The vulnerability of the TCP/IP software for the JanTek JTC-200 converter, related to deficiencies in authentication procedures, allows a hacker to gain access to the BusyBox Linux shell.

The vulnerability of the TCP/IP microprogramming software of the JanTek JTC-200 converter is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and gain access to the BusyBox Linux shell using the Teln...

EMC RSA Authentication Manager Cross-Site Scripting Vulnerability (CNVD-2017-35692)

EMC RSA Authentication Manager is a centralized binary authentication software from EMC. The software centralizes the management of binary authentication, security tokens, methods and users across physical sites. A cross-site scripting vulnerability exists in versions of EMC RSA Authentication...

EMC Authentication Manager Cross-Site Scripting Vulnerability

EMC RSA Authentication Manager is a centralized binary authentication software from EMC. The software centralizes the management of binary authentication, security tokens, methods and users across physical sites. A cross-site scripting vulnerability exists in EMC RSA Authentication Manager 8.2 SP...

PHP 4.2.0 / 4.2.1 Remote Compromise / Denial Of Service Vulnerability

PHP versions 4.2.0 and 4.2.1 suffer from an issue where depending on the processor architecture it may be possible for a remote attacker to either crash or compromise the web server. Advisory: Remote Compromise/DOS Vulnerability in PHP Author: Stefan Esser email protected Application: PHP 4.2.0,...

EMC Elastic Cloud Storage Default Password Vulnerability

EMC Elastic Cloud Storage is a multi-purpose global storage solution from EMC Corporation USA. A security vulnerability exists in EMC Elastic Cloud Storage versions prior to 3.1. A remote attacker could exploit the vulnerability to compromise an affected system...

EMC AppSync SQL Injection Vulnerability

EMC AppSync is a suite of data protection software from EMC Corporation USA. The software provides simple, self-service, service-level agreement SLA-driven data protection and storage management for EMC VNX and EMC VMAX storage. A SQL injection vulnerability exists in versions of EMC AppSync prio...

Unspecified Vulnerability in Oracle Java SE and Java SE Embedded (CNVD-2017-28398)

Oracle Java SE and Java SE Embedded are both products of Oracle Corporation. Java SE Java Platform Standard Edition is used to develop and deploy Java applications for desktops, servers, as well as embedded devices and real-time environments; Java SE Embedded is a Java platform for the developmen...

Unspecified Vulnerability in Oracle Java SE and Java SE Embedded (CNVD-2017-28403)

Oracle Java SE and Java SE Embedded are both products of Oracle Corporation. Java SE Java Platform Standard Edition is used to develop and deploy Java applications for desktops, servers, as well as embedded devices and real-time environments; Java SE Embedded is a Java platform for the developmen...

CVE-2017-10148

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Core Components. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to...

OpenJDK: insufficient access control checks in ActivationID (RMI, 8173697)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

OpenJDK: insufficient access control checks in XML transformations (JAXP, 8172469)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JAXP. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

Ansible: Compromised remote hosts can lead to running commands on the Ansible controller

An input validation vulnerability was found in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server...

Avaya Patches Remote Code Execution Flaw in Aura

Internet telephony company Avaya has patched a high-severity vulnerability in its Aura Application Enablement Services product that put phone call and API data running through the server at risk for interception. Researchers at Digital Defense found a vulnerability where an attacker could, withou...

Within the network of a large kill. Metasploit transplant MS17-010 vulnerabilities in the code module use-vulnerability warning-the black bar safety net

0x01 introduction 2017 year 4 June, a network of the most sensational events is undoubtedly TheShadowBrokers the release of a large number of NSA US National Security Agency“The formula of the organization” Equation Groupusing a destructive hacker tools, including remote compromised globally, abo...

Heap Overflow Vulnerability in Citrix NetScaler Gateway (CVE-2017-7219)

After presenting my findings on the Swisscom router at the CybSecConference last year, I started looking for a new product to analyze. I quickly found that it’s possible to download virtual “demo” appliances of Citrix products, so I went on to download a Netscaler VPX, which at the time was at...

Solarwinds LEM 6.3.1 Hardcoded Credentials Vulnerability

The Postgres database on Solarwinds Log and Event Manager Virtual Appliance version 6.3.1 has default hardcoded credentials. While some security measures were taken to ensure that network connectivity to the Postgres database wouldn't be possible using IPv4, the same measures were not taken for...

CVE-2017-3506

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HT...

Solarwinds LEM Database Listener with Hardcoded Credentials

Vulnerability Details Affected Vendor: Solarwinds Affected Product: Log and Event Manager Virtual Appliance Affected Version: v6.3.1 Platform: Embedded Linux CWE Classification: CWE-798: Use of Hard-coded Credentials, CWE-284: Improper Access Control Impact: Remote Database Compromise Attack...

Hardcoded Credentials Vulnerability in Multiple Foscam Devices

Foscam is the world's leading provider of home security IP cameras. A security vulnerability exists in the use of the same hard-coded SSL private key for Foscam networked devices across different customer installations. A remote attacker could utilize another installation with knowledge of this k...

CVE-2016-5552

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with...