IORegistryIterator race condition vulnerability analysis and exploit-vulnerability warning-the black bar safety net

Author: shrekwzw@360NirvanTeam 0x00 description CVE-2 0 1 5-7 0 8 4 is due to the IORegistryIterator the user does not consider the state of multiple threads simultaneously call the case, causing a Race Condition that can lead to arbitrary code execution. Vulnerability exists in MAP version 3 2 4...

Multiple vulnerabilities in extension phpMyAdmin (phpmyadmin)

It has been discovered that the extension "phpMyAdmin" phpmyadmin is susceptible to unsafe comparison of XSRF/CSRF token, multiple full path disclosure vulnerabilities, multiple XSS vulnerabilities, insecure password generation in JavaScript. Release Date: March 10, 2016 Component Type: Third par...

March 2016 Security Update Release

Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month’s security updates can be found in the Security TechNet Library...

Scald File - Critical - Remote Code Execution - SA-CONTRIB-2016-015

When a PDF is uploaded in Scald File, various tools can be executed if they're installed on the server, to try to generate a thumbnail out of that PDF. This is mitigated by the need to have the sufficient permissions to upload a file in Scald, and also to have at least one of the thumbnail creati...

Incorrect ACL get/set allowed on symlink path.

Description All versions of Samba from 3.2.0 to 4.4.0rc3 inclusive are vulnerable to a malicious client overwriting the ownership of ACLs using symlinks. An authenticated malicious client can use SMB1 UNIX extensions to create a symlink to a file or directory, and then use non-UNIX SMB1 calls to...

PHPLib < 7.4 - SQL Injection

PHPLib SQL Injection Vendor: PHPLib Product: PHPLib Version: newid=true; $this-name = $this-cookiename==""?$this-classname:$this-cookiename; if "" == $id $this-newid=false; switch $this-mode case "get": $id = isset$HTTPGETVARS$this-name ? $HTTPGETVARS$this-name...

PHPLib 7.4 - SQL Injection

PHPLib 7.4 - SQL Injection PHPLib SQL Injection Vendor: PHPLib Product: PHPLib Version: newid=true; $this-name = $this-cookiename==""?$this-classname:$this-cookiename; if "" == $id $this-newid=false; switch $this-mode case "get": $id = isset$HTTPGETVARS$this-name ?...

Node Notify - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-013

Node Notify is a lightweight module to allow subscription to comments on nodes for registered and anonymous users. The module doesn't sufficiently sanitize some user provided content, leading to a Cross Site Scripting vulnerability. Additionally, some paths were not protected against CSRF. An...

[SECURITY] Debian 6 Squeeze has reached end-of-life

The Debian Long Term Support LTS Team hereby announces that Debian 6 "Squeeze" support has reached its end-of-life on February 29, 2016, five years after its initial release on February 6, 2011. There will be no further security support for Debian 6.0. The LTS Team will prepare the transition to...

Symphony 2.6.3 SQL Injection

SQL injection vulnerability in Symphony fieldsemail parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

Pulse CMS 4.5.2 Local File Inclusion

Document Title: =============== Pulse CMS 4.5.2 - Local File Inclusion References Source: ==================== http://ehsansec.ir/advisories/plusecms452-lfi.txt Release Date: ============= 2016-02-28 Product & Service Introduction: =============================== Pulse CMS is the easiest way to...

phpRPC < 0.7 - Remote Code Execution

phpRPC Remote Code Execution Vendor: Robert Hoffman Product: phpRPC Version: = 0.7 Website: http://sourceforge.net/projects/phprpc/ BID: 16833 CVE: CVE-2006-1032 OSVDB: 23514 SECUNIA: 19028 PACKETSTORM: 44267 Description: phpRPC is meant to be an easy to use xmlrpc library. phpRPC is greatly...

phpRPC 0.7 - Remote Code Execution

phpRPC 0.7 - Remote Code Execution phpRPC Remote Code Execution Vendor: Robert Hoffman Product: phpRPC Version: = 0.7 Website: http://sourceforge.net/projects/phprpc/ BID: 16833 CVE: CVE-2006-1032 OSVDB: 23514 SECUNIA: 19028 PACKETSTORM: 44267 Description: phpRPC is meant to be an easy to use...

HackerOne: User with Read-Only permissions can manually public disclosure the report

Hello, I would like to report an incomplete fix of 109483 this report .manually disclose functionality is not consider for fix that cause read-only team members to post a public comment. In hackerone public disclose have a three types 1.Team/User Request a public disclose a bug 2.Team/user Agree ...

FileField - Denial of Service - SA-CONTRIB-2016-008

FileField module allows users to upload files in conjunction with the Content Construction Kit CCK module in Drupal 6. The module doesn't validate that a request to delete a temporary file was made by the user who uploaded the file. An attacker can use this vulnerability to delete other user's fi...

Angler Exploit Kit Attacks Silverlight Vulnerability

Exploits for a vulnerability in Microsoft Silverlight have found their way into the dangerous Angler Exploit Kit a little more than a month after it was patched. French security researcher Kafeine said he was able to get independent confirmation from researchers at Kaspersky Lab that the exploit...

RHEL 6 : rhev-hypervisor (RHSA-2016:0277)

Updated rhev-hypervisor packages that fix one security issue are now available. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the CVE link in the...

PEAR LiveUser < 0.16.8 - Arbitrary File Access

PEAR LiveUser Arbitrary File Access Vendor: Markus Wolff Product: PEAR LiveUser Version: options'cookie''name'; if strlen$cookieData deleteRememberCookie; $this-stack-pushLIVEUSERERRORCOOKIE, 'error', array, 'Wrong data in cookie store in LiveUser::readRememberMeCookie'; return false; $storeid =...

Drupal 8.0.x-dev Cross Site Scripting

DOM Based XSS with character on IE8 and older versions IMPORTANT: this issue has been cleared for public discussion and resolution by the Drupal Security Team based on the low evidence of vulnerable browsers still existing. Problem/Motivation filterxss does not filter out the accent grave...

Critical: Red Hat Security Advisory: rhev-hypervisor security update

Updated rhev-hypervisor packages that fix one security issue are now available. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the CVE link in the...