Slackware: Security Advisory (SSA:2022-140-02)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-43661

totolink EX300v2 V4.0.3c.140B20210429 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /home.asp...

TotoLink EX300 跨站脚本漏洞

TotoLink EX300 is a 300 Mbps wireless N range extender from TotoLink China. version TotoLink EX300v2 V4.0.3c.140B20210429 has a cross-site scripting vulnerability that can be exploited by attackers to execute JavaScript code on the client side...

Security Bulletin: Vulnerability in RC4 stream cipher affects Multiple N-series Products (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects Multiple N-series Products Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit thi...

IBM WebSphere Application Server 7.0.0.x < 7.0.0.41 / 8.0.0.x < 8.0.0.13 / 8.5.x < 8.5.5.10 MiTM (CVE-2016-0306)

The IBM WebSphere Application Server running on the remote host is version 7.0.0.x prior to 7.0.0.41, 8.0.0.x prior to 8.0.0.13, 8.5.0.x prior to 8.5.5.10. It is, therefore, affected by a vulnerability due to weaker than expected security caused by the improper TLS configuration if FIPS 140-2 is...

CVE-2020-6320

SAP Marketing Servlet, version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted. Limited knowledge of payload is required for an attacker to exploit the vulnerability and perform tasks related to contact and interaction data which impacts Confidentiali...

Code injection

SAP Marketing Servlet, version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted. Limited knowledge of payload is required for an attacker to exploit the vulnerability and perform tasks related to contact and interaction data which impacts Confidentiali...

Slackware 14.0 / 14.1 / 14.2 / current : bind (SSA:2020-140-01)

New bind packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2020-140-01. The text itself is copyright C Slackware Linux,...

Should cloud service providers be concerned with FIPS 140-3?

If youve dealt with FedRAMP, you may already know that FIPS 140-2 is the standard for cryptographic modules published by the National Institute of Standards and Technology NIST. All cloud service providers CSPs who wish to be FedRAMP compliant must use only crypto modules that have been validated...

Huawei EulerOS: Security Advisory for cyrus-sasl (EulerOS-SA-2019-1173)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-6811

An Improper Check for Unusual or Exceptional Conditions CWE-754 vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earlier, which could cause denial of service when the module receives an IP fragmented packet with a length greater than 65535 bytes. The module then requires a pow...

PT-2019-6017 · Schneider Electric · Modicon Quantum 140 Noe771X1

Name of the Vulnerable Software and Affected Versions: Modicon Quantum 140 NOE771x1 versions 6.9 and earlier Description: The issue is related to an Improper Check for Unusual or Exceptional Conditions, which could cause denial of service when the module receives an IP fragmented packet with a...

Side channel timing attacks against (EC)DSA in RSA BSAFE CVE-2019-3739/CVE-2019-3740 - Project Wycheproof is the AFL for Cryptography

About a year ago I wrote this tweet and now I can finally justify it Project Wycheproof https://t.co/wBz9P8atHs is the AFL https://t.co/JM2l557PZi of crypto. Thanks a lot @XorNinja and team notably including Bleichenbacher for providing such a powerful tool — Antonio Sanso @asanso April 9, 2018 i...

UBUNTU-CVE-2019-11487

The Linux kernel before 5.1-rc5 allows page-refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipefsi.h, kernel/trace/trace.c, mm/gup.c, and...

EulerOS Virtualization 2.5.3 : cyrus-sasl (EulerOS-SA-2019-1173)

According to the version of the cyrus-sasl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt functio...

ISF - Industrial Control System Exploitation Framework

ISFIndustrial Exploitation Framework is a exploitation framework based on Python, it's similar to metasploit framework. ISF is based on open source project routersploit. Read this in other languages:English, 简体中文, ICS Protocol Clients Name | Path | Description ---|---|--- modbustcpclient |...

Encryption of Federal Data

One of the biggest challenges our customers face when pursuing Federal Risk and Authorization Management Program FedRAMP compliance is the federal mandate that Federal Information Processing Standards FIPS 140-2 validated cryptographic modules must be consistently applied where cryptography is...

D-Link Router Password Plaintext Storage Vulnerability

The DWR-116, DIR-140, and DIR-640 are all D-Link router products. A password plaintext storage vulnerability exists in several series of D-Link routers, which stems from the administrative password being stored in plaintext in the /tmp/XXX /0 file. An attacker with directory traversal or LFI can...

Cb Protection 8.1 Makes Replacing Legacy Antivirus On Critical Systems and Servers Easier Than Ever

Cb Protection, has a long history of innovation in the market. Many have referred to Cb Protection as a pioneer in the application control market. Application control also known as whitelisting is used to lock down critical systems and servers. It's also one of the strongest forms of protection a...

CVE-2018-11543

A Local File Inclusion LFI vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the downloading of arbitrary files via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects...