CVE-2020-3259

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential...

CVE-2020-3187

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted...

PT-2020-2516 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the implementation of the Border Gateway Protocol BGP...

PT-2020-2506 · Cisco · Cisco Ftd

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the application policy configuration of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to...

PT-2020-2165 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the web services interface could allow an unauthenticated, remote attacker to condu...

PT-2020-2515 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the DHCP module could allow an unauthenticated, remote...

PT-2020-2163 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: The issue is related to improper length validation of a field in an IPv6 D...

PT-2020-2228 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the Open Shortest Path First OSPF implementation could...

Fazecast jSerialComm

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Fazecast Equipment: jSerialComm Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on a...

PT-2020-2229 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the Secure Sockets Layer SSL/Transport Layer Security T...

PT-2020-2236 · Cisco · Snort +3

Name of the Vulnerable Software and Affected Versions: Cisco IOS versions prior to the fixed version Cisco Firepower Threat Defense versions prior to the fixed version Cisco Firepower Management Center versions prior to the fixed version Description: The issue is related to errors in how the Snor...

PT-2020-2230 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the Open Shortest Path First OSPF implementation could...

U.S. Dept Of Defense: Arbitrary file upload and stored XSS via ███ support request

Summary: A malicious user can upload files of any type when submitting a support request. Impact This would allow the attacker to upload malicious executable files as well as .html or .svg files which would allow the attacker to execute malicious code on behalf of the ████ customer support...

U.S. Dept Of Defense: RXSS - https://███/

Hello All I Found RXSS in your OWN Website Steps:- Add Payload XSS To /████?view= Example:- https://████/█████████?view=%3Cscript%3Ealert%22xElkomy%22%3C/script%3E Payloads:- Any payloads XSS Fix:- Filter input on arrival Encode data on output Use appropriate response headers Content Security...

U.S. Dept Of Defense: No Rate Limiting on https://██████/██████████/accounts/password/reset/ endpoint leads to Denial of Service

Summary: No-Rate Limit on Password reset endpoint results mail-spam functionality to be abused. Additionally, the password-reset link remain the same after each request. Description: Malicious user could Spear-target █████████ user mail and Spam it for as many requests as he would like. Possible...

Ransomware groups continue to target healthcare, critical services; here’s how to reduce risk

At a time when remote work is becoming universal and the strain on SecOps, especially in healthcare and critical industries, has never been higher, ransomware actors are unrelenting, continuing their normal operations. Multiple ransomware groups that have been accumulating access and maintaining...

LCDS LAquis SCADA

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Low skill level to exploit Vendor: LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME Equipment: LAquis SCADA Vulnerabilities: Exposure of Sensitive Information to an Unauthorized Actor, Improper Input Validation 2. RISK EVALUATION Successful...

U.S. Dept Of Defense: Reflected XSS and HTML Injectionon a DoD website

Summary: I found Xss and Html injection vulnerabilities on one of the DoD websites Description: When doing the Xss tests I used this payload: alert "XSS" and when running I noticed that the server returned a 403 Forbidden error, but it was easy to do a bypass I just modified the javascript tags i...

U.S. Dept Of Defense: CSRF - Close Account

Target Url ████/services/user/closeAccount Summary: Hello, I found a Cross Site Request Forgery bug in the target endpoint on the POST request /█████/services/user/closeAccount which is critical because it can delete authenticated user account whenever he navigates to the attacker website or link...

U.S. Dept Of Defense: Unrestricted file upload leads to stored xss on https://████████/

Summary: When the user want to upload a "certificate", the web app doesn't check the content-type of the file. A user can upload any kind of file binary,html,... Step-by-step Reproduction Instructions 1. Create an account at https://██████/████████/app/registration/basic-info 2. When you are...