1262 matches found
spamassassin -- Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings
the Apache Spamassassin project reports: nefarious rule configuration .cf files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings...
spamassassin -- Nefarious rule configuration files can run system commands
The Apache SpamAssassin project reports: A nefarious rule configuration .cf files can be configured to run system commands. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug...
Google Chrome is crashing within published Desktop sessions
Google Chrome is crashing within published Desktop sessions. Warning message pops-up when launching Google Chrome within published Desktop session: Warning: settings are stored on a network drive. This may result in slowdowns, crashes, or even loss of data...
BCM Messenger: Account Takeover with old password and login QR
BCM servers don't store users' passwords, and the private keys are stored locally. If you change the password, the data in the old QR code will not be revoked. Please read the warnings during registration and backup, and protect your account credentials. Thank you! When someone wants to log into...
Inspecting TLS Web Traffic - Part 2
In the first blog post I covered why HTTPS web traffic has grown to unprecedented levels, provided a TLS primer and looked at the basic concept of intercepting and inspecting HTTPS web traffic with Man-In-The-Middle techniques MITM. In the second part, I will dive a bit deeper into how the TLS MI...
Feds Crack Down on Money Mules, Warn of BEC Scams
The Justice Department said this week that it is cracking down on money mules, i.e., middlemen who assist in fraud schemes by receiving money from victims and forwarding proceeds to foreign-based perpetrators. So far, feds say they have halted more than 600 domestic money mules – exceeding the 40...
PT-2019-19672 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android version 10 Description: The issue concerns incorrect warnings about app access to user location in various functions, potentially dissolving trust in the platform's permission system. No additional execution privileges are needed, but...
Breaking the Rules: A Tough Outlook for Home Page Attacks (CVE-2017-11774)
Attackers have a dirty little secret that is being used to conduct big intrusions. We’ll explain how they're "unpatching" an exploit and then provide new Outlook hardening guidance that is not available elsewhere. Specifically, this blog post covers field-tested automated registry processing for...
SUSE-SU-2019:2727-1 Security update for dhcp
This update for dhcp fixes the following issues: Secuirty issue fixed: - CVE-2019-6470: Fixed DHCPv6 server crashes bsc1134078. Bug fixes: - Add compile option --enable-secs-byteorder to avoid duplicate lease warnings bsc1089524. - Use IPv6 when called as dhclient6, dhcpd6, and dhcrelay6 bsc11365...
OPENSUSE-SU-2019:2341-1 Security update for dhcp
This update for dhcp fixes the following issues: Secuirty issue fixed: - CVE-2019-6470: Fixed DHCPv6 server crashes bsc1134078. Bug fixes: - Add compile option --enable-secs-byteorder to avoid duplicate lease warnings bsc1089524. - Use IPv6 when called as dhclient6, dhcpd6, and dhcrelay6...
Tarnish - A Chrome Extension Static Analysis Tool To Help Aide In Security Reviews
tarnish is a static-analysis tool to aid researchers in security reviews of Chrome extensions. It automates much of the regular grunt work and helps you quickly identify potential security vulnerabilities. This tool accompanies the research blog post which can be found here. If you don't want to ...
CloudBees Jenkins Warnings Next Generation Plugin Cross-Site Scripting Vulnerability
CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees. The product is mainly used to monitor the continuous software release/testing projects and some timed tasks . Warnings Next Generation Plugin is used in one of the plug-in used to collect compiler...
Big Tech Needs to Use Hazardous Materials Warnings
Opinion: Tech users don’t have time to read novel-length terms of service. Give them a danger icon that tells them their personal risk...
CVE-2019-13960
In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect width and height values in the image header. NOTE: the vendor's expectation, for use cases in which this memory usage would be a denial of service, is that the...
CVE-2019-11725
When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resources from the same site loaded through websockets are not blocked, leading to the loading of unsafe resources and bypassing safebrowsing protections. This...
vim security update
2:7.4.629-5.2 - 1724045 - fix CVE-2019-12735 the :source! command allows arbitrary command execution via the modeline - fix spec warnings about expanding macros...
PT-2019-13496 · Libjpeg Turbo +1 · Libjpeg-Turbo +1
Name of the Vulnerable Software and Affected Versions: libjpeg-turbo version 2.0.2 Description: The issue arises when processing an invalid progressive JPEG image with incorrect width and height values in the image header, potentially leading to a large amount of memory usage. This could result i...
UPDATE: Cuckoo Sandbox 2.0.7
PenTestIT RSS Feed It has been some time that I posted about the Cuckoo Sandbox. Good news is that the guys at the Cuckoo Foundation are not silent and have released the Cuckoo Sandbox 2.0.7, with lots of improvements, code cleanup, support for VirtualBox 6 and the well deserved support for the...
Cross site scripting
A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages...