CVE-2017-6767

A vulnerability in Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to gain higher privileges than the account is assigned. The attacker will be granted the privileges of the last user to log in, regardless of whether those privileges are highe...

CVE-2017-6776

A vulnerability in the web framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affecte...

CVE-2017-6767

CVE-2017-6767 concerns Cisco Application Policy Infrastructure Controller (APIC). It describes an RBAC-related privilege-escalation: after authentication via SSH to the local management interface, the attacker’s privilege level can be modified to match the last user who logged in, enabling elevat...

CVE-2017-6786

A vulnerability in Cisco Elastic Services Controller (ESC) allows an authenticated, local, unprivileged attacker to access sensitive information, including credentials for system accounts, due to improper protection of sensitive log files. An attacker can log in to an affected ESC and access unpr...

CVE-2017-6788

The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected software. The vulnerability is due to insufficient input...

CVE-2017-6774

A vulnerability in Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify sensitive system files. The vulnerability is due to the inclusion of sensitive system files within specific FTP...

CVE-2017-6784

A vulnerability in the web interface of the Cisco RV340, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to Cisco...

CVE-2017-6782

Cisco Prime Infrastructure (CPI) HTML Injection vulnerability CVE-2017-6782 allows an authenticated remote attacker to modify a page in the CPI administrative web interface due to improper sanitization of parameter values. Attack chain involves injecting code into an affected parameter and entici...

CVE-2017-12440

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...

SweetSecurity - Network Security Monitoring on Raspberry Pi type devices

Scripts to setup and install Bro IDS, Elasticsearch, Logstash, Kibana, and Critical Stack on any device. Getting Sweet Security Either download the Github repository manually, or clone the repo with the following command: $ git clone https://github.com/travisfsmith/sweetsecurity Prerequisites Mos...

About the security content of tvOS 10.1 - Apple Support

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, see the Apple Product Security...

U.S. Dept Of Defense: Gateway information leakage

Summary: Many DoD systems use BlueCoat gateways. These gateways insert unique BlueCoat ids that permit tracking DoD users and gaining insight into the DoD network architecture when DoD users access the Internet. Description: I run a popular web service FotoForensics.com -- it's around 150,000 in...

Design/Logic Flaw

Rtrlet.class in Novell ZENworks Configuration Management ZCM allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for the maintenance variable...

CVE-2015-0784

Rtrlet.class in Novell ZENworks Configuration Management ZCM allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for the maintenance variable...

CVE-2015-0784

Rtrlet.class in Novell ZENworks Configuration Management ZCM allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for the maintenance variable...

CVE-2015-0784

This CVE affects Novell ZENworks Configuration Management (ZCM). The vulnerability is in Rtrlet.class, where a remote attacker can obtain Session IDs of logged-in users by sending a POST request with the maintenance variable set to ShowLogins. The issue is an information-disclosure flaw; exploita...

CVE-2015-0784: Exposure of Sensitive Information to an Unauthorized Actor

Rtrlet.class in Novell ZENworks Configuration Management ZCM allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for the maintenance variable...

Critical Flaws Found in Solar Panels Could Shut Down Power Grids

A Dutch security researcher has uncovered a slew of security vulnerabilities in an essential component of solar panels which could be exploited to cause widespread outages in European power grids. Willem Westerhof, a cybersecurity researcher at Dutch security firm ITsec, discovered 21 security...

Raspberry Pi Network Security Monitoring: SweetSecurity

Raspberry Pi Network Security Monitoring Scripts to setup and install Bro IDS, Elasticsearch, Logstash, Kibana, and Critical Stack on any device. Installation: sudo python setup.py Follow prompts to enter appropriate information for chosen installation type Installation Types 1. Full Install : Th...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance ASA 9.51 could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...