Monthly Archives: November 2016
Atlassian Confluence AppFusions Doxygen 1.3.x Cross Site Scripting
Atlassian Confluence AppFusions Doxygen versions 1.3.0, 1.3.1, 1.3.2, and 1.3.3 suffer from a cross site scripting vulnerability.
Atlassian Confluence AppFusions Doxygen 1.3.x Information Disclosure
Atlassian Confluence AppFusions Doxygen versions 1.3.0, 1.3.1, 1.3.2, and 1.3.3 suffer from an information disclosure vulnerability.
Atlassian Confluence AppFusions Doxygen 1.3.0 Path Traversal
Atlassian Confluence AppFusions Doxygen version 1.3.0 suffers from a path traversal vulnerability.
Spammers using Facebook Messenger to Spread Locky Ransomware
If you came across any Facebook Message with an image file (exactly .SVG file format) send by any of your Facebook friends, just avoid clicking it.
An ongoing Facebook spam campaign is spreading malware downloader among Facebook users by taking advantage of innocent-looking SVG image file to infect computers.
If clicked, the file would eventually infect your PC with the nasty Locky Ransomware,
Ansvif 1.6.1
Ansvif is “A Not So Very Intelligent Fuzzer”. It feeds garbage arguments and data into programs trying to induce a fault.
Dlink DIR Routers Unauthenticated HNAP Login Stack Buffer Overflow
Several Dlink routers contain a pre-authentication stack buffer overflow vulnerability, which is exposed on the LAN interface on port 80. This vulnerability affects the HNAP SOAP protocol, which accepts arbitrarily long strings into certain XML parameters and then copies them into the stack. This exploit has been tested on the real devices DIR-818LW and 868L (rev. B), and it was tested using emulation on the DIR-822, 823, 880, 885, 890 and 895. Others might be affected, and this vulnerability is present in both MIPS and ARM devices. The MIPS devices are powered by Lextra RLX processors, which are crippled MIPS cores lacking a few load and store instructions. Because of this the payloads have to be sent unencoded, which can cause them to fail, although the bind shell seems to work well. For the ARM devices, the inline reverse tcp seems to work best. Check the reference links to see the vulnerable firmware versions.
Multitech RightFax Faxfinder Credential Disclosure
Multitech RightFax Faxfinder versions prior to 4.1.2 suffer from a clear-text credential disclosure vulnerability.
Debian Security Advisory 3719-1
Debian Linux Security Advisory 3719-1 – It was discovered that wireshark, a network protocol analyzer, contained several vulnerabilities in the dissectors for DCERPC, AllJoyn, DTN, and OpenFlow, that could lead to various crashes, denial-of-service, or execution of arbitrary code.
Red Hat Security Advisory 2016-2809-01
Red Hat Security Advisory 2016-2809-01 – The ipsilon packages provide the Ipsilon identity provider service for federated single sign-on. Ipsilon links authentication providers and applications or utilities to allow for SSO. It includes a server and utilities to configure Apache-based service providers. Security Fix: A vulnerability was found in ipsilon in the SAML2 provider’s handling of sessions. An attacker able to hit the logout URL could determine what service providers other users are logged in to and terminate their sessions.