114 matches found
New HTTPS URL Leakage Attack Leaves PCs, Macs, Linux Systems Vulnerable
LAS VEGAS — Researchers have found flaws in the Web Proxy AutoDiscovery protocol tied to DHCP and DNS servers that allow hackers spy on HTTPS-protected URLs and launch a myriad of different malicious attacks against Linux, Windows or Mac computers. According to the security firm SafeBreach, this...
Cumulative update for Windows 10: June 14, 2016
None None...
Cumulative Update for Windows 10 version 1511 and Windows Server 2016 Technical Preview 4: June 14, 2016
None None...
Elevation of Privilege Vulnerability Found in Microsoft Windows WPAD Agent
Microsoft Windows is a series of operating systems released by the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows that stems from a program's inability to properly handle certain proxy discovery scenarios using the Web Proxy Autodiscovery WPAD...
Microsoft Windows WPAD Elevation of Privilege Vulnerability
Microsoft Windows is a series of operating systems released by the American company Microsoft. An elevation of privilege vulnerability exists in the Web Proxy Autodiscovery WPAD protocol for Microsoft Windows. An attacker could exploit this vulnerability to bypass security checks and obtain...
June 14, 2016 — KB3163017 (OS Build 10240.16942)
None None...
OWA Exchange Web Services (EWS) Login Scanner
This module attempts to log in to the Exchange Web Services, often exposed at https://example.com/ews/, using NTLM authentication. This method is faster and simpler than traditional form-based logins. In most cases, all you need to set is RHOSTS and some combination of user/pass files; the...
Nagios XI < 2012R1.6 Multiple Vulnerabilities
Binary data 8366.prm...
Nagios XI Autodiscovery Arbitrary Command Execution
An arbitrary command execution vulnerability has been reported in Nagios XI. The vulnerability is due to insufficient validation of incoming requests sent to the Autodiscovery module. The vulnerability can be exploited by an authenticated attacker by submitting a maliciously crafted job to the...
Nagios XI多个远程安全漏洞
Bugtraq ID:57672 Nagios是一款免费开放源代码的主机和服务监视软件 Nagios存在多个安全漏洞，包括： -Alert Cloud组件存在反射型跨站脚本漏洞，可获得敏感信息或劫持用户会话。 -Nagios QL存在存储型跨站脚本漏洞，可获得敏感信息或劫持用户会话。 -Autodiscovery没有正确过滤输入，允许攻击者提交恶意作业执行任意代码。 -'admin/commandline.php'脚本不正确过滤用户提交的参数，允许攻击者利用漏洞注入任意SQL。 -Nagios QL存在跨站请求伪造漏洞，允许攻击者利用漏洞执行恶意操作。...
Nagios XI 2012R1.5b XSS / Command Execution / SQL Injection / CSRF
Nagios XI version 2012R1.5b suffers from cross site request forgery, cross site scripting, remote command injection, and remote SQL injection vulnerabilities. Reflected XSS: Alert Cloud Component: Example URL: http://nagiosxiserver/nagiosxi/includes/components/alertcloud/index.php?width=800";...
Nagios XI 2012R1.5b XSS / Command Execution / SQL Injection / CSRF
Reflected XSS: Alert Cloud Component: Example URL: http://nagiosxiserver/nagiosxi/includes/components/alertcloud/index.php?width=800"; alert'xss'; var aa="a" : "b" : " The vulnerable code in Alert Cloud's index.php appears to have been copied and pasted into several other components as well...
Microsoft Windows DNS Server WPAD Access Validation Vulnerability
Description The Microsoft Windows DNS Server is prone to an access-validation vulnerability because the software fails to properly restrict access when defining WPAD Web Proxy Autodiscovery Protocol entries. An authenticated attacker may exploit this issue to create a WPAD DNS entry. This may aid...
Privilege escalation
The default configuration of Microsoft Windows uses the Web Proxy Autodiscovery Protocol WPAD without static WPAD entries, which might allow remote attackers to intercept web traffic by registering a proxy server using WINS or DNS, then responding to WPAD requests, as demonstrated using Internet...