HP Security Bulletin HPSBUX03437 SSRT110025 1 – A potential security vulnerability has been identified with HP-UX running HP-UX IPFilter. The vulnerability could be remotely exploited to cause a denial of service (DoS). Note: The vulnerability only exists when HP-UX IPFilter rules are configured for UDP protocol packets and the keep state option is used in that IPFilter rule. Revision 1 of this advisory.
Monthly Archives: February 2016
Debian Security Advisory 3482-1
Debian Linux Security Advisory 3482-1 – An anonymous contributor working with VeriSign iDefense Labs discovered that libreoffice, a full-featured office productivity suite, did not correctly handle Lotus WordPro files. This would enable an attacker to crash the program, or execute arbitrary code, by supplying a specially crafted LWP file.
FBI iPhone Brouhaha Sparks Apple Store Protest In San Francisco
Apple Versus The FBI – In Plain English
Hollywood Hospital Pays Ransom To Hackers
Kaspersky Weighs Up The True Cost Of A Cyber Attack
Apache Hive Authorization Bypass
Apache Hive fails to perform a particular authorization check. Versions affected include 0.13.x, 0.14.x, 1.0.0 through 1.0.1, 1.1.0 through 1.1.1, and 1.2.0 through 1.2.1.
EBAY Bugbounty: Persistent DOM Based XSS on ebay.com
Posted by Alexander Korznikov on Feb 18
Hello all,
Description: Persistent DOM based Cross Site Scripting on ebay.com domain.
Disclosed to Ebay: January 2015
Fixed: February 2016
Vulnerability location: Every listing
Who are able to create: Sellers
Same origin policy bypass via postMessage
Write-up:
http://www.korznikov.com/2016/02/persistent-stored-dom-xss-on-ebaycom.html
Proof of Concept:
this code is inserted to the listing to pop-up alert on ebay.com domain.
<script>…
CVE-2016-2046 Cross Site Scripting in Sophos UTM 9
Posted by Mike Lisi on Feb 18
———–
Vendor:
———–
Sophos (https://www.sophos.com)
—————————————–
Affected Products/Versions:
—————————————–
Product: Sophos UTM 9
Version: 9.350-12 with pattern version 92405 (potentially lower)
—————-
Description:
—————-
Title: Cross-site Scripting (XSS) in Sophos UTM 9
CVE: CVE-2016-2046
Researcher: Mike Lisi – HALOCK Security Labs (@MikeHacksThings)
A…
Umbraco – The open source ASP.NET CMS Multiple Vulnerabilities
Posted by Sandeep Kamble on Feb 18
[image: Vulnerable Umbraco]
<http://blog.securelayer7.net/wp-content/uploads/2016/02/download.png>
Recently I got an assignment where I had to work on the Umbraco application
– a free Open Source Content Management System built on the ASP.NET
platform and is used by more than 2,25,000 websites. While performing the
security testing of this application, I discovered serious vulnerabilities
within this application, allowing to perform SSRF…