5496 matches found
New Comic Videos Take CISO/Security Vendor Relationship to the Extreme
Today's CISOs operate in an overly intensive environment. As the ones who are tasked with the unenviable accountability for failed protection and successful breaches, they must relentlessly strive to improve their defense lines with workforce education, training their security teams and last but...
U.S. Dept Of Defense: Able to log in with default ██████g creds at https█████████████████████.mil
Summary████ was able to use ████████████████████████ to log into this instance of Adobe Experience Manager, though it does not seem to be in used at the moment Description███████ while navigating to https█████████████████████████.mil, I performed some fuzzing and found that /repository was...
Cisco Firepower Threat Defense Input Validation Error Vulnerability
Cisco Firepower Threat Defense FTD is a suite of unified software from the U.S. company Cisco Cisco that provides next-generation firewall services. An input validation error vulnerability exists in the CLI in Cisco FTD. A local attacker could exploit this vulnerability to execute commands with...
The vulnerability of the SIP protocol implementation in Cisco Adaptive Security Appliances and Cisco Firepower Threat Defense (FTD) allows attackers to induce service failure.
The vulnerability of the SIP protocol implementation in Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense FTD is related to errors in processing SIP packets. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...
The vulnerability of the multi-connection mode of the Microprogrammable Network Interface Device Firepower Threat Defense (FTD) allows a attacker to exit the container for their own instance of FTD and execute arbitrary commands with root privileges.
The vulnerability of the multi-connection mode of the Firepower Threat Defense FTD software relates to security configuration errors. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root privileges from within the FTD instance...
The vulnerability of the multi-connection mode of the Microprogrammable Network Interface Device Firepower Threat Defense (FTD) allows a attacker to exit the container for their own instance of FTD and execute arbitrary commands with root privileges.
The vulnerability of the multi-connection mode of the Firepower Threat Defense FTD software relates to security configuration errors. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root privileges from within the FTD instance...
Cisco Firepower Threat Defense Local Elevation of Privilege Vulnerability
Cisco Firepower Threat Defense is a suite of unified software that provides next-generation firewall services. A security vulnerability exists in the Cisco Firepower Threat Defense CLI that allows a local attacker to exploit the vulnerability by submitting a special request to gain ROOT privilege...
The vulnerability of the command-line interface of the Cisco FX-OS network operating system and the Cisco Firepower Threat Defense (FTD) network switches’ micro-programming software allows a attacker to execute arbitrary commands on the privileged root operating system.
The vulnerability of the command-line interface of the Cisco FX-OS network operating system and the Cisco Firepower Threat Defense FTD network interface micro-programming system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute...
The vulnerability of the FTP analysis mechanism of Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense (FTD) allows attackers to induce service interruptions.
The vulnerability of the FTP analysis mechanism of Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense FTD is related to the execution of operations outside the buffer in memory. Exploitation of this vulnerability can allow a malicious actor to cause service interruptions using...
The vulnerability of the Internet Key Exchange Version 1 function in Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense (FTD) software allows a attacker to induce a service failure.
The vulnerability of the Internet Key Exchange Version 1 IKEv1 function in Cisco Adaptive Security Appliances and Cisco Firepower Threat Defense FTD is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to induce service failure through specially...
GE Mark VIe Controller
1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Low skill level to exploit Vendor: GE Equipment: Mark VIe Controller Vulnerabilities: Improper Authorization, Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to create...
ICSA-19-281-04 Siemens SIMATIC IT UADM
1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIMATIC IT Unified Architecture Discrete Manufacturing UADM Vulnerability: Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of this vulnerability...
U.S. Dept Of Defense: Null byte Injection in https://████/
Description: Microsoft .NET Framework is prone to multiple NULL-byte injection vulnerabilities because it fails to adequately sanitize user-supplied data. Vulnerable URL: https://████/%2F%20This%20website%20is%20vulnerable%20to%20NULL%20BYTE%20INJECTION/ Steps to Reproduce: 1 An attacker can...
U.S. Dept Of Defense: [█████] — DOM-based XSS on endpoint `/?s=`
Description GET parameter s is vulnerable to DOM-based XSS on endpoint /?s=. XSS affects all users and no authentication or login is required. Proof of Concept Visit the following URL for PoC: https://██████/?s=%27%3E%3Cscript%3Ealertdocument.domain%3C/script%3E █████████ Explanation This DOM-bas...
U.S. Dept Of Defense: Information disclousure by clicking on the link shown in http://████████/
Description: Looking at some subdomains using aquatone I noticed http://█████/ I clicked it and then started navigating the page, if I go to this link: https://█████████/██████████wireframes/admin/round12/tsp0-awarded.html it is completely valid and shows some information that I'm unsure it shoul...
What Is the DoD’s New Cybersecurity Maturity Model Certification, and What Does It Mean for Defense Contractors?
Citing the threat of compromise of Controlled Unclassified Information CUI within the defense industrial base DIB, along with the high cost of cyber breaches in general, the Office of the Assistant Secretary of Defense for Acquisition has initiated a program for rating the cybersecurity maturity ...
Cisco IOS XE Software Unified Threat Defense Denial of Service Vulnerability
According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information TRUSTED...
The vulnerability of the Unified Threat Defense (UTD) function in the Cisco IOS XE operating system allows a attacker to trigger a reboot of the vulnerable device.
The vulnerability of the Unified Threat Defense UTD function in the Cisco IOS XE operating system is related to errors in packet processing for IPv6. Exploiting this vulnerability can allow a malicious actor to trigger a reboot of the vulnerable device through specially crafted IPv6 traffic...
CVE-2019-12694
A vulnerability in the command line interface CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker with administrative privileges to execute commands on the underlying operating system with root privileges. The vulnerability is due to insufficient input...
CVE-2019-12698
A vulnerability in the WebVPN feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The vulnerability is due to excessive processing load f...