Debian DLA-1120-1 : git security update

joernchen discovered that the git-cvsserver subcommand of Git, a distributed version control system, suffers from a shell command injection vulnerability due to unsafe use of the Perl backtick operator. The git-cvsserver subcommand is reachable from the git-shell subcommand even if CVS support ha...

Google Chrome < 61.0.3163.110 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 61.0.3163.110. It is, therefore, affected by multiple unspecified vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid10364...

USN-3431-1: NSS vulnerability

Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-3431-1 nss vulnerability

Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code...

SMBMap - Samba Share Enumeration Tool

SMBMap allows users to enumerate samba share drives across an entire domain. List share drives, drive permissions, share contents, upload/download functionality, file name auto-download pattern matching, and even execute remote commands. This tool was designed with pen testing in mind, and is...

Cisco IOS XE Software Web UI Privilege Escalation Vulnerability

According to its self-reported version, the Cisco IOS XE Software is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2017:2598-1)

This update for libvirt fixes several issues. This security issue was fixed : - bsc1053600: Escape ssh commed line to prevent interpreting malicious hostname as arguments, allowing for command execution The update package also includes non-security fixes. See advisory for details. Note that Tenab...

CVE-2017-14797

The CVE-2017-14797 entry concerns Philips Hue Bridge BSB002 public API on firmware 1707040932, where a lack of transport encryption enables an attacker on the local intranet to sniff HTTP traffic and read API keys. This bypasses the pushlink protection and can, per cited sources, allow full contr...

Legal Robot: External links should be served in HTTPS.

Summary: This is just for the awareness to use HTTPS everywhere, even for outgoing links - where it's possible. Treat this report with some salt, not as in hashes. Navigate to: https://www.legalrobot.com/events/2017/06/12/ICAIL/ Some of the External Links on that Page redirects to HTTPS after...

TrendMicro OfficeScan 11.0 / XG (12.0) Encryption Key Disclosure

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14083-TRENDMICRO-OFFICESCAN-XG-PRE-AUTH-REMOTE-ENCRYPTION-KEY-DISCLOSURE.txt + ISR: ApparitionSec Vendor: ================== www.trendmicro.com Product: ========...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2017:2589-1)

This update for MozillaFirefox to ESR 52.3 fixes several issues. These security issues were fixed : - CVE-2017-7807 Domain hijacking through AppCache fallback bsc1052829 - CVE-2017-7791 Spoofing following page navigation with data: protocol and modal alerts bsc1052829 - CVE-2017-7792 Buffer...

Fedora 25 : drupal7-views (2017-f27641a807)

7.x-3.18 - 7.x-3.17 - Moderately Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-068 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

For Fibaro home center regulation device of the remote executable command flaws vulnerability oday studies-vulnerability and early warning-the black bar safety net

In my everyday ordinary su interest of time, I match the hobby to discuss some of the smart home and Internet of things equipment the coherence of hardware and software. Recently this period of time, I was known in the workshops of the equipment the adoption of network security solutions. In my...

nss: Potential use-after-free in TLS 1.2 server when verifying client authentication

A use-after-free flaw was found in the TLS 1.2 implementation in the NSS library when client authentication was used. A malicious client could use this flaw to cause an application compiled against NSS to crash or, potentially, execute arbitrary code with the permission of the user running the...

CVE-2017-12228

CVE-2017-12228 affects Cisco Network Plug and Play in Cisco IOS 12.4–15.6 and Cisco IOS XE 3.3–16.4. The root cause is insufficient certificate validation in the PKI API, allowing an unauthenticated remote attacker to supply a crafted certificate and perform MITM to decrypt user data. Exploitatio...

Siemens Ruggedcom ROS, SCALANCE (Update A)

CVSS v3 8.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: Ruggedcom ROS, SCALANCE Vulnerability: Improper Access Control UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-17-271-01 Siemens Ruggedcom ROS and SCALAN...

Fedora 26 : kernel (2017-3202aed903)

The 4.12.14 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Helping Mobile Operators Keep Customers Safe with Virtualized Network Security

At Trend Micro we’re always looking for innovative new ways to support our customers and help overcome their cybersecurity challenges. Mobile network operators MNOs are increasingly adopting virtualization and software acceleration technologies to become more agile in how they deploy and operate...

Debian DLA-1108-1 : tomcat7 security update

The Tomcat security team discovered that when using a VirtualDirContext it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. For Debian 7 'Wheezy', these problems have been fixed in...

SugarCRM new vulnerability is reproducible,a hacker attacker or can remote steal customer information data-vulnerability warning-the black bar safety net

SugarCRM audit a variety of network security achievements SugarCRM is more than a hotspot a customer relationship governance check-in Solution, and SugarCRM now important to have two major versions, that is necessary to pay the trade Edition and open source Community Edition, the eras of all ther...