Cisco IOS Cluster Management Protocol Telnet Option Handling RCE (cisco-sa-20170317-cmp) (destructive check)

The remote device is affected by a remote code execution vulnerability in the Cluster Management Protocol CMP subsystem due to improper handling of CMP-specific Telnet options. An unauthenticated, remote attacker can exploit this by establishing a Telnet session with malformed CMP-specific telnet...

HP Shared ArcSight Source Code with Russians

Reuters is reporting that HP Enterprise gave the Russians a copy of the ArcSight source code. The article highlights that ArcSight is used by the Pentagon to protect classified networks, but the security risks are much broader. Any weaknesses the Russians discover could be used against any ArcSig...

samba: Some code path don't enforce smb signing, when they should

It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text...

dnsmasq: heap overflow in the IPv6 router advertisement code

A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement RA handling code. An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. This issue only affected configurations using one o...

Dnsmasq 2.78 - Integer Underflow

Dnsmasq 2.78 - Integer Underflow ''' Sources: https://raw.githubusercontent.com/google/security-research-pocs/master/vulnerabilities/dnsmasq/CVE-2017-14496.py https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html dnsmasq is vulnerable only if one of the following option i...

Dnsmasq < 2.78 - Lack of free() Denial of Service Exploit

Exploit for multiple platform in category dos / poc ''' Sources: https://raw.githubusercontent.com/google/security-research-pocs/master/vulnerabilities/dnsmasq/CVE-2017-14495.py https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html dnsmasq is vulnerable only if one of the...

Aspen: aspen | clickjacking

Hi Team, Found vulnerability of clickjacking on the domain "aspen.io". Please refer the below attached screenshot as POC. Clickjack test page Website is vulnerable to clickjacking! 2.save it as .html eg cj.html 3.and just simply open that in browser Issue Details :Clickjacking User Interface...

Advanced Dork Searching Utility: Zeus-Scanner

Zeus is an advanced reconnaissance utility designed to make web application reconnaissance simple. Zeus comes complete with a powerful built-in URL parsing engine, multiple search engine compatibility, the ability to extract URLs from both ban and webcache URLs, the ability to run multiple...

openSUSE Security Update : apache2 (openSUSE-2017-1083) (Optionsbleed)

This update for apache2 fixes the following security issue : - CVE-2017-9798: Prevent use-after-free use of memory that allowed for an information leak via OPTIONS bsc1058058. This update was imported from the SUSE:SLE-12-SP2:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security,...

samba: Some code path don't enforce smb signing, when they should

It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text...

samba: Some code path don't enforce smb signing, when they should

It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text...

“Restart” “Shadow” ”Reset Profile” and “Reset PvD” buttons are grayed out in Director

“Restart” “Shadow” ”Reset Profile” and “Reset PvD” buttons are grayed out in Director when user connected to static Desktops PVS+PvD in one Delivery Group. But when click the “Details” button under Activity Manager, the machine management options like “restart”, “shutdown” and “shadow” are all...

FAQ: XenMobile Licensing Model

Question: What is difference between XenMobile MDM edition Licenses and Enterprise Edition Licenses? Answer: XenMobile MDM Edition Citrix XenMobile MDM edition is licensed under a per-user or per-device model. User licensing is based on how many unique users have registered devices on the...

FreeBSD : Apache -- HTTP OPTIONS method can leak server memory (76b085e2-9d33-11e7-9260-000c292ee6b8) (Optionsbleed)

The Fuzzing Project reports : Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x...

Risks Limited With Latest Apache Bug, Optionsbleed

Servers running Apache software are susceptible to memory leaks that an attacker could theoretically piece together to learn secrets transmitted during a session. But the risk is most pressing only in shared hosting environments apparently, and only if the software is running a certain rare...

USN-3422-2: Linux kernel (Trusty HWE) vulnerabilities

USN-3422-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS. It was discovered that a buffer overflow existed in the Bluetooth stack of the Linux...

CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

PT-2017-3338

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.0 through 2.2.34 Apache HTTP Server versions 2.4.0 through 2.4.27 Description The issue allows remote attackers to read secret data from process memory under certain conditions, such as when the Limit directive...

openSUSE: Security Advisory for qemu (openSUSE-SU-2017:2513-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...