DEBIAN-CVE-2016-8625

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host...

GHSA-2J9C-9VMV-7M39 Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

GHSA-6M53-C78Q-7QMG Mitmweb in mitmproxy allows DNS Rebinding attacks

mitmweb in mitmproxy before v4.0.4 allows DNS Rebinding attacks, related to tools/web/app.py...

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...

F5 BIG-IP DNS Design Vulnerability

F5 BIG-IP is an all-in-one network device that integrates network traffic management, application security management, load balancing, etc. BIG-IP DNS is one of the traffic managers. A security vulnerability exists in F5 BIG-IP DNS versions 13.1.0 through 13.1.0.7 and 12.1.3 through 12.1.3.5, whi...

UBUNTU-CVE-2018-14505

mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py...

DEBIAN-CVE-2018-14505

mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py...

CVE-2018-5532

On F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 a domain name cached within the DNS Cache of TMM may continue to be resolved by the cache even after the parent server revokes the record, if the DNS Cache is receiving a stream of requests for the cached name...

DEBIAN-CVE-2018-1046

pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overfl...

USN-3715-1 dns-root-data update

This update adds the latest DNSSEC validation trust anchor required for the upcoming Root Zone KSK Rollover and refreshes the list of root hints...

CVE-2018-8304

A denial of service vulnerability exists in Windows Domain Name System DNS DNSAPI.dll when it fails to properly handle DNS responses, aka "Windows DNSAPI Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012,...

CVE-2018-8304: Undefined Security Weakness

A denial of service vulnerability exists in Windows Domain Name System DNS DNSAPI.dll when it fails to properly handle DNS responses, aka "Windows DNSAPI Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012,...

Microsoft Windows DNSAPI Remote Denial of Service Vulnerability

Microsoft Windows 7 and others are a series of operating systems released by Microsoft Corporation in the U.S. Windows Domain Name System DNS is one of the Windows domain name systems. A denial of service vulnerability exists in Microsoft Windows DNS DNSAPI.dll, which arises from a program's...

Froxlor php object injection vulnerability

Froxlor is a web-based version of the server backend control panel developed by the Froxlor team, which supports a wide range of servers such as Apache, Lighttpd and Nginx. A PHP object injection vulnerability exists in the Domain name form in Froxlor 0.9.39.5 and earlier versions. A remote...

ExxonMobil Bungles Rewards Card Debut

Energy giant ExxonMobil recently sent snail mail letters to its Plenti rewards card members stating that the points program was being replaced with a new one called Exxon Mobil Rewards+. Unfortunately, the letter includes a confusing toll free number and directs customers to a parked page that...

Threat Roundup for June 29 to July 6th

Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we've observed this week — covering the dates between June 29 and July 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, it will summarize the threats we've observed by...

CVE-2018-13252

Entrust Datacard Syntera CS 5.x has XSS via the name field of "Domain or Computer Name" in the login page...

CVE-2018-13252

Entrust Datacard Syntera CS 5.x has XSS via the name field of "Domain or Computer Name" in the login page...

The vulnerability of the DNSAPI component for Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the DNSAPI component DNSAPI.dll in Windows operating systems is related to insufficient access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the Local System Account by sending specially crafted DNS responses from ...

Microsoft Forefront Unified Access Gateway 2010 External DNS Interaction Vulnerability

Microsoft Forefront Unified Access Gateway is an SSL VPN gateway server from Microsoft. Microsoft Forefront Unified Access Gateway 2010 external DNS interaction vulnerability allows remote attackers to Trigger URLs in the outbound DNS query origurl parameter from arbitrary hosts via a...