Search API Autocomplete - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-140

This module enables you to add autocomplete suggestions for search forms created with the Search API module. The module doesn't sufficiently sanitize the HTML output for the returned suggestions, theoretically allowing an attacker to include custom HTML there. This vulnerability is mitigated by t...

Remotely Exploitable Vulnerabilities in SAP Compression Algorithms

The two primary compression algorithms used by SAP SE products, some of the most popular enterprise and business management software platforms on the market, contain multiple, remotely exploitable security vulnerabilities. Martin Gallo of Core Security Consulting Services found vulnerabilities in...

Sheep Marketplace Owner Arrested While Trying to Buy Luxury Home

Thomas Jiřikovský, an alleged Owner of one of the most popular Darknet website ‘Sheep Marketplace,’ has been arrested after laundering around $40 Million, making it one of the biggest exit scams in Darknet history. After the arrest of Silk Road owner 'Ross Ulbricht' in 2013 -- Sheep Marketplace...

IT-Grundschutz M5.064: Secure Shell

IT-Grundschutz M5.064: Secure Shell. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM5064.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 5.064 Authors: Thomas Rotter Copyright: Copyright c 2015 Greenbone Networks GmbH, http://www.greenbone.net...

TrueCrypt Audit Cryptanalysis Handed Off to NCC Group

The stagnant TrueCrypt audit stirred to life in the last 24 hours with the announcement that the second phase of the audit, tasked with examining the cryptography behind the open source disk encryption software, will begin shortly. NCC Group’s Cryptography Services has been contracted to do the...

Sysmon v2.0 - System Activity Monitor for Windows

System Monitor Sysmon is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to...

SA-CONTRIB-2015-008 - Batch Jobs - Cross Site Request Forgery (CSRF)

The Batch Jobs project is a scalable way to execute a list of tasks. Links that take actions on batch jobs are not protected from Cross Site Request Forgery CSRF. A malicious individual could cause a user that has permission to access a particular batch job or an administrator to delete the recor...

file -- multiple vulnerabilities

RedHat reports: Thomas Jarosch of Intra2net AG reported a number of denial of service issues resource consumption in the ELF parser used by file1. These issues were fixed in the 5.21 release of file1, but by mistake are missing from the changelog...

Ubuntu 14.04 LTS : OpenStack Cinder vulnerabilities (USN-2405-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2405-1 advisory. Duncan Thomas discovered that OpenStack Cinder did not properly track the file format when using the GlusterFS of Smbfs drivers. A remote authenticated...

ManageEngine Desktop Central - Arbitrary File Upload / RCE Vulnerabilities

ManageEngine Desktop Central suffers from code execution and remote shell upload vulnerabilities. Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro Agile Information Security...

Mercur Messaging 2005 <= SP4 - IMAP Remote Exploit (egghunter mod)

No description provided by source. !/usr/bin/python Mercur Messaging 2005 SP3 IMAP service - Egghunter mod [email protected] http://www.offensive-security.com Original exploit by Winny Thomas Thanks Thomas, this code really came in handy ! VMWare seems to alter the stack a bit as the...

WordPress 2.9 - Failure to Restrict URL Access

No description provided by source. WordPress = 2.9 Failure to Restrict URL Access http://www.thomasmackenzie.co.uk/ 1. Advisory Information Title: WordPress = 2.9 Failure to Restrict URL Access Date published: 2. Vulnerability Information Class: Failure to Restrict URL Access Remotely Exploitable...

Oracle Linux 5 / 6 : unbreakable enterprise kernel (ELSA-2014-3038)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-3038 advisory. - futex: Make lookuppistate more robust Thomas Gleixner Orabug: 18918614 CVE-2014-3153 - futex: Always cleanup owner tid in unlockpi Thomas Gleixner Orabug:...

Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2014-3037)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-3037 advisory. - futex: Make lookuppistate more robust Thomas Gleixner Orabug: 18918552 CVE-2014-3153 - futex: Always cleanup owner tid in unlockpi Thomas Gleixner Orabug:...

Linux Kernel Vulnerable to Privilege Escalation and DoS Attack

Multiple flaws have been identified in Linux Kernel and related software could allow hackers to hack your Linux machines, shared hosting and websites hosted on them. PRIVILEGE ESCALATION VULNERABILITY IN LINUX KERNEL A privilege escalation vulnerability has been identified in the widely used Linu...

unbreakable enterprise kernel security update

2.6.39-400.215.2 - futex: Make lookuppistate more robust Thomas Gleixner Orabug: 18918614 CVE-2014-3153 - futex: Always cleanup owner tid in unlockpi Thomas Gleixner Orabug: 18918614 CVE-2014-3153 - futex: Validate atomic acquisition in futexlockpiatomic Thomas Gleixner Orabug: 18918614...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-35.1.1.el6uek - futex: Make lookuppistate more robust Thomas Gleixner Orabug: 18918552 CVE-2014-3153 - futex: Always cleanup owner tid in unlockpi Thomas Gleixner Orabug: 18918552 CVE-2014-3153 - futex: Validate atomic acquisition in futexlockpiatomic Thomas Gleixner Orabug:...

Ubuntu 14.04 LTS : chkrootkit vulnerability (USN-2230-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2230-1 advisory. Thomas Stangner discovered that chkrootkit incorrectly quoted certain values. A local attacker could use this issue to execute arbitrary code when chkrootkit is r...

USN-2230-1 chkrootkit vulnerability

Thomas Stangner discovered that chkrootkit incorrectly quoted certain values. A local attacker could use this issue to execute arbitrary code when chkrootkit is run and gain root privileges...

ICOMM 610 Wireless Modem - CSRF Vulnerability

Exploit for hardware platform in category web applications Exploit Title : ICOMM 610 Wireless Modem CSRF Vulnerability Google dork : N/A Date : 02/04/2014 Exploit Author : Blessen Thomas Vendor Homepage : http://www.icommtele.com/ Software Link : N/A Version : ICOMM 610 Tested on : Device softwar...