Avaya Patches Remote Code Execution Flaw in Aura

Internet telephony company Avaya has patched a high-severity vulnerability in its Aura Application Enablement Services product that put phone call and API data running through the server at risk for interception. Researchers at Digital Defense found a vulnerability where an attacker could, withou...

PT-2017-2726

Name of the Vulnerable Software and Affected Versions Android CAF-сборки affected versions not specified Qualcomm products with Android releases from CAF using the Linux kernel affected versions not specified Description The issue is caused by an out-of-bounds array index in the LPP process of th...

PT-2017-2736

Name of the Vulnerable Software and Affected Versions Qualcomm products with Android releases from CAF using the Linux kernel affected versions not specified Description The issue is related to an untrusted pointer dereference that can occur in a TrustZone syscall in the Android operating system...

PT-2017-2738

Name of the Vulnerable Software and Affected Versions Qualcomm products with Android releases from CAF using the Linux kernel affected versions not specified Description A buffer over-read vulnerability exists in a TrustZone syscall in the Android operating system, specifically in CAF builds. Thi...

Within the network of a large kill. Metasploit transplant MS17-010 vulnerabilities in the code module use-vulnerability warning-the black bar safety net

0x01 introduction 2017 year 4 June, a network of the most sensational events is undoubtedly TheShadowBrokers the release of a large number of NSA US National Security Agency“The formula of the organization” Equation Groupusing a destructive hacker tools, including remote compromised globally, abo...

Heap Overflow Vulnerability in Citrix NetScaler Gateway (CVE-2017-7219)

After presenting my findings on the Swisscom router at the CybSecConference last year, I started looking for a new product to analyze. I quickly found that it’s possible to download virtual “demo” appliances of Citrix products, so I went on to download a Netscaler VPX, which at the time was at...

Solarwinds LEM 6.3.1 Hardcoded Credentials Vulnerability

The Postgres database on Solarwinds Log and Event Manager Virtual Appliance version 6.3.1 has default hardcoded credentials. While some security measures were taken to ensure that network connectivity to the Postgres database wouldn't be possible using IPv4, the same measures were not taken for...

CVE-2017-3506

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HT...

Solarwinds LEM Database Listener with Hardcoded Credentials

Vulnerability Details Affected Vendor: Solarwinds Affected Product: Log and Event Manager Virtual Appliance Affected Version: v6.3.1 Platform: Embedded Linux CWE Classification: CWE-798: Use of Hard-coded Credentials, CWE-284: Improper Access Control Impact: Remote Database Compromise Attack...

Hardcoded Credentials Vulnerability in Multiple Foscam Devices

Foscam is the world's leading provider of home security IP cameras. A security vulnerability exists in the use of the same hard-coded SSL private key for Foscam networked devices across different customer installations. A remote attacker could utilize another installation with knowledge of this k...

CVE-2016-5552

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with...

Unspecified Vulnerability in Oracle FLEXCUBE Universal Banking (CNVD-2017-00944)

Oracle FLEXCUBE Universal Banking is the United States Oracle Oracle company's set of real-time, online coverage of retail, group, investment banking, a comprehensive solution. The program supports multi-currency, multi-language and multi-entity operations. A remote security vulnerability exists ...

Unspecified Vulnerability in Oracle FLEXCUBE Universal Banking (CNVD-2017-00940)

Oracle FLEXCUBE Universal Banking is the United States Oracle Oracle company's set of real-time, online coverage of retail, group, investment banking, a comprehensive solution. The program supports multi-currency, multi-language and multi-entity operations. A remote security vulnerability exists ...

phpmailer -- Remote Code Execution

Legal Hackers reports: An independent research uncovered a critical vulnerability in PHPMailer that could potentially be used by unauthenticated remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application. To...

Legba Incorporated YateBTS Has a Design Vulnerability

Legba Incorporated YateBTS is software for analog protocol stacks for GSM networks. A design vulnerability exists in Legba Incorporated YateBTS. Since the device is exposed to external connections, an attacker could exploit this vulnerability to compromise the BTS transceiver over the Internet. B...

On KeySniffer, Two Factor Authentication, LastPass, and Tor

Mike Mimoso and Chris Brook discuss the news of the week, including a wireless keyboard vulnerability – KeySniffer, NIST’s statement on 2FA, a LastPass remote compromise bug, and a new Tor paper. Download: ThreatpostNewsWrapJuly292016.mp3 Music by Chris Gonsalves...

LastPass Patches Ormandy Remote Compromise Flaw

LastPass has patched a vulnerability in its Firefox add-on found by Google Project Zero researcher Tavis Ormandy that allows attackers complete remote compromise of the password manager, . The divisive Ormandy submitted a bug report on Tuesday to LastPass after a series of tweets hinting at serio...

CVE-2016-3593

Unspecified vulnerability in the Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Outside In Filters, a different vulnerability than CVE-2016-3574, CVE-2016-357...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the integrity of protected information

The multiple vulnerabilities in the libstdc++6-0-dev package of the Debian GNU/Linux operating system may lead to a violation of the integrity of protected information. These vulnerabilities can be exploited remotely...

The vulnerability of the MySQL database management system allows unauthorized users, after passing authentication, to affect the accessibility of data.

The vulnerability in the Oracle database management system, related to the MySQL Client component, allows malicious actors operating remotely to compromise the confidentiality, integrity, and accessibility of data...