Critical RCE Flaw Affects F5 BIG-IP Application Security Servers

Cybersecurity researchers today issued a security advisory warning enterprises and governments across the globe to immediately patch a highly-critical remote code execution vulnerability affecting F5's BIG-IP networking devices running application security servers. The vulnerability, assigned...

11 security tips to help stay safe in the COVID-19 era

The COVID-19 pandemic has changed our daily routines, the ways we work, and our reliance on technology. Many of us are now working remotely, students are attending classes virtually, and we’re relying more on social media and social networks to stay connected as we define what our new normal look...

Fancy Bear’s VPNfilter malware is back with 7 new modules

By Waqas Cisco’s Talos researchers have identified that Russia’s VPNfilter is way more dangerous than it is believed to be. The malware, which prompted the FBI to urge people to reboot their internet routers, contains seven additional third-stage modules that are infecting countless global...

New VPNFilter malware targets at least 500K networking devices worldwide

Intro For several months, Talos has been working with public- and private-sector threat intelligence partners and law enforcement in researching an advanced, likely state-sponsored or state-affiliated actor's widespread use of a sophisticated modular malware system we call "VPNFilter." We have no...

CVE-2017-17250

Huawei AR120-S V200R005C32; AR1200 V200R005C32; AR1200-S V200R005C32; AR150 V200R005C32; AR150-S V200R005C32; AR160 V200R005C32; AR200 V200R005C32; AR200-S V200R005C32; AR2200-S V200R005C32; AR3200 V200R005C32; V200R007C00; AR510 V200R005C32; NetEngine16EX V200R005C32; SRG1300 V200R005C32; SRG230...

CVE-2014-4705

Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5300, S5700, S6300, and S6700 series switches; AR150, AR160, AR200, AR1200, AR2200, AR3200, AR530, NetEngine16EX, SRG1300, SRG2300, and SRG3300 series routers; and WLAN AC6005, AC6605, and AC...

November 30, 2017—KB4051963 (OS Build 16299.98)

None None...

Design/Logic Flaw

ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG1312-B30B, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, VMG8924-B30A, and VSG1435-B101 DSL CPEs; PMG5318-B20A GPONs; SBG3300-N000, SBG3300-NB00, and SBG3500-N000...

CVE-2016-8632

A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible privilege escalation. The flaw involves a system with an unusually low MTU 60 on networking devices configured as bearers for the TIPC protocol. An attacker could create a packet which will...

91 Percent of Public-Facing ICS Components Are Remotely Exploitable

We live in an increasingly connected world, but even in an age when DDoS attacks can take entire airlines offline, many critically sensitive industrial control systems ICS are still connected to the internet. A pair of reports released today by Kaspersky Lab reveal how dire the situation really i...

Cisco IOS/IOS XE/Cisco Unified Communications Manager Information Disclosure Vulnerability

Cisco IOS is the interconnected Internet operating system used on most Cisco Systems routers and network switches. A vulnerability in the SIP gateway implementation of Cisco IOS, IOS XE, Cisco Unified Communications Manager Software could be exploited by an unauthenticated, remote attacker to cau...

F5 Networks BIG-IP : HTTP cookie vulnerability (SOL15406)

The built-in web servers for multiple networking devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the same server. CVE-2004-0462 C Tenable Network Security, Inc. The...

Major DNS Cache Poisoning Attack Hits Brazilian ISPs

There is a large-scale DNS cache-poisoning attack going on in Brazil at the moment, with potentially millions of users affected by a tactic that is forcing the to install a malicious Java applet before they can reach many popular sites, including Google, Gmail and Hotmail. The attack has been goi...

CVE-2010-0039

The Application-Level Gateway ALG on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in incoming FTP traffic, which allows remote attackers to use the device's IP address for arbitrary intranet TCP traffic by...

D-link Click 'n Connect Daemon Detection

The remote service is the D-link Click 'n Connect Daemon DCCD, a remote networking service provided on some D-link networking devices that allows a remote client to view and configure the D-link device. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid47605;...

CVE-2004-0462

The CVE-2004-0462 issue concerns the built-in web servers in multiple networking devices failing to set the Secure attribute on cookies during HTTPS sessions, risking plaintext cookie exposure over HTTP. Connected materials (notably F5 BIG-IP SOL15406) specify affected products and versions, e.g....

CVE-2004-0462

The built-in web servers for multiple networking devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the same server...

Linksys WAP11 1.3/1.4 / D-Link DI-804 4.68/Dl-704 2.56 b5 - Embedded HTTP Server Denial of Service

source: https://www.securityfocus.com/bid/6090/info A denial of service vulnerability has been reported for several networking devices. The condition will be triggered when the embedded web server, used by the devices, receives an overly long HTTP header. An attacker can exploit this vulnerabilit...

Linksys WAP11 1.31.4 D-Link DI-804 4.68Dl-704 2.56 b5 - Embedded HTTP Server Denial of Service

Linksys WAP11 1.31.4 D-Link DI-804 4.68Dl-704 2.56 b5 - Embedded HTTP Server Denial of Service source: https://www.securityfocus.com/bid/6090/info A denial of service vulnerability has been reported for several networking devices. The condition will be triggered when the embedded web server, used...