Phoenix Broadband Technologies LLC PowerAgent SC3 Site Controller

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Phoenix Broadband Technologies LLC Equipment: PowerAgent SC3 Site Controller Vulnerability: Use of Hard-Coded Password AFFECTED PRODUCTS Phoenix Broadband Technologies LLC reports that the following versions of...

[SECURITY] Fedora 24 Update: lynis-2.5.0-1.fc24

Lynis is an auditing and hardening tool for Unix/Linux and you might even c all it a compliance tool. It scans the system and installed software. Then it performs many individual security control checks. It determines the hardeni ng state of the machine, detects security issues and provides...

Revised Active Defense Bill Allows Victims to Recover or Destroy Stolen Data

A controversial bill that would allow organizations that have been breached to hack back has undergone revisions that include an exemption permitting victims to recover or destroy their data on an attacker’s infrastructure. Rep. Tom Graves R-GA introduced the updated Active Cyber Defense Certaint...

SA150: NSS Vulnerability April 2017

SUMMARY Symantec Network Protection products using affected versions of NSS are susceptible to a security vulnerability. A remote attacker can send crafted Base64-encoded data and execute arbitrary code or cause denial of service through an application crash. AFFECTED PRODUCTS The following...

Installers of the screensavers provided by JAPAN AIR SELF DEFENSE FORCE, MINISTRY OF DEFENSE may insecurely load Dynamic Link Libraries

Overview Installers of the screensavers provided by JAPAN AIR SELF DEFENSE FORCE, MINISTRY OF DEFENSE contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Eili Masami of Tachibana Lab. reported this vulnerability to IPA. JPCERT/CC coordinated wit...

JVN#41185163: Installers of the screensavers provided by JAPAN AIR SELF DEFENSE FORCE, MINISTRY OF DEFENSE may insecurely load Dynamic Link Libraries

Installers of the screensavers provided by JAPAN AIR SELF DEFENSE FORCE, MINISTRY OF DEFENSE contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Impact This vulnerability can be exploited when the following condition is met. If this vulnerabilit...

Cisco Firepower Threat Defense and Cisco ASA with FirePOWER Module Improper SSL Policy Packet Handling DoS (cisco-sa-20170503-ftd)

According to its version, the Cisco Firepower Threat Defense FTD software installed on the remote host is prior to 6.1.0.3 or else is 6.2.x prior to 6.2.1. It is, therefore, affected by a denial of service vulnerability in the access control policy due to improper handling of SSL packets. An...

Trump's Top Cybersecurity Boss Talks Priorities

BOSTON–Citing Mirai and WannaCry as recent examples, Rob Joyce, special assistant to the president and cyber security coordinator for the White House, said the global landscape of cyber threats can’t be ignored and the U.S. needs to sharpen its defenses when it comes to fending off attacks. “If y...

U.S. Dept Of Defense: Arbitary file download vulnerability on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about the web application and system. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability!...

U.S. Dept Of Defense: Limited code execution vulnerability on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to execute some malicious code. @sp1d3rs was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability! This bug was an interesting one. I will writ...

For the APT organization to use the EPS vulnerabilities in and mention the right vulnerability analysis-vulnerability warning-the black bar safety net

In 2015, FireEye released a Microsoft Office EPS（Encapsulated PostScript in the two vulnerability details. Wherein, a is 0day vulnerabilities, one in the attack a few weeks before playing the patch. Recently, FireEye and Microsoft Office products in the discovery of three new 0day vulnerabilities...

CVE-2016-9092

The Symantec Content Analysis CA 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense MTD 1.1 management consoles are susceptible to a cross-site request forging CSRF vulnerability. A remote attacker can use phishing or other social engineering techniques to access the management console with the...

CVE-2016-9092

The Symantec Content Analysis CA 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense MTD 1.1 management consoles are susceptible to a cross-site request forging CSRF vulnerability. A remote attacker can use phishing or other social engineering techniques to access the management console with the...

Cross site request forgery (csrf)

The Symantec Content Analysis CA 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense MTD 1.1 management consoles are susceptible to a cross-site request forging CSRF vulnerability. A remote attacker can use phishing or other social engineering techniques to access the management console with the...

CVE-2016-9092

The CVE concerns CSRF in Symantec Content Analysis (CA) management consoles (1.3, 2.x prior to 2.2.1.1) and Mail Threat Defense (MTD) 1.1. The issue allows a remote attacker, via phishing/social engineering, to perform actions as an authenticated administrator. Exploitation details are not presen...

CVE-2016-9092

The Symantec Content Analysis CA 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense MTD 1.1 management consoles are susceptible to a cross-site request forging CSRF vulnerability. A remote attacker can use phishing or other social engineering techniques to access the management console with the...

U.S. Dept Of Defense: Cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @jin was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @tcpiplab was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks you for reporting this!...

Cisco Firepower Threat Defense and Cisco ASA with FirePOWER Module Denial of Service Vulnerability

A vulnerability in the access control policy of Cisco Firepower System Software could allow an authenticated, remote attacker to cause an affected system to stop inspecting and processing packets, resulting in a denial of service DoS condition. SPDX-FileCopyrightText: 2017 Greenbone AG Some text...

SA148: Linux Kernel Vulnerabilities Feb-Apr 2017

SUMMARY Symantec Network Protection products that include a vulnerable version of the Linux kernel are susceptible to multiple vulnerabilities. A remote attacker, with access to the management interface, can exploit these vulnerabilities to execute arbitrary code. The attacker can also cause deni...