NfSen 1.3.7 AlienVault OSSIM 5.3.4 - Command Injection

NfSen 1.3.7 AlienVault OSSIM 5.3.4 - Command Injection Exploit Title: NfSen/AlienVault remote root exploit IPC query command injection Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault 5.3.4 Date: 2017-07-10 Vendor Homepage:...

NfSen < 1.3.7 / AlienVault OSSIM 5.3.4 - Command Injection

Exploit Title: NfSen/AlienVault remote root exploit IPC query command injection Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault 5.3.4 Date: 2017-07-10 Vendor Homepage: http://nfsen.sourceforge.net/ Vendor Homepage:...

CVE-2017-6971

creationtimestamp| type| source ---|---|--- 2017-07-10 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42306...

Code injection

AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 have an error in privilege dropping and unnecessarily execute the NfSen Perl code as root, aka AlienVault ID ENG-104945, a different vulnerability than CVE-2017-6970 and CVE-2017-6971...

CVE-2017-6971

CVE-2017-6971 affects AlienVault USM/OSSIM before 5.3.7 and NfSen before 1.3.8. A remote authenticated attacker can trigger arbitrary commands (or a reverse shell) through crafted requests manipulating NfSen’s PHP code (notably nfsen.php) and the PHP session ID, achieving root-level execution on ...

Design/Logic Flaw

Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different...

Design/Logic Flaw

Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different...

CVE-2016-6944

Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different...

CVE-2016-6971

Technical details for CVE-2016-6971 are not publicly available in the provided connected documents. No specific affected products, components, root cause, or remediation are disclosed here. Monitor for updates from official advisories and the connected sources.

CVE-2 0 1 5-6 9 7 1: the Lenovo System Update component vulnerability analysis-vulnerability warning-the black bar safety net

In the last 7 months, Lenovo a large number of system updates, software vulnerabilities let a person Shine at the moment. Lenovo this spring to fix the first vulnerability, I decided to learn more about these patches to verify the presence of these vulnerabilities. The results I found a related...

CVE-2014-6971

The CVE-2014-6971 entry affects the Android app Easy Video Downloader (com.simon.padillar.EasyVideo), version 4.4.1, which does not verify X.509 certificates from SSL servers. This enables man-in-the-middle attackers to spoof servers and steal sensitive information via a crafted certificate. The ...

CVE-2013-6971

Cisco WebEx Training Center has an open redirect vulnerability (CVE-2013-6971) that can be exploited by an unauthenticated, remote attacker to redirect users to an attacker‑supplied URL via a crafted link. The issue is described in Cisco’s advisory Cisco-SA-20131213-CVE-2013-6971, which notes tha...

CVE-2008-6971

CVE-2008-6971 describes a by-design weakness in Simple Machines Forum (SMF) where password reset codes are generated using an insecure random-number state exposed in a hidden form field. A remote attacker could predict validation codes for the password reset, enabling modification of other users’...

CVE-2008-6606

creationtimestamp| type| source ---|---|--- 2008-11-03 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6967 2008-11-03 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6971...

CVE-2006-6971

Mozilla Firefox 2.0 (Windows) vulnerability: phishing-protection can be bypassed by representing an IP address in formats such as dotted-hex, dotted-octal, decimal, hex, or octal, which evade the blacklist filter. Root cause is parsing/format handling that fails to normalize these IP representati...