Beers with Talos EP20: Crypto, Vuln Disco, and the Spectre Meltdown

Beers with Talos BWT Podcast Episode 20 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast EP20 Show Notes: This is easily our best podcast of 2018 so far. The crew discusses the recent spike in...

CVE-2016-0219

XML external entity XXE vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial of service via crafted XML data. IBM X-Force ID: 109693...

CVE-2016-0219

XML external entity XXE vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial of service via crafted XML data. IBM X-Force ID: 109693...

Xxe

XML external entity XXE vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial of service via crafted XML data. IBM X-Force ID: 109693...

CVE-2016-0219

XML external entity XXE vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial of service via crafted XML data. IBM X-Force ID: 109693...

CVE-2016-0219

CVE-2016-0219 is an XXE vulnerability in IBM Rational Team Concert. The IBM/CLM bulletin and NVD entries describe a denial-of-service risk when processing crafted XML data, affecting RTC 3.0 up to 6.0.1 (pre-iFix4). The issue manifests when XML with external entity references is parsed, enabling ...

About the security content of Xcode 9.2 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

Skygofree — Powerful Android Spyware Discovered

Security researchers have unveiled one of the most powerful and highly advanced Android spyware tools that give hackers full control of infected devices remotely. Dubbed Skygofree, the Android spyware has been designed for targeted surveillance, and it is believed to have been targeting a large...

imagemagick/encoder_psd_fuzzer: Use-of-uninitialized-value in ScaleQuantumToShort

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5941577940729856 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderpsdfuzzer Fuzz target binary: encoderpsdfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

Canadian Police Charge Operator of Hacked Password Service Leakedsource.com

Canadian authorities have arrested and charged a 27-year-old Ontario man for allegedly selling billions of stolen passwords online through the now-defunct service Leakedsource.com. The now-defunct Leakedsource service. On Dec. 22, 2017, the Royal Canadian Mounted Police RCMP charged Jordan Evan...

libreoffice/htmlfuzzer: Heap-use-after-free in SwTextFootnote::GetTextNode

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5183158522740736 Project: libreoffice Fuzzer: libFuzzerlibreofficehtmlfuzzer Fuzz target binary: htmlfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

WordPress Gravity Forms File Upload

File upload vulnerability in WordPress Gravity Forms plugin upload.php Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

WordPress WPshop File Upload

File upload vulnerability in WordPress WPshop plugin ajax.php Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

WordPress ACF Frontend Display File Upload

File upload vulnerability in WordPress ACF Frontend Display plugin Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Western Digital My Cloud File Upload

File upload vulnerability in Western Digital My Cloud multiuploadify.php Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

[SECURITY] [DLA 1231-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u16 CVE ID : CVE-2017-17498 CVE-2017-17500 CVE-2017-17501 CVE-2017-17502 CVE-2017-17503 CVE-2017-17782 CVE-2017-17912 CVE-2017-17915 Debian Bug : 884905 The NSFocus Security Team discovered multiple security issues in Graphicsmagick, a collection ...

team-lab.com XSS vulnerability

Open Bug Bounty ID: OBB-499189 Description| Value ---|--- Affected Website:| team-lab.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

AMD PSP fTPM Remote Code Execution Vulnerability

AMD PSP suffers from an fTPM remote code execution vulnerability that can be performed through a crafted EK certificate. Introduction ============ AMD PSP 1 is a dedicated security processor built onto the main CPU die. ARM TrustZone provides an isolated execution environment for sensitive and...

libreoffice/fodsfuzzer: Heap-use-after-free in cppu::_destructData

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4963204691132416 Project: libreoffice Fuzzer: libFuzzerlibreofficefodsfuzzer Fuzz target binary: fodsfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

The First Question(s) Today’s CEOs Should Ask (& Know the Answers To)

In a previous blog, we discussed Commander's Intent for CEOs and introduced 10 questions CEOs should be asking their teams. In this blog series, I am going to take a deeper dive into each question and break them down one at a time. We will discuss why CEOs should care about each question and the...