clock-skew NSE Script

Analyzes the clock skew between the scanner and various services that report timestamps. At the end of the scan, it will show groups of systems that have similar median clock skew among their services. This can be used to identify targets with similar configurations, such as those that share a...

Multiple Vulnerabilities in Dell SonicWALL GMS/Analyzer

Dell SonicWALL GMS/Analyzer is a centralized management system that optimizes and enhances network security monitoring, security reporting and more.analyzer is a network-based, performance monitoring and analysis solution. Multiple vulnerabilities exist in Dell SonicWALL GMS/Analyzer. A remote...

Cisco Adaptive Security Appliance Access Control List ICMP Echo Request Code Filtering Vulnerability (cisco-sa-20160711-asa)

A vulnerability in the Cisco Adaptive Security Appliance ASA Software implementation of access control list ACL permit and deny filters for ICMP Echo Reply messages could allow an unauthenticated, remote attacker to bypass ACL configurations for an affected device. ICMP traffic that should be...

Updated struts packages fix security vulnerabilities

Updated struts packages fix security vulnerabilities: A vulnerability in Apache Struts 1 ActionForm allowing unintended remote operations against components on server memory, such as Servlets and ClassLoader, was found CVE-2016-1181. It was reported that The Apache Struts 1 Validator contains a...

The vulnerability of the Serv-U File Server allows a remote attacker to modify the system configuration.

The vulnerability of the Serv-U File Server software lies in errors in the code of the web interface forms. Exploiting this vulnerability allows a malicious attacker to modify system configurations...

Siemens SICAM PAS Information Disclosure Vulnerability (CNVD-2016-04434)

SICAM PAS is an energy automation solution for the operation of substation equipment. It has open communication interfaces for power system control and control of industrial power supply equipment. An information disclosure vulnerability exists in Siemens SICAM PAS. An authenticated, local attack...

LizardStresser IoT Botnets Part of 400Gbps DDoS Attacks

LizardStresser, a distributed denial of service botnet, has found new life leveraging hundreds of internet-based webcams in attacks against Brazilian-based banks, government agencies as well as a handful of U.S.-based gaming companies. Researchers at the Arbor’s Security Engineering and Response...

Concrete5 5.7.3.1 Cross Site Scripting

------------------------------------------------------------------------- Concrete5 which is exactly 32 characters. 2 The vulnerable code is located in /concrete/controllers/singlepage/dashboard/system/registration/open.php: 13. public function updateregistrationtype 14. 15. if $this-isPost 16...

Troubleshooting Checklist: Cannot get required apps on an iOS device

If the APNSpush is not working, ask the following questions: Are port 2195 and outbound port 2196 open from the company network to reach the APNs? Is the APNs certificate valid? Are the APNs and App Store IP addresses are not present hardcoded in the host entry of the XenMobile? If there is a pro...

Microsoft Internet Explorer CVE-2016-3205 Scripting Engine Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-i...

jenkins: Granting the permission to read node configurations allows access to overall system configuration (SECURITY-281)

The API URL computer/master/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors...

jenkins: Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration (SECURITY-266)

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration...

AWS releases PCI DSS Quick Start for Deploying PCI DSS In-Scope Workloads

In the next step to help customers adopt their platform for PCI, Amazon Web Services AWS has released their PCI DSS Quick Start program. The PCI DSS Quick Start program is the next evolution of cloud providers developing tools for rapid deployment of standardized configurations to drive adoption ...

SUSE-SU-2016:1351-1 Security update for systemd

This update for SystemD provides fixes and enhancements. The following security issue has been fixed: - Don't allow read access to journal files to users. bsc972612, CVE-2014-9770, CVE-2015-8842 The following non-security issues have been fixed: - Restore initrd-udevadm-cleanup-db.service...

SOL52349521 - OpenSSL vulnerability CVE-2016-2842

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

AirOS 6.x - Arbitrary File Upload

AirOS 6.x - Arbitrary File Upload EDB-Note Source: https://hackerone.com/reports/73480 Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's possible to a...

SOL22334603 - OpenSSL vulnerability CVE-2016-0799

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445)

Qemu: nvram: OOB r/w access in processing firmware configurations CVE-2016-1714 1296080 Qemu: i386: NULL pointer dereference in vapicwrite CVE-2016-1922 1292767 qemu: Stack-based buffer overflow in megasasctrlgetinfo CVE-2015-8613 1293305 qemu-kvm: Infinite loop and out-of-bounds transfer start i...

How to configure standalone SQL server, Database Mirroring, and Always on High Availability

How to configure standalone SQL server, Database Mirroring, and Always on High Availability...

[SECURITY] [DSA 3517-1] exim4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3517-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 14, 2016 https://www.debian.org/security/faq -...