EulerOS 2.0 SP2 : libpcap (EulerOS-SA-2019-2456)

According to the version of the libpcap package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.CVE-2019-15165 Note that Tenable...

Shopify: Shopify's SF and LA offices Dashboard Information disclosed via Public Gist

Hi Team, During my recon process, I found a public gist containing the Internal Information of the Shopify offices of LA and SF. The gist belongs to the Shopify employee - https://gist.github.com/runmad He is currently - Engineering Manager at Shopify LA Office Dashboard -...

CVE-2019-15165

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory...

CVE-2019-15165

The CVE-2019-15165 issue affects libpcap: sf-pcapng.c in libpcap before 1.9.1 fails to validate PHB header length before memory allocation, enabling potential memory exhaustion. Confirmed references from multiple advisories indicate the vulnerability is addressed by upgrading to libpcap 1.9.1 or ...

CVE-2019-15165: Allocation of Resources Without Limits or Throttling

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory...

Threat Outbreak Alert RuleID32896: Email Messages Distributing Malicious Software on June 7, 2018

Medium Alert ID: 58039 First Published: 2018 June 7 15:53 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32896 may contain the following files: Name | Size...

sf-ar.ch XSS vulnerability

Open Bug Bounty ID: OBB-576765 Description| Value ---|--- Affected Website:| sf-ar.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

sf-luth.org XSS vulnerability

Open Bug Bounty ID: OBB-378578 Description| Value ---|--- Affected Website:| sf-luth.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

Ultimate Property Listing Component SQL Injection Vulnerability in Joomla!

Joomla! is an open source, cross-platform content management system developed using PHP and MySQL. A SQL injection vulnerability exists in the sfselectuserid parameter in Joomla! Ultimate Property Listing, which can be exploited by attackers to access or modify database data...

Fedora 26 : libupnp (2017-23535a31f8)

miniserver: fix binding to ipv6 link-local addresses - Fix out-of-bound access in createurllist CVE-2016-8863 - If the error or info log files can not be created, use stderr and stdout instead. - SF Bug Tracker 132 CVE-2016-6255: write files via POST Note that Tenable Network Security has...

kernel: Slab out-of-bounds access in sctp_sf_ootb()

A flaw was found in the Linux kernel's implementation of the SCTP protocol. A remote attacker could trigger an out-of-bounds read with an offset of up to 64kB potentially causing the system to crash...

SF Web Page inaccessible after changing Base URL

- Once the SF is configured, there might be a need to change the Base URL. However, the SF page becomes inaccessible and throws below error - You might also get "Cannot complete your request" on this page...

EasyIO EasyIO-30P-SF Controller Hardcoding Vulnerability

The EasyIO EasyIO-30P-SF is a 32-bit controller for DDC Direct Digital Control systems. The EasyIO EasyIO-30P-SF controller uses hard-coded passwords that allow remote attackers to exploit vulnerabilities for unauthorized access...

CVE-2015-3974

EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a...

Hardcoded credentials

EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a...

CVE-2015-3974: Undefined Security Weakness

EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a...

EasyIO-30P-SF Hard-Coded Credential Vulnerability

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on August 25, 2015, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified a hard-coded credential vulnerability in the EasyIO-30P-SF controller. EasyIO has produced a...

Windows Inject DLL, Bind IPv6 TCP Stager with UUID Support (Windows x86)

Inject a custom DLL into the exploited process. Listen for an IPv6 connection with UUID Support Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 331 include...

openSUSE Security Update : phpMyAdmin (openSUSE-SU-2014:1636-1)

phpMyAdmin on openSUSE 12.3 and 13.1 was updated to 4.1.14.8. This update fixes one vulnerability. - Security fixes : - PMASA-2014-17 CVE-2014-9218, CWE-661 CWE-400 boo908363 http://www.phpmyadmin.net/homepage/security/PMASA-2014- 17.php - sf4611 security DOS attack with long passwords phpMyAdmin...

APK signature verification bypass-vulnerability warning-the black bar safety net

0x01 Android signature mechanism The APK rename it to zip file, then you can see there's a META-INF folder, inside there are three files, called MANIFEST. MF, CERT. SF and CERT. RSA, which is to use signapk. jar to generate the signature file. 1, the MANIFEST. MF file: The program loops through t...