4799 matches found
TippingPoint Threat Intelligence and Zero-Day Coverage – Week of January 1, 2018
Happy New Year! It’s out with the old, in with the new, right? Except we all know that the old tends to stick around, especially when it comes to vulnerabilities and patching them. Trend Micro predicts that that 2018’s biggest attacks will originate from known vulnerabilities. And speaking of kno...
January 4, 2018—KB4056896 (Monthly Rollup)
None None...
January 3, 2018—KB4056899 (Security-only update)
None None...
January 8, 2018—KB4056895 (Monthly Rollup)
None None...
Reading privileged memory with a side-channel
Posted by Jann Horn, Project Zero We have discovered that CPU data cache timing can be abused to efficiently leak information out of mis-speculated execution, leading to at worst arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts. Variants of this...
Oracle WebLogic WSAT Remote Code Execution
The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the WSAT endpoint due to unsafe deserialization of XML encoded Java objects. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context of...
Embedthis GoAhead < 3.6.5 RCE Vulnerability - Active Check
Embedthis GoAhead is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Palo Alto Networks PAN-OS 7.1.x < 7.1.14 Multiple Vulnerabilities
The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 7.1.14. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid105298; scriptversion"1.8";...
Palo Alto Networks PAN-OS 8.0.x < 8.0.6 Multiple Vulnerabilities
The version of Palo Alto Networks PAN-OS running on the remote host is 8.0.x prior to 8.0.6. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid104811; scriptversion"1.11";...
Cisco Email Security Appliance Filter Bypass Vulnerability
According to its self-reported version, the Cisco Email Security Appliance ESA is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...
PT-2017-12285
Name of the Vulnerable Software and Affected Versions Windows versions prior to the fixed version Description The issue allows remote attackers to execute arbitrary code and affect the system. It is due to the way the Routing and Remote Access service handles requests. Recommendations At the...
3: authentication bypass for elasticsearch with external routes
An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the Elasticsearch be configured with an external route, and the data accessed is limited to the indices...
Hirschmann Devices Detection (Web UI)
Detection of Hirschmann devices over HTTP. The script sends a connection request to the server and attempts to detect Hirschmann devices and to extract its version. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C b...
Apache Tomcat HTTP PUT JSP File Upload RCE
The HTTP server running on the remote host is affected by a flaw that allows a remote unauthenticated attacker to upload a JSP file and execute it. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid105006;...
Fedora Update for roundcubemail FEDORA-2017-cbc49efae8
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Seamless Flags Configuration for Epic Hyperspace
This article includes recommended configuration for specific issues that may be encountered in your EpicHyperspace via CVAD deployment. These configurations should only be used if you encounter the specific issue mentioned. Before determining whether or not you will use any of these configuration...
Design/Logic Flaw
A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade RU or...
CVE-2017-12337
A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade RU or...
Cisco Voice Operating System-Based Products Unauthorized Access Vulnerability
A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade or Prim...