Application Security this week for October 21

The "Man that was a hell of a flu bug" edition. Stay healthy, everyone.

 

SSH bypass by ... wait for it ... telling the server your request is granted.  These are not the vulnerabilities you are looking for.  They can go on their way.

https://www.libssh.org/security/advisories/CVE-2018-10933.txt

 

PHP 5.6 support is ending.  That's a whole lot of websites.

https://www.zdnet.com/article/around-62-of-all-internet-sites-will-run-an-unsupported-php-version-in-10-weeks/

 

RCE in URL handling in Edge.  Positive security model, people.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8495

 

Oracle released 300 patches, most of them critical or high.  Not sure if this is good or bad.

https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

 

jQuery File Upload has a serious bug that has been being exploited for three years.  Go update those old applications.

https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/

 

Here's a new SSL testing contender.  I haven't tried it yet but I will tomorrow.  Let me know what you think if you use it.

https://testssl.sh/

 

And that's the news.

Add comment

Bill Sempf

Husband. Father. Pentester. Secure software composer. Brewer. Lockpicker. Ninja. Insurrectionist. Lumberjack. All words that have been used to describe me recently. I help people write more secure software.

 

 

profile for Bill Sempf on Stack Exchange, a network of free, community-driven Q&A sites

MonthList