Kaspersky Anti-Virus File Server 8.0.3.297 XSS / CSRF / Code Execution

Advisory Information Title: Kaspersky Anti-Virus File Server Multiple Vulnerabilities Advisory ID: CORE-2017-0003 Advisory URL: http://www.coresecurity.com/advisories/Kaspersky-Anti-Virus-File-Server-Multiple-Vulnerabilities Date published: 2017-06-28 Date of last update: 2017-06-28 Vendors...

Kaspersky Anti-Virus File Server Multiple Vulnerabilities

Advisory ID Internal CORE-2017-0003 1. Advisory Information Title: Kaspersky Anti-Virus File Server Multiple Vulnerabilities Advisory ID: CORE-2017-0003 Date published: 2017-06-28 Date of last update: 2017-06-28 Vendors contacted: Kaspersky Release mode: Forced release 2. Vulnerability...

Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities

Advisory Information Title: Kaspersky Anti-Virus File Server Multiple Vulnerabilities Advisory ID: CORE-2017-0003 Advisory URL: http://www.coresecurity.com/advisories/Kaspersky-Anti-Virus-File-Server-Multiple-Vulnerabilities Date published: 2017-06-28 Date of last update: 2017-06-28 Vendors...

Antivirus Kasper’s 8.0 File Server Access

The vulnerability of the Antivirus Kaspersky 8.0 web console for Linux File Servers relates to the possibility of executing operating system commands. Exploiting this vulnerability allows a malicious actor to gain access to files located on the server by sending a specially crafted GET request wi...

WikiLeaks Dumps CIA Patient Zero Windows Implant

WikiLeaks on Thursday made public a CIA implant that is used to turn a Windows file server into a malware distribution point on the local network. The documents describing the tool, Pandemic, explain how remote machines on the local network trying to download and-or execute documents from the fil...

May 9, 2017—KB4019216 (Monthly Rollup)

May 9, 2017—KB4019216 Monthly Rollup Applies To Windows Server 2012 Windows Embedded 8 Standard Improvements and fixes This security update includes improvements and fixes that were a part of update KB4015554 released April 18, 2017, and also resolves the following vulnerabilities in Windows:...

PT-2017-2932

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue is related to the reportId parameter of the getReportStatus action method in the web interface, which can be exploited to read arbitrary files with...

PT-2017-2933

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue is related to the absence of Anti-CSRF tokens in all forms on the web interface of Kaspersky Anti-Virus for Linux File Server. This could allow a remo...

PT-2017-2844

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue exists due to insufficient input validation during quarantine read and write operations in the kav4fs-control service. This can be exploited by a remo...

PT-2017-2895

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue concerns a cross-site scripting XSS vulnerability related to the scriptName parameter of the licenseKeyInfo action method. This vulnerability can be...

Analysis of Kerberos constrained delegation SPN security vulnerabilities-vulnerability warning-the black bar safety net

In the past few years, more and more security researchers began to study Kerberos security, eventually found in support of the authentication Protocol of the network environment a lot of interesting attacks. In this post, I will describe my in the Windows Kerberos constrained delegation feature...

March 14, 2017—KB4012606 (OS Build 10240.17319)

March 14, 2017—KB4012606 OS Build 10240.17319 Applies To Windows 10 Improvements and fixes This update includes quality improvements. No new operating system features are being introduced in this update. Key changes include: Addressed a known issue with KB3192440 that was rendering DFS-N mapped...

CVE-2017-6100

tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP...

June 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2

June 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 This update rollup is superseded by July 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 KB3172614 that was released on July 21, 2016. The June 2016 update rollup for Windows RT 8.1,...

CVE-2016-4025

Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email...

Easy FTP Server APPE Remote Code Execution Vulnerability

Easy FTP Server is a free green software that does not require installation and is prohibited for commercial use Supports multiple users, multiple permissions, multiple directories, supports web access, supports Windows system service mode. Easy FTP Server has a security vulnerability. Due to the...

Serv-U File Server Information Disclosure

The vulnerability of the Serv-U File Server software relates to errors that occur during the processing of application variables. Exploiting this vulnerability allows a malicious attacker to obtain system configuration information, including user authentication data...

SAP NetWeaver File Server Unauthorized Access

The SAP NetWeaver application contains an error that allows a malicious individual to remotely gain access to the SAP CUA child system and read any tables from the central SAP CUA system...

Serv-U File Server Source Code Disclosure

The vulnerability of the Serv-U File Server software lies in the lack of consideration for accessing files using extended syntax in the NTFS file system. Exploiting this vulnerability by comparing the requested resource’s URL with locations specified in the web server configuration allows a...

Serv-U File Server DoS

The vulnerability of the Serv-U File Server software relates to an error that occurs when processing an HTTP request involving a recursive declared variable. Exploiting this vulnerability allows a malicious attacker to perform denial-of-service attacks on the application...