4194 matches found
ALPINE-CVE-2017-3735
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g...
Disk Savvy Enterprise 9.9.14 - Remote Buffer Overflow (SEH)
Disk Savvy Enterprise 9.9.14 - Remote Buffer Overflow SEH !/usr/bin/env python Exploit Title: Disk Savvy Enterprise 9.9.14 Remote SEH Buffer Overflow Date: 2017-08-25 Exploit Author: Nipun Jaswal & Anurag Srivastava Author Homepage: www.pyramidcyber.com Vendor Homepage: http://www.disksavvy.com...
Red Hat JBoss Enterprise Application Platform Information Disclosure Vulnerability
Red Hat JBoss Enterprise Application Platform EAP is the United States Red Hat Red Hat company's set of open source, J2EE-based middleware platform. The platform is mainly used to build, deploy and host Java applications and services. A security vulnerability exists in Red Hat JBoss EAP version 7...
Cisco Adaptive Security Appliance Username Enumeration Information Disclosure Vulnerability (CSCvd47888)
According to its self-reported version and configuration, the Cisco Adaptive Security Appliance ASA software running on the remote device is affected by a vulnerability in the web-based management interface of Cisco Adaptive Security Appliance ASA that could allow an authenticated, remote attacke...
I Recommend This <= 3.8.1 - Authenticated SQL Injection
Plugin description: "This plugin allows your visitors to simply like/recommend your posts instead of comment on it." Active installs according to https://wordpress.org/plugins/i-recommend-this/: 40.000+ It's possible to inject SQL into the dotrecommends shortcode, if the check for IP addresses is...
Spoofing
A vulnerability in the web interface of the Cisco Adaptive Security Appliance ASA 9.33 and 9.62 could allow an unauthenticated, remote attacker to determine valid usernames. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to the...
Cisco Adaptive Security Appliance Username Enumeration Information Disclosure Vulnerability
A vulnerability in the web interface of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to determine valid usernames. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to the interaction between...
Code injection
The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows remote attackers to obtain unintended access to the Network Processor NP 169.254/16 IP network by adding a routing-table entry that specifies the LAN IP address as the router for that...
CVE-2017-9487
The CVE-2017-9487 issue affects Cisco DPC3939 and DPC3941T Comcast firmware. A remote attacker could discover a WAN IPv6 address by leveraging knowledge of the CM MAC address, affecting firmware versions dpc3939-P20-18-v303r20421746-170221a-CMCST (DPC3939) and DPC3941_2.5s3_PROD_sey (DPC3941T). T...
Denial Of Service (DoS) Through Resource Consumption
Moodle is vulnerable to denial of service DoS attacks. The script used when geo-mapping an IP address was accessible by attackers, by requesting the calculation of an estimated latitude and longitude for an IP, attackers are able to consume all the resources...
CVE-2015-7703
The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration...
Dark Web Users Suspect "Dream Market" Has Also Been Backdoored by Feds
By now you might be aware of the took down of two of the largest online dark websites—AlphaBay and Hansa—in what's being called the largest-ever international operation against the dark web's black market conducted by the FBI, DEA Drug Enforcement Agency and Dutch National Police. But the...
Cross-Site Scripting in the Management Web Interface
A reflected cross-site scripting XSS vulnerability exists in the management web interface. PAN-OS contains an unauthenticated vulnerability that may allow for a reflected cross-site scripting XSS attack of the management web interface. ref PAN-76455 / CVE-2017-9459. Successful exploitation of thi...
Cross-Site Scripting in the Management Web Interface
A reflected cross-site scripting XSS vulnerability exists in the management web interface. PAN-OS contains an unauthenticated vulnerability that may allow for a reflected cross-site scripting XSS attack of the management web interface. ref PAN-76455 / CVE-2017-9459. Successful exploitation of thi...
Uber Patches Authentication Bypass Vulnerability on Custom SSO Solution
Uber has addressed a vulnerability that allowed attackers to steal session tokens and hijack accounts. Researcher Arne Swinnen disclosed details Monday after confirming late last week that the issue had been resolved; he earned $5,000 in bounties from Uber. Swinnen said that if exploited at a lar...
DNSSEC RR Stub Resolver Denial Of Service Exploit
Exploit for linux platform in category dos / poc !/usr/bin/perl DNS/DNSSEC RR stub resolvers amplification ddos Copyright 2017 c Todor Donev email protected https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Disclaimer: This or previous program is for Educational purpose...
CVE-2017-7405
On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine. By spoofing the IP address belonging to the victim's host, an attacker might be able to take over the administrative session without being prompted for...
Null pointer dereference
The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via an empty field that should have contained a hostname or IP address...
CVE-2017-7458
The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via an empty field that should have contained a hostname or IP address...