ALPINE-CVE-2018-5738

Change 4777 introduced in October 2017 introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended and documented behavior is that if an operator has not specified a value for the...

CVE-2018-5738

Change 4777 introduced in October 2017 introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended and documented behavior is that if an operator has not specified a value for the...

CVE-2018-5738

Change 4777 introduced in October 2017 introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended and documented behavior is that if an operator has not specified a value for the...

CVE-2018-5738

Change 4777 introduced in October 2017 introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended and documented behavior is that if an operator has not specified a value for the...

Design/Logic Flaw

In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection...

CVE-2017-18356

In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection...

CVE-2017-18356

In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection...

Denial Of Service (DoS)

389 Directory Server is vulnerable to denial of service. Get Effective Rights GER search queries are not properly handled when the attribute list contains the @ characters. An attacker is able submit search queries containing multiple @ characters to crash the application...

PT-2019-8296 · Automattic · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce plugin versions prior to 3.2.4 Description: The issue allows an attack after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker constructs a specifically crafted string th...

Red Hat 389 Directory Server do_search Denial of Service (CVE-2018-14648)

A denial-of-service vulnerability has been reported in 389 Directory Server. The vulnerability is due to improper processing of LDAP search queries in the dosearch function in servers/slapd/search.c. A remote, unauthenticated attacker could exploiting this vulnerability by sending crafted LDAP...

Google DNS Service (8.8.8.8) Now Supports DNS-over-TLS Security

Almost every activity on the Internet starts with a DNS query, a key function of the Internet that works as an Internet's directory where your device looks up for the server IP addresses after you enter a human-readable web address e.g., thehackernews.com. Since DNS queries are sent in clear text...

The vulnerability in the Cisco Prime License Manager’s web infrastructure, related to the lack of protection for SQL query structures, allows attackers to execute arbitrary SQL queries.

The vulnerability in the Cisco Prime License Manager’s web infrastructure is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

Valve: RCE on Steam Client via buffer overflow in Server Info

Introduction In Steam and other valve games CSGO, Half-Life, TF2 there is a functionality to find game servers called the server browser. In order to retrieve the information about these servers the server browser communicates with a specific UDP protocol called server queries. The protocol is we...

The vulnerability of the embedded SQL database SQLite, related to deficiencies in input data processing, allows a perpetrator to execute arbitrary code or cause service failures.

The vulnerability of the embedded SQL database SQLite is related to deficiencies in data processing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause service failures by using specially crafted SQL queries...

LDAP_Search - Tool To Perform LDAP Queries And Enumerate Users, Groups, And Computers From Windows Domains

LDAPSearch can be used to enumerate Users, Groups, and Computers on a Windows Domain. Authentication can be performed using traditional username and password, or NTLM hash. In addition, this tool has been modified to allow brute force/password-spraying via LDAP. LdapSearch makes use of Impackets...

PowerDNS Recursor Denial of Service Vulnerability (CNVD-2018-24628)

PowerDNS Recursor aka pdnsrecursor is a domain name resolution server from the Dutch company PowerDNS. A denial of service vulnerability exists in PowerDNS Recursor versions prior to 4.1.8, which can be exploited by a remote attacker to cause a denial of service out-of-bounds read and crash by...

DEBIAN-CVE-2018-16855

An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash...

Cisco Patches Critical Bug in License Management Tool

Cisco Systems is warning of a critical bug in two of its license management tools that could allow an unauthenticated remote attacker to execute arbitrary queries. A successful attack could allow for an attacker to modify and delete random data in Cisco product lifecycle management applications...

Sql injection

A vulnerability in the web framework code of Cisco Prime License Manager PLM could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An attacker could exploit this vulnerabilit...

PowerDNS DNSDist Data Injection Vulnerability

PowerDNS DNSDist is a load balancer from the Dutch company PowerDNS that shunts traffic to different servers to provide optimal performance for users. A security vulnerability exists in PowerDNS DNSDist versions prior to 1.3.3. A remote attacker can exploit the vulnerability with the help of...