.org/extension/sp-movie-database/ Version : 1.4 Tested on: Kali Linux proof : https://ibb.co/cjdiZw Search Form in Home...

libreoffice/htmlfuzzer: Bad-cast to SdrObject from SwTextFormatColl in SwHTMLParser::ResizeDrawObject

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=6745890124464128 Project: libreoffice Fuzzer: libFuzzerlibreofficehtmlfuzzer Fuzz target binary: htmlfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash...

IBM Rational Team Concert and Rational Collaborative Lifecycle Management Cross-Site Scripting Vulnerability

IBM Rational Team Concert RTC and Rational Collaborative Lifecycle Management CLM are both collaborative lifecycle management solutions from IBM USA. A cross-site scripting vulnerability exists in IBM RTC and Rational CLM. A remote attacker could exploit this vulnerability to inject arbitrary...

CVE-2017-1365

IBM Team Concert RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

Cross site scripting

IBM Team Concert RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

CVE-2017-1365

IBM Team Concert (RTC) and IBM Rational CLM are affected by a cross-site scripting vulnerability in the Web UI that can allow an attacker to inject arbitrary JavaScript and potentially disclose credentials within a trusted session. The CVE entry covers IBM Rational CLM/RRC components including CL...

VIDEO: Carbon Black’s Agile Transformation

In 2017, our product team went through a major "Agile Transformation." All employees adopted this new way of working to establish better collaboration within and across teams. We’ve restructured our teams to be smaller and more cross-functional. We’ve hired Agile Coaches and Scrum Masters to keep...

Xbox 360 Aurora 0.6b Default Credentials / FTP BruteForce Exploit

Exploit for linux platform in category remote exploits Exploit Title: XBOX 360 Aurora 0.6b Default Credentials / FTP BruteForce Date: 20/12/2017 Exploit Author: Daniel Godoy Vendor Homepage: http://phoenix.xboxunity.net//news Tested on: XBOX 360 GREETZ: Iker Legorreta, RemoteExecution Team...

Trend Micro InterScan Messaging Security Virtual Appliance WizardSetting_sys.imss RCE

Remote command execution vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance WizardSettingsys.imss sysdesname parameter Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

vBulletin LFI

Local file include vulnerability in vBulletin routestring parameter Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

libreoffice/fodsfuzzer: Heap-buffer-overflow in rtl_string_newFromStr

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5008090362544128 Project: libreoffice Fuzzer: libFuzzerlibreofficefodsfuzzer Fuzz target binary: fodsfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

ruby -- Command injection vulnerability in Net::FTP

Etienne Stalmans from the Heroku product security team reports: There is a command injection vulnerability in Net::FTP bundled with Ruby. Net::FTPget, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernelopen to open a local file. If the localfile argument starts with the pip...

Fixed in Apache Tomcat 8.0.48

Low: Incorrectly documented CGI search algorithm CVE-2017-15706 As part of the fix for bug 61201, the description of the search algorithm used by the CGI Servlet to identify which script to execute was updated. The update was not correct. As a result, some scripts may have failed to execute as...