CVE-2020-3391

Cisco DNA Center Information Disclosure (CVE-2020-3391): An authenticated remote attacker could view credentials stored insecurely, by accessing device configuration. Affected product: Cisco DNA Center. Root cause: insecure storage of unencrypted credentials. Impact: potential exposure of credent...

Exploit for CVE-2020-0609

This is a PoC exploit for CVE-2020-0609 and CVE-2020-0610, two v...

Microsoft Windows Remote Desktop Gateway allows for unauthenticated remote code execution

Overview Microsoft Windows Remote Desktop Gateway contains vulnerabilities that may allow a remote, unauthenticated attacker to execute arbitrary code with SYSTEM privileges on a vulnerable system. Description Microsoft Windows Remote Desktop Gateway RD Gateway is a Windows Server component that...

RHEL 8 : libreswan (RHSA-2019:3391)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3391 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide...

Ubuntu 14.04 LTS / 16.04 LTS : Firefox regression (USN-3391-3)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3391-3 advisory. USN-3391-1 fixed vulnerabilities in Firefox. The update introduced a performance regression with WebExtensions. This update fixes the problem. We...

Ubuntu 14.04 LTS / 16.04 LTS : Ubufox update (USN-3391-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3391-2 advisory. USN-3391-1 fixed vulnerabilities in Firefox. This update provides the corresponding update for Ubufox. Tenable has extracted the preceding description...

CVE-2017-3391

Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2017-3391

CVE-2017-3391 affects Oracle E-Business Suite, Oracle Advanced Outbound Telephony (User Interface) across affected versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6. The vulnerability permits an unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outb...

CVE-2016-3391

CVE-2016-3391 affects Microsoft Internet Explorer 10/11 and Edge. The issue allows credential disclosure via access to a memory dump (context-dependent disclosure). Connected sources identify mitigations as local patches: IE memory-disclosure fixes delivered via MS16-118 (and related MS16-119) up...

KLA10885 Multiple vulnerabilities in Microsoft Edge and Internet Explorer

Multiple serious vulnerabilities have been found in Microsoft Internet Explorer and Edge. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information or gain privileges. Below is a complete list of vulnerabilities 1. An improper memory objects handlin...

demotywatory.pl XSS vulnerability

Vulnerable URL: http://demotywatory.pl/res/evercookie/evercookie.swf?everdata=%27;alert/XSSPOSED/;var%20evercookieflashvar=1// Details: Description| Value ---|--- Patched:| Yes, at 30.01.2017 Latest check for patch:| 30.01.2017 15:44 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

Debian DSA-3391-1 : php-horde - security update

It was discovered that the web-based administration interface in the Horde Application Framework did not guard against Cross-Site Request Forgery CSRF attacks. As a result, other, malicious web pages could cause Horde applications to perform actions as the Horde user. The oldstable distribution...

Debian: Security Advisory (DSA-3391-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2007-0710)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-3391

The Path Breadcrumbs module before 7.x-3.2 for Drupal allows remote attackers to bypass intended access restrictions and obtain sensitive node titles by reading a 403 Not Found page...

CVE-2015-3391

CVE-2015-3391 affects the Drupal Path Breadcrumbs module prior to 7.x-3.2. The issue allows remote attackers to bypass access controls and read the 403 page to obtain sensitive node titles. The root cause is improper access restriction checks on 403 Not Found pages. Affected versions are Path Bre...

SA-CONTRIB-2015-037 - Path Breadcrumbs - Access Bypass

This module enables you to configure breadcrumbs for any Drupal page. The module doesn't check node access on 403 Not Found pages. As a result, unpublished content data can be shown to unprivileged user. This vulnerability is mitigated by the fact that it is possible to configure proper access...

CVE-2014-3391

Untrusted search path vulnerability in Cisco ASA Software 8.x before 8.43, 8.5, and 8.7 before 8.71.13 allows local users to gain privileges by placing a Trojan horse library file in external memory, leading to library use after device reload because of an incorrect LDLIBRARYPATH value, aka Bug I...

CVE-2014-3391

CVE-2014-3391 is a local privilege escalation in Cisco ASA Software caused by an untrusted LD_LIBRARY_PATH that enables a Trojan-horse library to be loaded from external memory, triggering a library load after reload. Affected products are Cisco ASA Software 8.x, specifically before 8.4(3), 8.5, ...

CentOS 4 : wireshark (CESA-2007:0709)

New Wireshark packages that fix various security vulnerabilities and functionality bugs are now available for Red Hat Enterprise Linux 4. Wireshark was previously known as Ethereal. This update has been rated as having low security impact by the Red Hat Security Response Team. Wireshark is a...