Adobe Connect Server-Side Request Forgery Vulnerability

Adobe Connect is an online video conferencing software. A server-side request forgery vulnerability exists in Adobe Connect 9.6.2 and earlier versions. A remote user can exploit this vulnerability to bypass network access control by submitting a specially crafted request...

CVE-2017-12155

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack...

Hikvision IP Camera Access Bypass

Access control bypass in Hikvision IP Cameras Full disclosure Sep 12, 2017 Synopsis: --------------- Many Hikvision IP cameras contain a backdoor that allows unauthenticated impersonation of any configured user account. The vulnerability has been present in Hikvision products since at least 2014...

AWS Auditing & Hardening Tool: Zeus

Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices. It checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user. Identity and Access...

HPE Aruba ClearPass Policy Manager Elevation of Privilege Vulnerability

HPE Aruba ClearPass Policy Manager is a network access control solution from Hewlett Packard Enterprise HPE. An elevation of privilege vulnerability exists in HPE Aruba ClearPass Policy Manager versions prior to 6.6.5. An attacker could exploit this vulnerability to gain elevated privileges...

Inherent Risks of Using the Intelligent Platform Management Interface (IPMI) on the Lenovo System x Integrated Management Module (IMM), Integrated Management Module II (IMM2) and ThinkServer TSM - us

Lenovo Security Advisory: LEN-10617 Potential Impact: Access to systems through IPMI if default settings are not changed Severity: High Scope of Impact: Industry-Wide CVE Identifiers: CVE-2013-4037, CVE-2013-4031 Summary Description: Various risks with the industry-standard Intelligent Platform...

Moxa NPort Device Vulnerabilities

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-336-02 Moxa NPort Device Vulnerabilities that was published December 1, 2016, on the NCCIC/ICS-CERT web site. Security researchers Reid Wightman of RevICS Security, Mikael Vingaard, and Maxim Rupp have identifie...

SOL02201365 - SLOTH: TLS 1.2 handshake vulnerability CVE-2015-7575

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

PacketFence v4.3.0 - Free and Open Source network access control (NAC) solution

PacketFence is a fully supported , trusted , Free and Open Source network access control NAC solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, powerful BYOD management options, 802.1X support, layer...

Symantec End Point Protection 11.x & Symantec Network Access Control 11.x LCE PoC

No description provided by source. Symantec End Point Protection 11.x & Symantec Network Access Control 11.x Local Code Execution POC Date: 22/05/2012 Author: 41.w4r10r Software Link: Symantec.com Version: 11.x Tested on: Windows XP SP2 English Windows XP SP3 English Windows Vista 32Bit Windows 7...

Camtron CMNC-200 IP Camera Undocumented Default Accounts

No description provided by source. Finding 4: Undocumented Default Accounts CVE: CVE-2010-4233 The CMNC-200 IP Camera has undocumented default accounts on its Linux operating system. These accounts can be used to login via the cameras telnet interface, which cannot be normally disabled. The...

Microsoft Office ASLR Remote Security Bypass Weakness

Description Microsoft Office is prone to a remote security-bypass weakness that may cause a library to use a predictable base address. This weakness may allow attackers to predict the base address of a library in certain circumstances and in turn bypass the Address Space Layout Randomization ASLR...

[PacketFence v4.0] Open Source network access control (NAC)

PacketFence is a fully supported, trusted, Free and Open Source network access control NAC solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, 802.1X support, layer-2 isolation of problematic devices,...

NGS00336 Patch Notification: Symantec Network Access Control Privilege Escalation

Medium Risk Vulnerability in Symantec Network Access Control 04 February 2013 Gavin Jones of NCC Group has discovered a Medium risk vulnerability in Symantec Endpoint Protection Version 12.1.1000.157.105 Impact: Privilege escalation Versions affected: Symantec Network Access Control v12.1 and...

CVE-2012-4349

Unquoted Windows search path vulnerability in Symantec Network Access Control SNAC 12.1 before RU2 allows local users to gain privileges via unspecified vectors...

CVE-2012-4349: Undefined Security Weakness

Unquoted Windows search path vulnerability in Symantec Network Access Control SNAC 12.1 before RU2 allows local users to gain privileges via unspecified vectors...

Symantec Endpoint Protection Management Consoles Multiple Issues

SUMMARY The management console in Symantec Endpoint Protection Manager SEPM and Symantec Protection Center SPC for SEP 12.0 Small Business Edition, contains PHP scripts that do not properly validate external input. This could potentially result in remote code execution. Symantec Network Access...

Forescout NAC (Network Access Control) multiple vulnerabilities

Forescout NAC Network Access Control multiple vulnerabilities: Forescout NAC 6.3.4.1 Cross-Site Redirection Vulnerability CVE-2012-4982 The Forescout NAC device is vulnerable to cross-site redirection and could be used to redirect a targetted victim to a malicious site. The 'a' parameter is...

Forescout NAC 6.3.4.1 XSS / Redirection / Filter Vulnerabilities

Forescout NAC Network Access Control version 6.3.4.1 suffers from ICMP and ARP protocols not being filtered, cross site scripting, and cross site redirection vulnerabilities. Forescout NAC Network Access Control multiple vulnerabilities: Forescout NAC 6.3.4.1 Cross-Site Redirection Vulnerability...

CVE-2012-0289

Buffer overflow in Symantec Endpoint Protection SEP 11.0.600x through 11.0.710x and Symantec Network Access Control SNAC 11.0.600x through 11.0.710x allows local users to gain privileges, and modify data or cause a denial of service, via a crafted script...