9512 matches found
EulerOS 2.0 SP1 : java-1.8.0-openjdk (EulerOS-SA-2017-1150)
According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that the DCG implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attack...
CVE-2011-5325
Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink...
CVE-2017-9861
An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to replay attacks, packet injection attacks, and man in the middle attacks. An attacker is able to successfully use SIP to communicate with the...
Authentication flaw
DISPUTED An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to replay attacks, packet injection attacks, and man in the middle attacks. An attacker is able to successfully use SIP to communicate...
CVE-2017-9861
An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to replay attacks, packet injection attacks, and man in the middle attacks. An attacker is able to successfully use SIP to communicate with the...
Ubuntu 16.04 LTS : OpenJDK 8 regression (USN-3366-2)
The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3366-2 advisory. USN-3366-1 fixed vulnerabilities in OpenJDK 8. Unfortunately, that update introduced a regression that caused some valid JAR files to fail validation. This update...
Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3360-1)
The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3360-1 advisory. It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan data structure. A local attacker could use this to expose sensitive...
Ubuntu: Security Advisory (USN-3360-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 25 Update: knot-2.4.5-1.fc25
Knot DNS is a high-performance authoritative DNS server implementation...
[SECURITY] Fedora 24 Update: knot-2.4.5-1.fc24
Knot DNS is a high-performance authoritative DNS server implementation...
Critical: Red Hat Security Advisory: java-1.8.0-openjdk security update
An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...
Senator Calls For Use Of DMARC To Curb Govt.-Related Phishing Scams
In a letter sent Tuesday to the Department of Homeland Security, Sen. Ron Wyden D-OR called for federal agencies to implement stricter controls on e-mail that would prevent hackers from impersonating email addresses of federal agencies. Wyden called for the use of an email protocol called...
HackerOne: Content Security Policy not applied to error pages at multiple HackerOne endpoints
HackerOne CSP "script-src" includes "unsafe-inline" bypass via % and %" ----- Summary & Description We utilize a strict Content Security Policy and a safe-by-default templating language to effectively neutralize Cross-Site Scripting XSS. We encrypt all network communications with SSL/TLS...
Samba 4.4.x < 4.4.15 / 4.5.x < 4.5.12 / 4.6.x < 4.6.6 KDC-REP Service Name Validation (Orpheus' Lyre)
The version of Samba running on the remote host is 4.4.x prior to 4.4.15, 4.5.x prior to 4.5.12, or 4.6.x prior to 4.6.6. It is, therefore, affected by a logic flaw in the Heimdal implementation of Kerberos, specifically within the krb5extractticket function within lib/krb5/ticket.c, due to the...
Debian DSA-3904-1 : bind9 - security update
Clement Berthaux from Synaktiv discovered two vulnerabilities in BIND, a DNS server implementation. They allow an attacker to bypass TSIG authentication by sending crafted DNS packets to a server. - CVE-2017-3142 An attacker who is able to send and receive messages to an authoritative DNS server...
[SECURITY] Fedora 25 Update: jetty-alpn-8.1.11-2.v20170118.fc25
A pure JavaTM implementation of the Application Layer Protocol Negotiation TLS Extension...
Debian DLA-1007-1 : icedove/thunderbird security update
Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or spoofing. For Debian 7 'Wheezy', these problems have been fixed in version...
A Man-in-the-Middle Attack against a Password Reset System
This is nice work: "The Password Reset MitM Attack," by Nethanel Gelerntor, Senia Kalma, Bar Magnezi, and Hen Porcilan: Abstract: We present the password reset MitM PRMitM attack and show how it can be used to take over user accounts. The PRMitM attack exploits the similarity of the registration...
Using the CTS for vulnerability detection and principles of analysis-vulnerability warning-the black bar safety net
360 Vulpecker team Membership 360 Information Security Department, committed to the Android application and the system-layer vulnerability discovery as well as other Android security research. We passed on the CTS frame of the research, the preparation of a vulnerability detection aspect of the...