Web Application Penetration Testing Tool: Tracy

Tracy is a pentesting tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner. tracy should be used during the mapping-the-application phase of the pentest to identify sources of input and their corresponding outputs. tracy...

CVE-2018-10689

blktrace aka Block IO Tracing 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the devmapread function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file...

AZL-6328 CVE-2018-10689 affecting package blktrace for versions less than 1.2.0-6

blktrace aka Block IO Tracing 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the devmapread function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file...

DEBIAN-CVE-2018-10689

blktrace aka Block IO Tracing 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the devmapread function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file...

CVE-2018-10689

blktrace aka Block IO Tracing 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the devmapread function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file...

Malware monitor - leveraging PyREBox for malware analysis

This post was authored by Xabier Ugarte Pedrero In July 2017 we released PyREBox, a Python Scriptable Reverse Engineering Sandbox as an open source tool. This project is part of our continuous effort to create new tools to improve our workflows. PyREBox is a versatile instrumentation framework...

CVE-2018-7676

The NetIQ Identity Manager, in versions prior to 4.7, userapp with log / trace enabled may leak sensitive information...

Tracing Stolen Bitcoin

Ross Anderson has a really interesting paper on tracing stolen bitcoin. From a blog post: Previous attempts to track tainted coins had used either the "poison" or the "haircut" method. Suppose I open a new address and pay into it three stolen bitcoin followed by seven freshly-mined ones. Then und...

Chromium: Information disclosure via "memory_instrumentation::mojom::Coordinator" interface in "resource_coordinator" service(CVE-2018-6080)

VULNERABILITY DETAILS The "memoryinstrumentation::mojom::Coordinator" mojo interface is exposed by the "resourcecoordinator" service, running under the browser process. The interface requires the "app" capability https://cs.chromium.org/chromium/src/services/resourcecoordinator/manifest.json?l=8,...

Monero: Corrupt RPC responses from remote daemon nodes can lead to transaction tracing

Dear Monero security team, We’re writing to disclose a privacy vulnerability when using monero-cli or monero-gui with an untrusted remote node. When using a remote node, the Monero client relies on the node to provide information from the blockchain, in particular the public keys and transaction...

How to get the traces for Citrix Receiver for Windows (Store) 4.10

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company's Help Desk/IT support team and can refer to CTX297149 for more information. This article describes how to get traces for Citrix Receiver for Windows Store 4.10 edition...

AndroTickler - Penetration Testing and Auditing Toolkit for Android Apps

A java tool that helps to pentest Android apps faster, more easily and more efficiently. AndroTickler offers many features of information gathering, static and dynamic checks that cover most of the aspects of Android apps pentesting. It also offers several features that pentesters need during the...

Hack of Attack-for-Hire Service vDOS Snares New Mexico Man

A New Mexico man is facing federal hacking charges for allegedly using the now defunct attack-for-hire service vDOS to launch damaging digital assaults aimed at knocking his former employer's Web site offline. Prosecutors were able to bring the case in part because vDOS got massively hacked last...

Introducing pywintrace: A Python Wrapper for ETW

Introduction Event tracing for Windows ETW is a lightweight logging facility first introduced with Windows 2000. Originally intended as a software diagnostic, troubleshooting and performance monitoring tool, it was greatly expanded in Windows Vista to create a lightweight debugging mechanism. The...

[SECURITY] Fedora 25 Update: potrace-1.15-1.fc25

Potrace is a utility for tracing a bitmap, which means, transforming a bitm ap into a smooth, scalable image. The input is a bitmap PBM, PGM, PPM, or BMP format, and the default output is an encapsulated PostScript file EPS. A typical use is to create EPS files from scanned data, such as company ...

[SECURITY] Fedora 26 Update: potrace-1.15-1.fc26

Potrace is a utility for tracing a bitmap, which means, transforming a bitm ap into a smooth, scalable image. The input is a bitmap PBM, PGM, PPM, or BMP format, and the default output is an encapsulated PostScript file EPS. A typical use is to create EPS files from scanned data, such as company ...

PT-2017-19221 · Sma Solar Technology · Sunny Tripower +2

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products affected versions not specified Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30 Description: An issue was discovered in SMA Solar Technology products, related to the Grid Guard system...

Fedora 24 : graphite2 (2017-e0a9e51dd5)

1.3.10 - Address floating point build parameters to give consistent positioning results across platforms - Various bug fixes 1.3.9 - Add Collision COLLISSPACE to allow for visible spaces in collision avoidance - Add segment and pass direction information to tracing output - Bug fix rule length...

CVE-2017-1284

IBM WebSphere MQ 9.0.1 and 9.0.2 could allow a local user with ability to run or enable trace, to obtain sensitive information from WebSphere Application Server traces including user credentials. IBM X-Force ID: 125145...

Fedora 25 : graphite2 (2017-03ef6281a8)

1.3.10 - Address floating point build parameters to give consistent positioning results across platforms - Various bug fixes 1.3.9 - Add Collision COLLISSPACE to allow for visible spaces in collision avoidance - Add segment and pass direction information to tracing output - Bug fix rule length...