[TZO-04-2020] Bitdefender Generic Malformed Archive Bypass (BZ2)
All Bitdefender Products and Vendors that have licensed the Engine before Dec 12 2019. Exact version is unknown as Bitdefender
Leer más
Advisories
Problemas de seguridad, hay que promover la cultura del parcheo … sin mas. Un parche instalado a tiempo te evita problemas en el futuro (bueno, lo mismo con Microsoft hay que esperar un poco mas).
[TZO-03-2020] ESET Generic Malformed Archive Bypass (ZIP Compression Information)
10 years ago I took a look at ways to evade AV/DLP Engine detection by using various techniques and released
Leer más
[TZO-02-2020] Kaspersyk Generic Malformed Archive Bypass (ZIP GFlag)
10 years ago I took a look at ways to evade AV/DLP Engine detection by using various techniques and released
Leer más
[TZO-01-2020] AVIRA Generic Malformed Container bypass (ISO)
10 years ago I took a look at ways to evade AV/DLP Engine detection by using various techniques and released
Leer más
[RT-SA-2019-015] IceWarp: Cross-Site Scripting in Notes for Contacts
During a penetration test, RedTeam Pentesting discovered that the IceWarp WebMail Server is prone to user-assisted cross-site scripting attacks in
Leer más
Microsoft Windows .Group File / URL Field Code Execution
Windows «.group» files are related to Contact files and suffer from unexpected code execution when clicking the «Contact Group Details»
Leer más
[DSA 4596-1] tomcat8 security update
Several issues were discovered in the Tomcat servlet and JSP engine, which could result in session fixation attacks, information disclosure,
Leer más
[DSA 4595-1] debian-lan-config security update
It was discovered that debian-lan-config, a FAI config space for the Debian-LAN system, configured too permissive ACLs for the Kerberos
Leer más
[DSA 4594-1] openssl1.0 security update
Guido Vranken discovered an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli.
Leer más
[DSA 4593-1] freeimage security update
It was found that freeimage, a graphics library, was affected by the following two security issues.
Leer más
Microsoft Exchange Server, External Service Interaction (DNS)
Microsoft Exchange Server, External Service Interaction (DNS) Exchange Server 2013 CU22 and previous.
Leer más
[DSA 4592-1] mediawiki security update
It was discovered that the Title blacklist functionality in MediaWiki, a website engine for collaborative work, could by bypassed.
Leer más
[slackware-security] openssl (SSA:2019-354-01)
New openssl packages are available for Slackware 14.2 and -current to fix a security issue.
Leer más
CA20191218-01: Security Notice for CA Client Automation Agent for Windows
CA Technologies, A Broadcom Company, is alerting customers to a potential risk with CA Client Automation agent on Windows. A
Leer más
[DSA 4591-1] cyrus-sasl2 security update
Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and
Leer más
[slackware-security] wavpack (SSA:2019-353-01)
New wavpack packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.
Leer más
[DSA 4590-1] cyrus-imapd security update
It was discovered that the lmtpd component of the Cyrus IMAP server created mailboxes with administrator privileges if the «fileinto»
Leer más
[DSA 4589-1] debian-edu-config security update
It was discovered that debian-edu-config, a set of configuration files used for the Debian Edu blend, configured too permissive ACLs
Leer más
[DSA 4588-1] python-ecdsa security update
It was discovered that python-ecdsa, a cryptographic signature library for Python, incorrectly handled certain signatures. A remote attacker could use
Leer más
WordPress 5.3.2
Ayer soltaron una nueva versión de mantenimiento de WordPress. Esta 5.3.2 resuelve algunos pequeños problemas que han detectado en la
Leer más