CVE-2017-10144

Vulnerability CVE-2017-10144 affects Oracle E-Business Suite, Oracle Applications Manager (subcomponent Oracle Diagnostics Interfaces). The affected version is 12.1.3. An unauthenticated attacker who can reach Oracle Applications Manager over HTTP can compromise it, with the impact described as a...

PT-2017-11137

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite version 12.1.3 Description The issue affects the Oracle Applications Manager component, specifically the Oracle Diagnostics Interfaces subcomponent. It allows an unauthenticated attacker with network access via HTTP to...

CVE-2017-10144: Undefined Security Weakness

Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite subcomponent: Oracle Diagnostics Interfaces. The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2017-9497

The Comcast firmware on Motorola MX011ANM firmware version MX011AN2.9p6s1PRODsey devices allows physically proximate attackers to execute arbitrary commands as root by pulling up the diagnostics menu on the set-top box, and then posting to a Web Inspector route...

Command injection

The Comcast firmware on Motorola MX011ANM firmware version MX011AN2.9p6s1PRODsey devices allows physically proximate attackers to execute arbitrary commands as root by pulling up the diagnostics menu on the set-top box, and then posting to a Web Inspector route...

PT-2017-18967

Name of the Vulnerable Software and Affected Versions Comcast firmware on Motorola MX011ANM version MX011AN 2.9p6s1 PROD sey Description The issue allows physically proximate attackers to execute arbitrary commands as root. This can be achieved by accessing the diagnostics menu on the set-top box...

CVE-2017-9497: Improper Input Validation

The Comcast firmware on Motorola MX011ANM firmware version MX011AN2.9p6s1PRODsey devices allows physically proximate attackers to execute arbitrary commands as root by pulling up the diagnostics menu on the set-top box, and then posting to a Web Inspector route...

Oracle E-Business Suite Denial of Service Vulnerability

Oracle E-Business Suite E-Business Suite is a set of Oracle's fully integrated global business management software. Oracle Applications Manager is one of the components used to monitor the performance and availability of the Oracle Application Server. A security vulnerability exists in the Oracle...

Building a Car Hacking Development Workbench: Part 1

Introduction There is a vast body of knowledge hiding inside your car. Whether you are an auto enthusiast, developer, hobbyist, security researcher, or just curious about vehicles, building a development bench can be an exciting project to facilitate understanding and experimentation without...

F5 Networks BIG-IP : GnuPG vulnerability (K21284031)

The douncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service infinite loop via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence. CVE-2014-4617 Impact ARX This vulnerability...

Website Flaw Let True Health Diagnostics Users View All Medical Records

Over the past two weeks readers have pointed KrebsOnSecurity to no fewer than three different healthcare providers that failed to provide the most basic care to protect their patients' records online. Only one of the three companies -- the subject of today's story -- required users to be logged o...

TP-LINK C2 and C20i Arbitrary Code Execution Vulnerability

TP-LINK C2 and C20i etc. are wireless router products from China P&L TP-LINK. A security vulnerability exists in the TP-Link C2 and C20i 'Diagnostic' page, which allows remote attackers to submit a special request to execute arbitrary code...

[SECURITY] Fedora 25 Update: xstream-1.4.9-5.fc25

XStream is a simple library to serialize objects to XML and back again. A high level facade is supplied that simplifies common use cases. Custom objects can be serialized without need for specifying mappings. Speed and low memory footprint are a crucial part of the design, making it suitable for...

[SECURITY] Fedora 26 Update: jenkins-xstream-1.4.7-11.jenkins1.fc26

XStream is a simple library to serialize objects to XML and back again. A high level facade is supplied that simplifies common use cases. Custom objects can be serialized without need for specifying mappings. Speed and low memory footprint are a crucial part of the design, making it suitable for...

[SECURITY] Fedora 26 Update: xstream-1.4.9-5.fc26

XStream is a simple library to serialize objects to XML and back again. A high level facade is supplied that simplifies common use cases. Custom objects can be serialized without need for specifying mappings. Speed and low memory footprint are a crucial part of the design, making it suitable for...

Microsoft Finally Reveals What Data Windows 10 Collects From Your PC

Since the launch of Windows 10, there has been widespread concern about its data collection practices, mostly because Microsoft has been very secretive about the telemetry data it collects. Now, this is going to be changed, as Microsoft wants to be more transparent on its diagnostics data...

Apple iOS legacy-diagnostics Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Apple iOS. User interaction is required to exploit this vulnerability in that the target must connect to a WiFi access point. The specific flaw exists within the usage of the legacy-diagnostics protoc...

Dell SonicWall Secure Remote Access Server Command Injection Vulnerability

Dell SonicWall Secure Remote Access is a SonicWALL Secure Remote Access Series appliance within the Dell SonicWall Secure Mobile Access solution. An input validation vulnerability in the diagnostics CGI /cgi-bin/diagnostics component of the web management interface of the Dell SonicWall Secure...

CVE-2016-9682

The SonicWall Secure Remote Access server version 8.1.0.2-14sv is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interface. These vulnerabilities occur in the diagnostics CGI /cgi-bin/diagnostics component responsible for emailing out information about the...

PT-2017-3171

Name of the Vulnerable Software and Affected Versions SonicWall Secure Remote Access server version 8.1.0.2-14sv Description The issue is related to the diagnostics component of the CGI application in the web administrative interface, specifically the /cgi-bin/diagnostics endpoint. It is caused b...