Posted by Brandon Perry on Nov 01
I am having trouble reproducing this one on 3.3 and 3.2.4. As an unauthenticated user on a clean install of dotCMS, I
perform this request.
GET /categoriesServlet?start=0&count=10&sort=asc HTTP/1.1
Host: 10.211.55.37:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Cookie:…
Posted by Dawid Golunski on Nov 01
CVE-2016-6663 / OCVE-2016-5616
Vulnerability: MySQL / MariaDB / PerconaDB – Privilege Escalation /
Race Condition
Discovered by:
Dawid Golunski
@dawid_golunski
Affected versions:
MariaDB
< 5.5.52
< 10.1.18
< 10.0.28
MySQL
<= 5.5.51
<= 5.6.32
<= 5.7.14
Percona Server
< 5.5.51-38.2
< 5.6.32-78-1
< 5.7.14-8
Percona XtraDB Cluster
< 5.6.32-25.17
< 5.7.14-26.17
< 5.5.41-37.0
An…
This Metasploit module attempts to exploit two different CVEs (CVE-2015-1328 and CVE-2015-8660) related to overlayfs.
KarjaSoft Sami FTP server version 2.0.2 USER/PASS remote buffer overflow SEH exploit.
A specially crafted webpage can cause Microsoft Internet Explorer to reallocate a memory buffer in order to grow it in size. The original buffer will be copied to newly allocated memory and then freed. The code continues to use the freed copy of the buffer.
Moodle CMS versions 3.1.2 and below suffer from cross site scripting and file upload vulnerabilities.
The fifth internal conference on cyber security, cyber welfare, and digital forensics (CyberSec2017) has announced its call for papers. It will be held April 22nd through the 24th, 2017 at St. Mary’s University, Addis Ababa, Ethiopia.
dotCMS versions before 3.5, 3.3.1, and 3.3.2 suffer from multiple remote SQL injection vulnerabilities.
Red Hat Security Advisory 2016-2134-01 – In accordance with the Red Hat Enterprise Developer Toolset Life Cycle policy, the Red Hat Developer Toolset Version 3.x offering was retired on October 31, 2016, and active support is no longer provided. Accordingly, Red Hat will no longer provide updated packages, including Critical impact security patches or Urgent priority bug fixes, for Developer Toolset Version 3.x after October 31, 2016.
Red Hat Security Advisory 2016-2135-01 – In accordance with the Red Hat Enterprise Linux Errata Support Policy, Extended Update Support for Red Hat Enterprise Linux 6.6 was retired on October 31, 2016, and active support is no longer provided. Accordingly, Red Hat will no longer provide updated packages, including Critical impact security patches or urgent priority bug fixes, for Red Hat Enterprise Linux 6.6 EUS after October 31, 2016.