Cisco Cloud Web Security Security Restriction Bypass Vulnerability

Cisco Cloud Web Security is the United States Cisco Cisco company's set of network security protection software. connector engine is one of the connector engine. A security vulnerability exists in the connector engine in Cisco Cloud Web Security, which stems from the program's failure to properly...

Unable to Configure Citrix App Layering ELM PVS Connector

The App Layering Agent PVS Agent on the PVS server is registered with the App Layering ELM virtual appliance, and the PVS Server enumerates on the App Layering PVS connector screen. However,clicking "check credentials" an error is displayed stating that the ELM cannot use the credentials on the P...

PKI entities connection test intermittently fails to connect to CA server via cloud connector

The cloud connectors could not connect to PKI server. The below error is generated: 2017-08-08T13:55:39.253+0000 | 467782B2FC0AB30F | ERROR | http-nio-14443-exec-15 | MsCertSrvConnector | TestConnection to pki url certnew.cer failed with response Headers: null=HTTP/1.1 401 Unauthorized, and...

Polycom BToE Connector Elevation of Privilege Vulnerability

Polycom BToE Connector is a BToE connector developed by Polycom. A security vulnerability exists in Polycom BToE Connector versions prior to 3.0.0, which originates from a program that assigns weak privileges to the x86\polycom\polycom btoe connector\plcmbtoesrv.exe program file. A local attacker...

Design/Logic Flaw

Polycom BToE Connector before 3.0.0 uses weak permissions Everyone: Full Control for "Program Files x86\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file...

CVE-2015-8300

Polycom BToE Connector (pre-3.0.0) exposes weak permissions (Everyone: Full Control) on the file plcmbtoesrv.exe, enabling local privilege escalation via a Trojan horse/file replacement. Multiple sources corroborate that versions prior to 3.0.0 are affected; fixed in version 3.0.0 released March ...

CVE-2015-8300

Polycom BToE Connector before 3.0.0 uses weak permissions Everyone: Full Control for "Program Files x86\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file...

Authorization Bypass

mysql-connector is vulnerable to authorization bypass. The library does not properly verify server certificates if the sslverifycert value is set to false. This allows a malicious user to update, insert or delete data on the database...

Qualys Cloud Platform 2.30 New Features

This release of the Qualys Cloud Platform version 2.30 includes updates and new features for Cloud Agent, EC2 Connector, Web Application Scanning, Web Application Firewall, and Security Assessment Questionnaire, highlights as follows. This posting has been updated on 9/6/2017 and 10/25/2017 to...

SQL Injection

mysql-connector-java is vulnerable to SQL injection. This is possible because user input is directly used in SQL queries without being checked for malicious intent...

PowerSAP: A PowerShell SAP Security Assessment Tool!

PenTestIT RSS Feed This post is about PowerSAP, a tool that was included in this years BlackHat Arsenal. What I like about this tool is that it does not try to re-invent the wheel and yet keeps it's source code open for all of us to see and understand. The author @Sn0rkY is upfront about this and...

CVE-2016-8745

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn...

CVE-2016-8745

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn...

CVE-2016-8745

CVE-2016-8745 describes a bug in Tomcat’s NIO HTTP connector error handling that could allow information leakage between requests. A Processor object could be added to the Processor cache multiple times, enabling the same Processor to service concurrent requests and potentially expose session IDs...

CVE-2016-8745

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn...

CVE-2017-3635

Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/C. Supported versions that are affected are 6.1.10 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors...

CVE-2017-3635

CVE-2017-3635 affects Oracle MySQL Connectors (Connector/C) with affected versions 6.1.10 and earlier. The issue allows a low-privileged, network-remote attacker to cause a hang or crash (DOS) of MySQL Connectors; documentation notes proper use of mysql_stmt_close. Exploitation details are not pr...

CVE-2017-3635

Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/C. Supported versions that are affected are 6.1.10 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors...

MySQL 5.7.x < 5.7.19 Multiple Vulnerabilities (RPM Check) (July 2017 CPU) (October 2017 CPU)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.19. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the UDF component that allows an authenticated, remote attacker to cause a denial of service condition. CVE-2017-3529 - An unspecified...

Oracle MySQL Server Denial of Service Vulnerability (CNVD-2017-17185)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which the MySQL Server component is a server component. A security vulnerability exists in the Connector/C subcomponent of the MySQL Server component in Oracle MySQL. A remotely authorized attacker...