-
Ils jouent à sauver la Terre contre des aliens, 50 spécialistes du hack réunis en pleine nature
September 10, 2024 at 10:15:37 AM GMT+2 * - permalink -J'apprend l'existence de l'association Alsace Digitale (bon, pas fan du "Digitale" je dois l'avouer) et de ce "camp de hacking" qui me semble bien fun !
- https://france3-regions.francetvinfo.fr/grand-est/haut-rhin/ils-jouent-a-sauver-la-terre-contre-des-aliens-50-specialistes-du-hack-reunis-en-pleine-nature-3029078.html
-
-
New Wi-Fi Encryption Vulnerability Affects Over A Billion Devices
February 28, 2020 at 3:54:40 PM GMT+1 - permalink -Une bonne explication de Kr00k, la dernière faille en date de WPA2
- https://thehackernews.com/2020/02/kr00k-wifi-encryption-flaw.html
-
oss-sec: [CVE-2019-14899] Inferring and hijacking VPN-tunneled TCP connections.
December 6, 2019 at 4:50:21 PM GMT+1 - permalink -Tiens, c'est rigolo ca "hijacking VPN-tunneled TCP connections."
- https://seclists.org/oss-sec/2019/q4/122
-
DSA-2019-137: iDRAC Improper Authorization Vulnerability
November 8, 2019 at 11:17:50 AM GMT+1 - permalink -In case you have your iDRAC available publicly ... (Hi NordVPN ;-) )
- https://www.dell.com/support/article/sln319317/dsa-2019-137-idrac-improper-authorization-vulnerability?lang=en
-
New PHP Flaw Could Let Attackers Hack Sites Running On Nginx Servers
October 26, 2019 at 11:56:36 PM GMT+2 - permalink -a website is vulnerable, if:
NGINX is configured to forward PHP pages requests to PHP-FPM processor, fastcgi_split_path_info directive is present in the configuration and includes a regular expression beginning with a '^' symbol and ending with a '$' symbol, PATH_INFO variable is defined with fastcgi_param directive, There are no checks like try_files $uri =404 or if (-f $uri) to determine whether a file exists or not.- https://thehackernews.com/2019/10/nginx-php-fpm-hacking.html
-
Another libssh2 integer overflow (CVE-2019-17498) | Semmle Blog
October 23, 2019 at 11:50:47 AM GMT+2 - permalink -ah, le premier qui soit si clair, je cite :
This is not a vulnerability in openssh, so it doesn't affect the ssh that we all use every day. libssh2 is a client-side C library, which enables applications to connect to an SSH server. This also isn't a vulnerability in libssh, which is an unrelated C library which provides similar functionality to libssh2.- https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/
-
https://www.openssh.com/txt/release-8.1
October 14, 2019 at 7:31:52 PM GMT+2 - permalink -Bon, c'est pas comme si c'etait tous les jours, mais les certif CA généré par default avec ssh-keygen v8.1 ne seront plus compatible avec OpenSSH < 7.2
- https://www.openssh.com/txt/release-8.1
-
oss-sec: Sudo: CVE-2019-14287
October 14, 2019 at 7:00:04 PM GMT+2 - permalink -Bon, dans le doute, on patch sudo hein ;-)
- https://seclists.org/oss-sec/2019/q4/18
-
CVE - CVE-2019-16701
September 26, 2019 at 11:57:43 AM GMT+2 - permalink -Vu la réponse de PFsense sur twitter (see https://twitter.com/CVEnew/status/1176900464643887109 ) on va dire que c'est DISPUTED :)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16701
-
[Unpatched] Critical 0-Day RCE Exploit for vBulletin Forum Disclosed Publicly
September 25, 2019 at 8:22:56 AM GMT+2 * - permalink -J'espère que vous utilisez pas vBulletin. Joli POC cela dit :)
Edit: on patch https://threatpost.com/exploits-critical-vbulletin-rce-bug/148712/- https://thehackernews.com/2019/09/vbulletin-zero-day-exploit.html
-
VMSA-2019-0014
September 20, 2019 at 10:29:29 AM GMT+2 * - permalink -Je suis pas contre qu'on me l'explique celle-là...
EDIT: Ils ont enlevé la note; tout le monde est affecté- https://www.vmware.com/security/advisories/VMSA-2019-0014.html
-
Exim TLS Flaw Opens Email Servers to Remote 'Root' Code Execution Attacks
September 6, 2019 at 4:56:08 PM GMT+2 - permalink -Si vous utilisez Exim (pourquoi?) patchez !
- https://thehackernews.com/2019/09/exim-email-server-vulnerability.html
-
Half of Android Handsets Susceptible to Clever SMS Phishing Attack | Threatpost
September 5, 2019 at 9:14:55 AM GMT+2 - permalink -and that's why I'm not using Bank app on my mobile ...
- https://threatpost.com/half-of-android-handsets-susceptible-to-clever-sms-phishing-attack/147988/
-
-
Android PDF app with just 100m downloads caught sneaking malware into mobes • The Register
August 28, 2019 at 11:02:41 AM GMT+2 - permalink -Désinstallez l'application CamScanner si vous l'avez sur votre mobile android !
PS: L'application notebloc (sur F-Droid) la remplace à merveille !
via https://sebsauvage.net/links/?RaYzMw- https://www.theregister.co.uk/2019/08/28/camscanner_android_malware/
-
CVE - CVE-2019-15316
August 22, 2019 at 4:24:03 PM GMT+2 - permalink -Attention aux utilisateurs de Steam, une élévation de privilège dans la version actuelle de Steam (hors beta, qui est corrigé). voir aussi https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15315
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15316
-
-
-