Debian: Security Advisory (DLA-1360-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-8880

Lutron Quantum BACnet Integration 2.0 firmware 3.2.243 doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure...

CVE-2018-8880

Lutron Quantum BACnet Integration 2.0 firmware 3.2.243 doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure...

CVE-2018-8880

Lutron Quantum BACnet Integration 2.0 firmware 3.2.243 doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure...

CVE-2018-8880

Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) is affected. The vulnerability arises from not verifying user authentication before displaying /deviceIP, leading to disclosure of internal network information (e.g., internal IP, subnet, gateway, and service ports). Multiple sources (NVD e...

CVE-2018-8880: Exposure of Sensitive Information to an Unauthorized Actor

Lutron Quantum BACnet Integration 2.0 firmware 3.2.243 doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure...

Automated Bots Growing Tool For Hackers

SAN FRANCISCO – The use of automated bots is becoming more prevalent for novice attackers as tools become more available, researchers found. A honeypot experiment, detailed by Cybereason at this year’s RSA Conference, showed the commoditization of using bots to perform low-level tasks. The honeyp...

MikroTik RouterOS 6.41.4 Authentication Bypass Vulnerability

An issue was discovered in MikroTik RouterOS. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of intercepting client traffic to act as a malicious OpenVPN server. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted...

CVE-2018-10066

An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of intercepting client traffic to act as a malicious OpenVPN server. This may allow the attacker to gain access to the client's internal network fo...

CVE-2018-10066

An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of intercepting client traffic to act as a malicious OpenVPN server. This may allow the attacker to gain access to the client's internal network fo...

MikroTik RouterOS Elevation of Privilege Vulnerability

MikroTik RouterOS is a set of routing operating system developed based on Linux core by MikroTik Latvia. The system turns a PC computer into a professional router. A security vulnerability exists in MikroTik RouterOS version 6.41.4, which stems from the program's lack of OpenVPN server certificat...

Onethink Ueditor Server-Side Request Forgery Vulnerability

Onethink is a content management framework for web development based on ThinkPHP.Ueditor is one of the HTML editors. A server-side request forgery vulnerability exists in the getRemoteImage.php file of Ueditor in Onethink version 1.0 and 1.1. A remote attacker can exploit this vulnerability with...

Xxe

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion XXE in the &dataConfig= parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the...

CVE-2018-1308: Improper Restriction of XML External Entity Reference

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion XXE in the &dataConfig= parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the...

Onethink CMS Server Side Request Forgery Vulnerability

Onethink CMS versions released up to date 2018/04/06 suffer from a server-side request forgery vulnerability. SSRFPS"Server Side Request ForgeryPSc in Onethink All version CVE-2017-14323 The Onethink is an open source CMSContent Management System.This system is based on the Thinkphp3.2 developmen...

Onethink CMS Server Side Request Forgery

SSRFPS"Server Side Request ForgeryPSc in Onethink All version CVE-2017-14323 The Onethink is an open source CMSContent Management System.This system is based on the Thinkphp3.2 development framework. Product Download: http://www.onethink.cn Vulnerability TypePSoSSRFPS"Server Side Request ForgeryP...

Slack: TURN server allows TCP and UDP proxying to internal network, localhost and meta-data services

The TURN servers used by Slack allow TCP connections and UDP packets to be proxied to the internal network. This gives an attacker the ability to scan and interact with internal systems. The attacker may proxy TCP connections to the internal network by setting the XOR-PEER-ADDRESS of the TURN...

Server side request forgery (ssrf)

The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery SSRF by creating an OAut...

CVE-2017-18096

The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery SSRF by creating an OAut...

CVE-2017-18096

The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery SSRF by creating an OAut...