The time of much patching is coming

Welcome to this week's edition of the Threat Source newsletter. Many solutions have been proposed to reduce software bugs: zero-defect mandates, pair programming, formal methods, and mathematical software proofs. The reality is that software engineering is hard. Identifying and fixing bugs before...

FuzzySQL: Uncovering Hidden Vulnerabilities in DBMS Special Features with LLM-Driven Fuzzing

Traditional database fuzzing techniques primarily focus on syntactic correctness and general SQL structures, leaving critical yet obscure DBMS features, such as system-level modes e.g., GTID, programmatic constructs e.g., PROCEDURE, advanced process commands e.g., KILL, largely underexplored...

The Windows Registry Adventure #7: Attack surface analysis

Posted by Mateusz Jurczyk, Google Project Zero In the first three blog posts of this series, I sought to outline what the Windows Registry actually is, its role, history, and where to find further information about it. In the subsequent three posts, my goal was to describe in detail how this...

CVE-2022-49636

In the Linux kernel, the following vulnerability has been resolved: vlan: fix memory leak in vlannewlink Blamed commit added back a bug I fixed in commit 9bbd917e0bec "vlan: fix memory leak in vlandevsetegresspriority" If a memory allocation fails in vlanchangelink after other allocations...

Ubuntu: Security Advisory (USN-7169-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Osprey Pump Controller 1.0.1 Administrator Backdoor Access

Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...

Debian: Security Advisory (DSA-4254-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities

Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities document.cookie="counter=1confirm'XSS'; path=/balerocms/"; csrf+stored xss+filter bypass+session hijack: document.location="http://www.zeroscience.mk/pent...

phpList 2.10.17 Remote SQL Injection and XSS Vulnerability

No description provided by source. phpList 2.10.17 Remote SQL Injection and XSS Vulnerability Vendor: phpList Ltd Product web page: http://www.phplist.com Affected version: 2.10.17 Summary: phplist is the world's most popular open source email campaign manager. phplist is free to download, instal...

Grebweb CMS Cross Site Scripting / SQL Injection

. \ \ | | | / | \ | | / | \ \ / | |/ / / / \ | | \ |/ \ | | / /\ | \ | /\ / / / / / /// .ORG ---------------------------------------------------------------- Grebweb Cms alert0 PoC 2 Enter In Search Box XSS Code PoC : http://localhost/index.php Demo : http://www.yagyashree.com/index.php...

Debian DSA-1392-1 : xulrunner - several vulnerabilities

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-1095 Michal Zalewski discovered that the unload event handler had access to the address of...

iGeneric12.txt

Hello All, I have discovered multiple vulnerabilities in: iGeneric eShop 1.2 Authors Site: http://www.igeneric.co.uk +-Examples:--------------------------------------------------+ Information Disclosure & Possible SQL Injection:...

[NOBYTES.COM: #5] iGeneric eShop 1.2 - Information Disclosure & Possible SQL Injection

Hello All, I have discovered multiple vulnerabilities in: iGeneric eShop 1.2 Authors Site: http://www.igeneric.co.uk +-Examples:--------------------------------------------------+ Information Disclosure & Possible SQL Injection:...

SYM04-008, Symantec Client Firewall Remote Access and Denial of Service Issues

Symantec Security Advisory SYM04-008 12 May, 2004 Symantec Client Firewall Remote Access and Denial of Service Issues Revision History None Risk Impact High Overview eEye Digital Security notified Symantec Corporation of four vulnerability issues they discovered in the Symantec Client Firewall...

DSA-239 kdesdk - several vulnerabilities

Bulletin has no description...

DSA-240 kdegames - several vulnerabilities

Bulletin has no description...

DSA-237 kdenetwork - several vulnerabilities

Bulletin has no description...

DSA-236 kdelibs - several vulnerabilities

Bulletin has no description...