SA159: OpenSSL Vulnerabilities 7-Dec-2017

SUMMARY Symantec Network Protection products using affected versions of OpenSSL are susceptible to two security vulnerabilities. A remote attacker can obtain Diffie-Hellman private key information and sensitive information accidentally transmitted in plaintext over an SSL/TLS connection. AFFECTED...

SA161: Local Information Disclosure Due to Meltdown and Spectre Attacks

SUMMARY Symantec Network Protection products, which run on an affected CPU chipset and execute arbitrary code from external sources, are susceptible to several information disclosure vulnerabilities aka Meltdown and Spectre attacks. A remote attacker, with the ability to execute arbitrary code...

mysavanah.com XSS vulnerability

Open Bug Bounty ID: OBB-500755 Description| Value ---|--- Affected Website:| mysavanah.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The LocalSystem account cannot be changed during the Update installation process

Challenge The Update installation cannot be performed because it requires the LocalSystem password to continue and it does not provide an option to change an existing account in the installation Wizard. Cause Veeam ONE Monitor Server service is running under the LocalSystem account which cannot b...

allfulldownload.com XSS vulnerability

Open Bug Bounty ID: OBB-483937 Description| Value ---|--- Affected Website:| allfulldownload.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

duitslandportaal.info XSS vulnerability

Open Bug Bounty ID: OBB-453261 Description| Value ---|--- Affected Website:| duitslandportaal.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

afhe.org XSS vulnerability

Open Bug Bounty ID: OBB-367703 Description| Value ---|--- Affected Website:| afhe.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Veeam ONE Business Shows Irrelevant Data

Challenge Veeam ONE Business View shows outdated data or no data at all Cause Veeam ONE Reporter collection task has stuck or failed Solution Running data collection manually You can run data collection for Veeam ONE Reporter and Veeam ONE Business View manually. This can be necessary when...

Long Infrastructure Object Removal

Challenge Sometimes when you remove an infrastructure object vCenter or Hyper-V server from the Veeam ONE Monitor client, the removal process may take longer than expected. Cause Once you click the Remove server button from the infrastructure tree view, it could take some time to remove the data...

Canadian Man Gets 9 Months Detention for Serial Swattings, Bomb Threats

A 19-year-old Canadian man was found guilty of making almost three dozen fraudulent calls to emergency services across North America in 2013 and 2014. The false alarms, two of which targeted this author -- involved phoning in phony bomb threats and multiple attempts at "swatting" -- a dangerous...

CVE-2017-11652

Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users to gain privileges via a Trojan horse dbghelp.dll file...

Udemy: Weak Password

Reporter thinks that our password rules should be different...

Acunetix Denial of Service Vulnerability

Acunetix is a Web application security scanner from Acunetix, Inc. that supports penetration testing, multi-threaded scanning, and client-side script analysis, among other security features. A denial of service vulnerability exists in the Reporter.exe file in Acunetix version 8. A remote attacker...

Acunetix Denial of Service Vulnerability (CNVD-2017-20139)

Acunetix is a Web application security scanner from Acunetix, Inc. that supports penetration testing, multi-threaded scanning, and client-side script analysis, among other security features. A denial of service vulnerability exists in the Reporter.exe file in Acunetix version 8. A remote attacker...

CVE-2017-11674

Reporter.exe in Acunetix 8 allows remote attackers to cause a denial of service application crash via a malformed PRE file, related to a "Read Access Violation starting at reporter!madTraceProcess."...

Design/Logic Flaw

Reporter.exe in Acunetix 8 allows remote attackers to cause a denial of service application crash via a malformed PRE file, related to a "Read Access Violation starting at reporter!madTraceProcess."...

CVE-2017-11673

Reporter.exe in Acunetix 8 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a malformed PRE file, related to a "User Mode Write AV starting at reporter!madTraceProcess."...

SA150: NSS Vulnerability April 2017

SUMMARY Symantec Network Protection products using affected versions of NSS are susceptible to a security vulnerability. A remote attacker can send crafted Base64-encoded data and execute arbitrary code or cause denial of service through an application crash. AFFECTED PRODUCTS The following...

Udemy: CSRF Token Design Flaw

Our django site uses their standard CSRF implementation. The reporter has their own ideas about how CSRF protection should be implemented...

SA144 : OpenSSH Vulnerabilities January 2017

SUMMARY Blue Coat products using affected versions of OpenSSH are susceptible to several vulnerabilities. A remote attacker with access to an SSH server can exploit these vulnerabilities to execute arbitrary code on an SSH client. A local attacker can also exploit these vulnerabilities to obtain...