libgd Heap Buffer Overflow Vulnerability

libgd also known as GD Graphics Library or libgd2 is an American software developer Thomas Boutell developed an open source library for dynamically creating images . A heap buffer overflow vulnerability exists in libgd, which can be exploited by an attacker to execute arbitrary code in an affecte...

Ubuntu 14.04 LTS : OpenSSH vulnerabilities (USN-2966-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2966-1 advisory. Shayan Sadigh discovered that OpenSSH incorrectly handled environment files when the UseLogin feature is enabled. A local attacker could use this issue t...

email.thomaspink.com XSS vulnerability

Vulnerable URL: https://email.thomaspink.com/login.php?message=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 09:03 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

Thomas & Friends: Go Go Thomas - Base64 encoded String, Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Thomas & Friends: Go Go Thomas published at the 'play' market has multiple vulnerabilities...

Thomas Cook Travel Insight - Corrupted files, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Thomas Cook Travel Insight published at the 'play' market has multiple vulnerabilities...

Thomas Cook Travelguide - ContentProvider mode not defined, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Thomas Cook Travelguide published at the 'play' market has multiple vulnerabilities...

Thomas Sabo Ice Tigers - Customized SSL, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Thomas Sabo Ice Tigers published at the 'play' market has multiple vulnerabilities...

Thomas & Friends 14 - Base64 encoded String, Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Thomas & Friends 14 published at the 'play' market has multiple vulnerabilities...

tomcat -- multiple vulnerabilities

Mark Thomas reports: CVE-2015-5345 Apache Tomcat Directory disclosure CVE-2016-0706 Apache Tomcat Security Manager bypass CVE-2016-0714 Apache Tomcat Security Manager Bypass...

Why a War Studies PhD?

When I begin receiving multiple questions on a topic, it's a signal that I should write a blog post. Several of you have asked me about my experience as a PhD candidate in the King's College London Department of War Studies. In this post I will try to answer your questions by explaining how I got...

Secure Data Space 3.1.1-2 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 secunet Security Networks AG Security Advisory Advisory: SECURE DATA SPACE API Multiple Non-Persistent Cross-Site Scripting Vulnerabilities 1. DETAILS - ---------- Product: SECURE DATA SPACE Vendor URL: www.ssp-europe.eu Type: Cross-site...

Variety Jones, A Senior Adviser to ‪Silk Road‬ arrested in Thailand

The man accused of being "a senior advisor" and mentor of Ross Ulbricht, the convicted operator of the illegal drug marketplace Silk Road, has been arrested in Thailand and charged with conspiring to traffic drugs and money laundering. The US Department of Justice DoJ announced on Friday that Rog...

RXTEC RXAdmin SQL Injection Vulnerability

RXTEC RXAdmin login page from UPDATE 06 / 2012 suffers from a remote SQL injection vulnerability. RXTEC20150513 Title: SQL injection vulnerability in the RXTEC RXAdmin Login Page allows remote attackers to execute arbitrary SQL commands via several HTTP parameter. Type of vulnerability: SQL...

Search API Autocomplete - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-140

This module enables you to add autocomplete suggestions for search forms created with the Search API module. The module doesn't sufficiently sanitize the HTML output for the returned suggestions, theoretically allowing an attacker to include custom HTML there. This vulnerability is mitigated by t...

Remotely Exploitable Vulnerabilities in SAP Compression Algorithms

The two primary compression algorithms used by SAP SE products, some of the most popular enterprise and business management software platforms on the market, contain multiple, remotely exploitable security vulnerabilities. Martin Gallo of Core Security Consulting Services found vulnerabilities in...

Sheep Marketplace Owner Arrested While Trying to Buy Luxury Home

Thomas Jiřikovský, an alleged Owner of one of the most popular Darknet website ‘Sheep Marketplace,’ has been arrested after laundering around $40 Million, making it one of the biggest exit scams in Darknet history. After the arrest of Silk Road owner 'Ross Ulbricht' in 2013 -- Sheep Marketplace...

IT-Grundschutz M5.064: Secure Shell

IT-Grundschutz M5.064: Secure Shell. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM5064.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 5.064 Authors: Thomas Rotter Copyright: Copyright c 2015 Greenbone Networks GmbH, http://www.greenbone.net...

TrueCrypt Audit Cryptanalysis Handed Off to NCC Group

The stagnant TrueCrypt audit stirred to life in the last 24 hours with the announcement that the second phase of the audit, tasked with examining the cryptography behind the open source disk encryption software, will begin shortly. NCC Group’s Cryptography Services has been contracted to do the...

Sysmon v2.0 - System Activity Monitor for Windows

System Monitor Sysmon is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to...

SA-CONTRIB-2015-008 - Batch Jobs - Cross Site Request Forgery (CSRF)

The Batch Jobs project is a scalable way to execute a list of tasks. Links that take actions on batch jobs are not protected from Cross Site Request Forgery CSRF. A malicious individual could cause a user that has permission to access a particular batch job or an administrator to delete the recor...