SAP NetWeaver AS JAVA P4 information disclosure Vulnerability(CVE-2017-5372)

No description provided by source...

CVE-2016-7144

The mauthenticate function in modules/msasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter...

PT-2017-9092

Name of the Vulnerable Software and Affected Versions UnrealIRCd versions prior to 3.2.10.7 UnrealIRCd versions 4.x prior to 4.0.6 Description The issue allows remote attackers to spoof certificate fingerprints, enabling them to log in as another user. This is achieved by crafting the AUTHENTICAT...

CVE-2016-7144: Improper Authentication

The mauthenticate function in modules/msasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter...

CVE-2017-0393

A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1,...

Cannot read event log Veeam MP – Management Servers

Challenge Error accessing event log on SCOM Management servers - Error 31551, 31552 in Event logs. Cause Starting in Veeam Management Pack for Microsoft System Center version 8, Dataset rules are used to collect host security profiles and snapshots. When a collector is installed on an agent, no...

Windows 'Run As' Using Powershell

This module will start a process as another user using powershell. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows 'Run As' Using Powershell', 'Description' = %q This module will start...

MS16-148: Description of the security update for Excel 2013: December 13, 2016

MS16-148: Description of the security update for Excel 2013: December 13, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...

CVE-2016-9562

CVE-2016-9562 affects SAP NetWeaver AS JAVA 7.4. The vulnerability allows remote DoS via an HTTPS GET to sap.com~P4TunnelingApp!web/myServlet, caused by a fault in icman/p4 plug-in handling that can trigger a null-pointer/DoS condition. Affected packages include SAP Kernel 7.21/7.22 variants; imp...

SAP NetWeaver AS JAVA - 'BC-BMT-BPM-DSK' XML external entity injection vulnerability

1 It is possible, that an attacker can perform a DoS attack for example, an XML Entity expansion attack 2 An SMB Relay attack is a type of man-in-the-middle attack where an attacker asks a victim to authenticate to a machine controlled by the attacker, then relays the credentials to the target. T...

PT-2016-7777

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA version 7.4 Description The issue allows remote attackers to cause a Denial of Service, resulting in a null pointer exception and icman outage. This can be achieved via an HTTPS request to the...

CVE-2016-9563: Improper Restriction of XML External Entity Reference

BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via the sap.comtcbpemhimuwlconnproviderweb/bpemuwlconn URI, aka SAP Security Note 2296909...

CVE-2016-9562: NULL Pointer Dereference

SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service null pointer exception and icman outage via an HTTPS request to the sap.comP4TunnelingApp!web/myServlet URI, aka SAP Security Note 2313835...

Oracle acquires DNS provider Dyn for more than $600 Million

Yes, Oracle just bought the DNS provider company that brought down the Internet last month. Business software vendor Oracle announced on Monday that it is buying cloud-based Internet performance and Domain Name System DNS provider Dyn. Dyn is the same company that was hit by a massive distributed...

CMS EditMe Cross Site Request Forgery Vulnerability

CMS EditMe suffers from cross site request forgery vulnerability that allows for privilege escalation. ===================================================== Exploit Title : CMS EditMe - Privilege Escalate CSRF Vulnerability Date Discovered : 2016-11-04 Affected Products: EditMe - Content Manageme...

CVE-2016-7488: Undefined Security Weakness

Teradata Virtual Machine Community Edition v15.10 has insecure file permissions on /etc/luminex/pkgmgr. These could allow a local user to modify its contents and execute commands as root...

PT-2016-7347

Name of the Vulnerable Software and Affected Versions Teradata Virtual Machine Community Edition version 15.10 Description The issue is related to insecure file permissions on the /etc/luminex/pkgmgr directory. This could allow a local user to modify the directory's contents and potentially execu...

krb5 security, bug fix, and enhancement update

1.14.1-26 - Use responder in non-preauth AS reqs - Resolves: 1363690 1.14.1-25 - Fix bad debuglog call in selinux handling - Resolves: 1292153 1.14.1-24 - Fix KKDCPP with TLS SNI by always presenting 'Host:' header - Resolves: 1364993 1.14.1-23 - Add dependency on libkadm5 to krb5-devel - Resolve...

Open-Xchange: Stored XSS in Template Documents

Steps to reproduce: Setup: Edit My Contact Data: - first name: ' onmouseover=alert1 data-first=' - last name: anything 1. Create a new text document, and make sure it is saved. 2. Click Review, check "Track Changes". 3. Make another edit, it should show coloured now as it is tracked. 4. Click Fil...

CVE-2016-6445

A vulnerability in the Extensible Messaging and Presence Protocol XMPP service of the Cisco Meeting Server CMS before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate user. This vulnerability is due to the XM...