Cisco Email Security Appliance and Content Security Management Appliance HTTP Response Splitting Vulnerability

A vulnerability in the Cisco Email Security Appliance ESA and Content Security Management Appliance SMA software could allow an unauthenticated, remote attacker to conduct a HTTP response splitting attack. The vulnerability is due to the failure of the application or its environment to properly...

Pivotal Cloud Foundry GrootFS Cache Poisoning Vulnerability

Pivotal Cloud Foundry CF is an open source Platform-as-a-Service PaaS cloud computing platform from Pivotal Software that provides container scheduling, continuous delivery, and automated service deployment.GrootFS is one of the root file system components. A security vulnerability exists in...

CVE-2017-14388

Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer...

CVE-2017-14388

Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer...

CVE-2017-14388

Summary: CVE-2017-14388 affects Cloud Foundry GrootFS 0.3.x prior to 0.30.0, where GrootFS does not validate DiffIDs, allowing a specially crafted image to poison the grootfs volume cache. Affected software: GrootFS (root filesystem component) within Cloud Foundry, specifically releases in the 0....

Semrush: Cross-origin resource sharing

Issue:Cross-origin resource sharing: arbitrary origin trusted The application implements an HTML5 cross-origin resource sharing CORS policy for this request that allows access from any domain. The application allowed access from the requested origin https://hhgdhgjgbrg.com Since the Vary: Origin...

Circle with Disney Rclient SSH Persistent Remote Access Vulnerability(CVE-2017-12084)

Summary A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker send an API call to enable the SSH server. Tested...

Circle with Disney Rclient SSL TLD MITM Vulnerability(CVE-2017-2911)

Summary An exploitable vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the rclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this...

Circle with Disney check_torlist.sh Update Code Execution Vulnerability(CVE-2017-2881)

Summary An exploitable vulnerability exists in the torlist update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this...

SA156: Apache Tomcat Vulnerabilities Apr-Oct 2017

SUMMARY Symantec Network Protection products using affected versions of Apache Tomcat are susceptible to multiple security vulnerabilities. A remote attacker, with access to the management interface, can obtain sensitive information from the server, modify information associated with a different...

Poisoned Search Results Deliver Banking Malware

Cybercriminals are using novel approaches to poison Google search results in the hope of infecting users with a banking Trojan called Zeus Panda, researchers at Cisco said. Attackers behind the Google poisoning attempts are targeting primarily keyword searches related to finance in order to drive...

IBM Infosphere BigInsights Link Injection Vulnerability

IBM InfoSphere BigInsights is a suite of software platforms for storing and analyzing "Big Data" from IBM in the United States. The platform provides solutions for managing and analyzing massive amounts of structured and unstructured data. A link injection vulnerability exists in IBM Infosphere...

CVE-2017-1552

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning...

Cross site scripting

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning...

CVE-2017-1552

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning...

CVE-2017-1552

CVE-2017-1552 affects IBM InfoSphere BigInsights 4.2.0 and 4.2.5. The IBM bulletin confirms a link-injection vulnerability in the web UI that could be exploited by a user clicking a specially crafted URL to induce cross-site scripting, cache poisoning, or session hijacking. Affected products/vers...

CVE-2017-1552

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning...

Circle with Disney check_torlist.sh Update Code Execution Vulnerability

Summary An exploitable vulnerability exists in the torlist update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this...

Circle with Disney Firmware Update Command Injection Vulnerability

Summary An exploitable vulnerability exists in the firmware update functionality of Circle with Disney. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this vulnerability. Tested...

tomcat: Vary header not added by CORS filter leading to cache poisoning

A vulnerability was discovered in Tomcat where the CORS Filter did not send a "Vary: Origin" HTTP header. This potentially allowed sensitive data to be leaked to other visitors through both client-side and server-side caches...