UBUNTU-CVE-2017-0528

An elevation of privilege vulnerability in the kernel security subsystem could enable a local malicious application to to execute code in the context of a privileged process. This issue is rated as High because it is a general bypass for a kernel level defense in depth or exploit mitigation...

Active Defense Bill Raises Concerns Of Potential Consequences

A discussion draft of a bill proposed on Friday by Rep. Tom Graves R-GA that would exclude organizations from prosecution for hacking back is already stirring up some concerns about potential unintended consequences. The Active Cyber Defense Certainty Act would exempt victims of computer crimes...

ICSA-17-061-01_Eaton xComfort Ethernet Communication Interface

CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Eaton Equipment: xComfort Ethernet Communication Interface Vulnerability: Improper Access Control AFFECTED PRODUCTS The following versions of xComfort Ethernet Communication Interface ECI, a building automation system...

U.S. Dept Of Defense: Cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @guruprasadmullangi was able to demonstrate this vulnerability by crafting ...

U.S. Dept Of Defense: Remote file inclusion vulnerability on a DoD website

A misconfigured Department of Defense website may have allowed unauthorized users to remotely download local files, potentially revealing sensitive system or user information. @sp1d3rs was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Reflected XSS vulnerability in a DoD website

A cross-site scripting XSS vulnerability was found on a Department of Defense. XSS vulnerabilities can be used to trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @rashedhasan007 able to demonstrate this vulnerabilit...

U.S. Dept Of Defense: Potentially sensitive information disclosure on a DoD website

A DoD website was misconfigured in a manner that could have potentially disclosed sensitive information. @scraps was able to demonstrate this vulnerability by searching for certain file types. Thanks @scraps!...

U.S. Dept Of Defense: Content-Injection/XSS ████

Summary: Hi, It is possible to inject content and vulnerable to reflected Cross Site Scripting. Affected domain: https://██████████ Used browser: Mozilla. Impact One of the most common XSS attack vectors is to hijack legitimate user accounts by stealing their session cookies. This allows attacker...

SA141 : OpenSSL Vulnerabilities 26-Jan-2017

SUMMARY Symantec Network Protection products using affected versions of OpenSSL are susceptible to several vulnerabilities. A remote attacker can exploit these vulnerabilities to cause denial of service and obtain private key information. AFFECTED PRODUCTS The following products are vulnerable:...

Information disclosure

An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission levels. This issue is rated as Moderate because it is a general bypass for a user level defense in depth or exploit mitigation technology ...

CVE-2017-0424

An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission levels. This issue is rated as Moderate because it is a general bypass for a user level defense in depth or exploit mitigation technology ...

Cisco Firepower Threat Defense Log Modification Vulnerability

Cisco Firepower is a firewall device developed by Cisco. A security vulnerability in the Cisco Firepower Threat Defense logging subsystem allows an unauthenticated remote attacker to exploit the vulnerability to add arbitrary entries to the logging system...

Information disclosure

A vulnerability in the logging subsystem of the Cisco Firepower Threat Defense FTD Firepower Device Manager FDM could allow an unauthenticated, remote attacker to add arbitrary entries to the audit log. This vulnerability affects Cisco Firepower Threat Defense Software versions 6.1.x on the...

CVE-2017-3822

A vulnerability in the logging subsystem of the Cisco Firepower Threat Defense FTD Firepower Device Manager FDM could allow an unauthenticated, remote attacker to add arbitrary entries to the audit log. This vulnerability affects Cisco Firepower Threat Defense Software versions 6.1.x on the...

CVE-2017-3822

A vulnerability in the logging subsystem of the Cisco Firepower Threat Defense FTD Firepower Device Manager FDM could allow an unauthenticated, remote attacker to add arbitrary entries to the audit log. This vulnerability affects Cisco Firepower Threat Defense Software versions 6.1.x on the...

CVE-2017-3822

CVE-2017-3822 describes an unauthenticated remote vulnerability in the logging subsystem of Cisco Firepower Threat Defense (FTD) when FDM (Firepower Device Manager) is enabled. The issue allows an attacker to add arbitrary entries to the audit log due to inadequate input validation in the FDM web...

CVE-2017-3822

A vulnerability in the logging subsystem of the Cisco Firepower Threat Defense FTD Firepower Device Manager FDM could allow an unauthenticated, remote attacker to add arbitrary entries to the audit log. This vulnerability affects Cisco Firepower Threat Defense Software versions 6.1.x on the...

U.S. Dept Of Defense: Cross-site request forgery (CSRF) vulnerability in a DoD website

A cross-site request forgery CSRF vulnerability was found on a Department of Defense website which could trick a web user into posting or changing confidential information, or redirecting sensitive information to the malicious user. @mantis was able to demonstrate this vulnerability by crafting a...

U.S. Dept Of Defense: Remote command execution (RCE) vulnerability on a DoD website

A remote command execution RCE vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. @japp1 was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @japp1!...

U.S. Dept Of Defense: SQL injection vulnerability on a DoD website

A Department of Defense website was vulnerable to a SQL injection attack which may allow an attacker to execute arbitrary SQL commands and expose sensitive data. @0xd0m7 was able to demonstrate this vulnerability by crafting a specially formatted URL...