CVE-2017-4969: Bug in CC allows users to exceed quotas | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v255 Description The Cloud Foundry Cloud Controller allows authenticated developer users to exceed memory and disk quotas for tasks. Mitigation OSS users are strongly encouraged to follow one of the...

Trend Micro InterScan Web Security Virtual Appliance ConfigBackup File Upload

File upload vulnerability in Trend Micro InterScan Web Security Virtual Appliance ConfigBackup servlet Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Open Atrium - Moderately critical - Information Disclosure - SA-CONTRIB-2017-041

Open Atrium is a distribution the enables collaboration sites to be built. It contains several custom modules to provide various functionality. While content is often protected behind private groups, public content can also be shared. When using Open Atrium as an internal Intranet, this "public"...

April 2017 security update release

Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found on the Security Update Guide. MSRC team...

April 2017 security update release

Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found on the Security Update Guide. MSRC team...

Lcnt Team Shell Upload Vulnerability

Exploit for php platform in category web applications xBADGIRL21 N3W PUBLIC 3XPL0IT , 0day T == -- /-' // x21 Exploit Title : Lcnt Team Shell Upload Vulnerability Exploit Author : xBADGIRL21 Dork : CopyRight 2006-2017 温州龙诚互联科技有限公司 Lcnt Team Vendor : http://icnt.net Tested on: WIN7 MyBlog :...

My Gaming Ladder Combo System 7.5 - SQL Injection

Exploit Title: My Gaming Ladder Combo System 7.5 - SQL Injection Google Dork: N/A Date: 07.04.2017 Vendor Homepage: http://www.mygamingladder.com/ Software: http://www.mygamingladder.com/demos.shtml Demo: http://www.mygamingladder.com/upgrade/combo/ Version: 7.5 Tested on: Win7 x64, Kali Linux x6...

Chrome Security Team Tackles 'Friendly Fire' To Keep Browser Safe

MIAMI— What is life like in the security trenches inside Google’s Chrome browser security team? From the perspective of Justin Schuh, lead engineer of Chrome Security, it’s balancing act where he has to juggle OEM pressures, questionable certificate authorities and quashing third-party software...

Auto Login URL - Less Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-034

This module lets you create auto login URLs programmatically on demand and through tokens. The module does not provide sufficient protection when generating login URLs. An attacker could rebuild login URLs independently thereby logging in as another user. This vulnerability is mitigated by the fa...

nRF24 Playset - Software tools for Nordic Semiconductor nRF24-based Devices like Wireless Keyboards, Mice, and Presenters

The nRF24 Playset is a collection of software tools for wireless input devices like keyboards, mice, and presenters based on Nordic Semiconductor nRF24 transceivers, e.g. nRF24LE1 and nRF24LU1+. All software tools support USB dongles with the nrf-research-firmware by the Bastille Threat...

Joomla JobGrok Application 3.1-1.2.55 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla Component JobGrok Application 3.1-1.2.55 - SQL Injection Date: 2017-04-02 Home : https://extensions.joomla.org/extension/job-grok-app/ Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM email protected Home ...

Joomla JobGrok Listing 3.1-1.2.58 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla Component JobGrok Listing 3.1-1.2.58 - SQL Injection Date: 2017-04-02 Home : https://extensions.joomla.org/extensions/extension/ads-a-affiliates/jobs-a-recruitment/job-grok-list/ Discovered by : Mojtaba MobhaM...

Fixed in Apache Tomcat 7.0.77

Important: Information Disclosure CVE-2017-5647 A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong...

Fixed in Apache Tomcat 8.0.43

Important: Information Disclosure CVE-2017-5647 A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong...

Joomla JobGrok Application 3.1-1.2.55 SQL Injection

Exploit Title: Joomla Component JobGrok Application 3.1-1.2.55 - SQL Injection Date: 2017-04-02 Home : https://extensions.joomla.org/extension/job-grok-app/ Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM [email protected] Home : http://persian-team.ir/ Telegram Channel AND...

Aviation-Related Phishing Campaigns Seeking Credentials

A wave of email-based phishing campaigns is targeting airline consumers with messages that contain malware that infects systems or links to spoofed airline websites that are personalized to trick victims into handing over personal or business credentials. “Over the past several weeks, we have see...

FreeBSD : chromium -- multiple vulnerabilities (7cf058d8-158d-11e7-ba2c-e8e0b747a45a)

Google Chrome Releases reports : 5 security fixes in this release, including : - 698622 Critical CVE-2017-5055: Use after free in printing. Credit to Wadih Matar - 699166 High CVE-2017-5054: Heap buffer overflow in V8. Credit to Nicolas Trippar of Zimperium zLabs - 662767 High CVE-2017-5052: Bad...

VMSA-2017-0006 : VMware ESXi, Workstation and Fusion updates address critical and moderate security issues

a. ESXi, Workstation, Fusion SVGA memory corruption ESXi, Workstation, Fusion have a heap buffer overflow and uninitialized stack memory usage in SVGA. These issues may allow a guest to execute code on the host. VMware would like to thank ZDI and Team 360 Security from Qihoo for reporting these...

Mail.ru: Stored XSS in e.mail.ru (payload affect multiple users)

Hi, We have found a high risk level STORED XSS in e.mail.ru chat, the status change function allow to inject malicious payload in javascript & HTML, The attack affect multiple users and run in auto mode, no need a user interaction. Vulnerability affect any user that have been invited to your chat...

pfsense 2.3.2 Cross Site Request Forgery

Security Advisory - Curesec Research Team 1. Introduction Affected Product: pfsense 2.3.2 Fixed in: 2.3.3 Fixed Version Link: https://pfsense.org/download/ Vendor Website: https://www.pfsense.org/ Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 02/06/2017 Disclosed to public:...