PT-2017-9588

Name of the Vulnerable Software and Affected Versions Huawei HiSuite version 4.0.5.300 OVE Description The issue concerns the use of insecure HTTP for software package downloads and the lack of integrity checks on the downloaded packages. This allows an attacker to potentially launch a...

WordPress Easy Digital Downloads plugin <= 2.7.11 - Information Disclosure Vulnerability

WordPress Easy Digital Downloads plugin in 2.7.11 and earlier versions are vulnerable to information disclosure vulnerability. The plugin function eddajaxgetdownloadtitle is accessible to anyone logged in or logged out users. Solution Update the plugin...

Media Acceleration Enhances Online Experiences for OTT Video, Games and Software Downloads

Online audiences are growing and so are their expectations for the quality of experience. You know exactly what I mean if you've ever been frustrated with the rate at which a game is downloading or if your video stalls at the most inopportune time. Online streaming is no longer novel, it's the...

Man-in-the-middle (MitM)

keycloak is vulnerable to man-in-the-middle MitM attacks. The pom file downloads sources over HTTP. A malicious user can potentially compromise the source to conduct MitM attacks...

Skype 7.16.0.102 DLL Hijacking

Vulnerability Title: Skype Insecure Library Loading Vulnerability api-ms-win-core-winrt-string-l1-1-0.dll Affected Product: Skype Vendor Homepage: https://www.microsoft.com/en-us/ MSRC Case 32355 TRK:0001002846 CVE-ID : CVE-2017-6517 Severity: Medium Description: Microsoft Skype contains a DLL...

CVE-2017-3844

A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file directory listings and download files. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 are...

Information Disclosure in the Management Web Interface

A vulnerability exists in the Management Web Interface that could result in Information Disclosure. Ref PAN-70428 / CVE-2017-5583 PAN-OS contains a post-authentication vulnerability that may allow for Information Disclosure. Successful exploitation allows an attacker to download arbitrary files...

Google Chrome chrome://downloads generic cross-site scripting vulnerability

Google Chrome is a popular web browser. A generic cross-site scripting vulnerability in Google Chrome chrome://downloads allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be tricked into parsing by the user, which can crash the application or execute...

For the Node. js in the node-serialize module deserialization vulnerability the subsequent analysis-vulnerability warning-the black bar safety net

Of the Node. js serialization remote command execution vulnerabilities of a number of follow-up found and how to develop the attack load. A few days ago I was in opsecx blog found an article How to use a named node-serialize nodejs module in the RCE remote code execution error blog. The article...

PostgreSQL 9.1.x < 9.1.24 / 9.2.x < 9.2.19 / 9.3.x < 9.3.15 / 9.4.x < 9.4.10 / 9.5.x < 9.5.5 Multiple Vulnerabilities

Binary data 9963.prm...

admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files

An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...

Man-in-the-Middle Via Insecure Binary Downloads

These libraries are vulnerable to man-in-the-middle MitM attacks. The vulnerability exists because the libraries download binary resources via HTTP. Also, the issue may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the...

Man-in-the-Middle Via Usage Of Insecure Source

These libraries are vulnerable to man-in-the-middle MitM attacks. This is because they download binary resources via HTTP, allowing MitM attacks. Also, it may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on...

chromium-browser: universal xss in chrome://downloads

Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful download operations, which allowed a remote attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted HTML page...

January 26, 2017—KB 3216755 (OS Build 14393.726)

None None...

CVE-2016-5214

Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file from receiving the Mark of the Web via a crafted HTML page...

admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files

An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...

iwf.net XSS vulnerability

Vulnerable URL: http://www.iwf.net/downloads/?dlsearch=%3Cscript%3Ealert%27openbugbounty%27%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 214777 VIP website status:...

Man-in-the-Middle (MitM)

haxeshim is vulnerable to man-in-the-middle attacks. The library downloads binaries via HTTP, potentially causing a remote code execution RCE vulnerability exploitable by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in betwee...

Remote Code Execution (RCE) Via Man-in-the-Middle (MitM)

mystem is vulnerable to man-in-the-middle attacks. The library downloads binaries via HTTP, causing remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server...