SQL Injection Vulnerability in One Wave Website Building System

Hefei Yilang Network Technology Co., Ltd. is a professional network design company integrating creativity, design, production and development. A SQL injection vulnerability exists in the One Wave Network website builder system. Attackers can use the vulnerability to obtain sensitive database...

UBUNTU-CVE-2018-10536

An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks...

manuals-backend.z-wave.info XSS vulnerability

Open Bug Bounty ID: OBB-607291 Description| Value ---|--- Affected Website:| manuals-backend.z-wave.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Word Attachment Delivers FormBook Malware, No Macros Required

A new wave of document attacks targeting inboxes do not require enabling macros in order for adversaries to trigger an infection chain that ultimately delivers FormBook malware. Researchers at Menlo Security are reporting a wave of attacks that began last month that are targeting financial and...

New 10 Second SLA For Rapid DDoS Mitigation

Two months ago, we updated the Imperva Incapsula SLA service level agreement to guarantee network and application layer DDoS attack mitigation in under 10 seconds. This commitment sets a new standard for time to mitigation TTM, made possible by improvements to our DDoS mitigation technology and...

UBUNTU-CVE-2017-18207

The Waveread.readfmtchunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service divide-by-zero and exception via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications...

Python 'Wave_read._read_fmt_chunk' function denial of service vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A security vulnerability exists in the 'waveread.readfmtchunk' function in the Lib/wave.py file in Python...

PT-2018-6736 · Python +2 · Python +2

Name of the Vulnerable Software and Affected Versions: Python versions through 3.6.4 Description: The issue concerns the Wave read. read fmt chunk function in Lib/wave.py, which does not ensure a nonzero channel value. This allows attackers to cause a denial of service via a crafted wav format...

openSUSE Security Update : lame (openSUSE-2018-214)

This update for lame fixes the following issues : Lame was updated to version 3.100 : - Improved detection of MPEG audio data in RIFF WAVE files. sf3545112 Invalid sampling detection - New switch --gain , range -20.0 to +12.0, a more convenient way to apply Gain adjustment in decibels, than the u...

Security update for lame (important)

This update for lame fixes the following issues: Lame was updated to version 3.100: Improved detection of MPEG audio data in RIFF WAVE files. sf3545112 Invalid sampling detection New switch --gain decibel, range -20.0 to +12.0, a more convenient way to apply Gain adjustment in decibels, than the...

USN-3568-1 wavpack vulnerabilities

Hanno Böck discovered that WavPack incorrectly handled certain WV files. An attacker could possibly use this to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2016-10169 Joonun Jang discovered that WavPack incorrectly handled certain RF64 files. An...

CVE-2018-6767

An out-of-bounds stack buffer read flaw was found in WavPack. This flaw could potentially be used to crash WavPack CLI utilities by tricking them into processing specially crafted WAVE files...

Getting Back on the Field

Growing up as a foreign service brat, I was obsessed with security. Living in Guatemala in the 80s you had to adapt and become resilient as child. As there was no TV in our household, 10-year-old Tom began to tinker with my father’s computer and soon it became my oasis from the stress of living i...

The Forrester Wave Ranks Imperva as a Leader for DDoS Mitigation Providers

Imperva has tracked the DDoS threat for some time now. Back in 2014 we saw the rise of DDoS botnets. In 2015, we revealed one of the first IoT-based DDoS attacks. Last year, we predicted and then documented one of the largest botnet-based DDoS attacks. DDoS mitigation, as it turns out, is the...

Nullsoft Winamp Pro Denial of Service Vulnerability

Nullsoft Winamp Pro is a set of free media player software developed by Nullsoft Corporation in the United States. The program supports a wide range of media formats, skinning and plug-in extensions, as well as the most basic playlist and media library features. A security vulnerability exists in...

CVE-2017-16868

In SWFTools 0.9.2, the wavconvert2mono function in lib/wav.c does not properly restrict a multiplication within a malloc call, which allows remote attackers to cause a denial of service integer overflow and NULL pointer dereference via a crafted WAV file...

A week in security (October 30 – November 5)

Last week on our blog, we told you what to expect at the upcoming Irisscon security conference in Dublin. We gave you a quick introduction into the why and how of analyzing malware based on their API calls. And we issued a warning about some lesser-known cybercrimes. Plus we explained why emergin...

Q2 2017 Global DDoS Threat Landscape Report

This week we released our latest Global DDoS Threat Landscape Report, a statistical analysis of more than 15,000 network and application layer DDoS attacks mitigated by Imperva Incapsula services during Q2 2017. This quarter, for the fifth one in a row, we saw a decrease in the number of network...

FIBARO Home Center Detection

Detection of FIBARO Home Center. The script sends a connection request to the server and attempts to detect FIBARO Home Center and to extract its version. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

August 17, 2017 – Morning Cyber Coffee Headlines – “Davy Crockett” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 17, 2017 - Headlines Students offer hope for narrowing of skills gap in...