Application Security This Week for October 28

by Bill Sempf 28. October 2018 01:03

A flaw in X.Org is exploitable with a tweet sized attack.


A malformed IPv6 packet can take over a Linux box. Thanks, SystemD.


Twelve malicious Python libraries were found and removed from PyPi.


And that's the news!




Application Security this week for October 21

by Bill Sempf 21. October 2018 13:55

The "Man that was a hell of a flu bug" edition. Stay healthy, everyone.


SSH bypass by ... wait for it ... telling the server your request is granted.  These are not the vulnerabilities you are looking for.  They can go on their way.


PHP 5.6 support is ending.  That's a whole lot of websites.


RCE in URL handling in Edge.  Positive security model, people.


Oracle released 300 patches, most of them critical or high.  Not sure if this is good or bad.


jQuery File Upload has a serious bug that has been being exploited for three years.  Go update those old applications.


Here's a new SSL testing contender.  I haven't tried it yet but I will tomorrow.  Let me know what you think if you use it.


And that's the news.


Application Security This Week for October 7

by Bill Sempf 7. October 2018 20:38

Authentication bypass vulnerability in Western Digital My Cloud allows escalation to admin privileges.  Obscure finding, but neat bug.


EIGHTY FIVE findings in latest Adobe Reader patch.


It looks like we might be getting a foothold on the war against malware.


And that's the news!


Husband. Father. Pentester. Secure software composer. Brewer. Lockpicker. Ninja. Insurrectionist. Lumberjack. All words that have been used to describe me recently. I help people write more secure software.

Find me on Mastodon

profile for Bill Sempf on Stack Exchange, a network of free, community-driven Q&A sites