Security Bulletin: A vulnerability in Samba affects IBM Spectrum Scale SMB protocol access method (CVE-2017-7494)

Summary A Samba vulnerability affects IBM Spectrum Scale SMB protocol access method which could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper access to named pipe endpoints. By uploading a specially-crafted shared library to a writeable share, a...

Security Bulletin: Vulnerabilities in Samba affect IBM Spectrum Scale SMB protocol access method (CVE-2016-2126, 2016-2125)

Summary Samba vulnerabilities affect IBM Spectrum Scale SMB protocol access method which could allow: - a remote authenticated attacker to gain elevated privileges on the system, caused by forwarding a Ticket Granting Ticket TGT to other service when using Kerberos authentication. An attacker...

Security Bulletin: A vulnerability in Samba affects IBM Spectrum Scale SMB protocol access method (CVE-2017-2619)

Summary A Samba vulnerability affects IBM Spectrum Scale SMB protocol access method which could allow a remote authenticated attacker to launch a symlink attack, caused by a race condition. An attacker could exploit this vulnerability using SMB1 unix extensions or NFS to create a symbolic link fr...

Security Bulletin: Vulnerabilities in Samba affect IBM Spectrum Scale SMB protocol access method (CVE-2017-12163, CVE-2017-12151, CVE-2017-12150)

Summary Vulnerabilities in Samba affect IBM Spectrum Scale SMB protocol access method that: - could allow a remote authenticated attacker to obtain sensitive information, caused by a memory leak over SMB1 CVE-2017-12163 - could provide weaker than expected security, caused by the failure to...

Security Bulletin: Vulnerabilities in Samba affect IBM Spectrum Scale SMB protocol access method (CVE-2017-14746, CVE-2017-15275)

Summary Vulnerabilities in Samba affect IBM Spectrum Scale SMB protocol access method that: - could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free memory error CVE-2017-14746 - could allow a remote attacker to obtain sensitive information, caused by a...

Oracle Linux 6 : samba (ELSA-2018-1860)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-1860 advisory. - resolves: 1553018 - Fix CVE-2018-1050 - resolves: 1509455 - Fix regression of CVE-2017-2619 - resolves: 1491211 - CVE-2017-2619 CVE-2017-12150 CVE-2017-12163 ...

Microsoft Windows: Microsoft network server: Server SPN target name validation level

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnsspnvalidationlevel.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Microsoft network server: Server SPN target name validation level Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Windows: Microsoft network client: Digitally sign communications (if server agrees)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winncdigitallysigncommunicationsserveragrees.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Microsoft network client: Digitally sign communications if server agrees Authors: Emanuel Moss Copyright: Copyright c 201...

Microsoft Windows: Do not display last user name

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winildisplaylastuser.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Interactive logon: Do not display last user name Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

CVE-2018-11101

Open Whisper Signal aka Signal-Desktop through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a...

Design/Logic Flaw

Open Whisper Signal aka Signal-Desktop through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a...

CVE-2018-11101

Open Whisper Signal aka Signal-Desktop through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a...

CVE-2018-11101

Open Whisper Signal aka Signal-Desktop through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a...

Signal Desktop HTML Tag Injection Variant 2

Title: Signal-desktop HTML tag injection variant 2 Date Published: 2018-05-16 Last Update: 2018-05-16 CVE Name: CVE-2018-11101 Class: Code injection Remotely Exploitable: Yes Locally Exploitable: No Vendors contacted: Signal.org Vulnerability Description: Signal-desktop is the standalone desktop...

Signal Desktop HTML Injection

Title: HTML tag injection in Signal-desktop Date Published: 14-05-2018 CVE Name: CVE-2018-10994 Class: Code injection Remotely Exploitable: Yes Locally Exploitable: No Vendors contacted: Signal.org Vulnerability Description: Signal-desktop is the standalone desktop version of the secure Signal...

SMBrute - SMB Protocol Bruteforce

SMBrute is a program that can be used to bruteforce username and passwords of servers that are using SMB Samba. Install SMBrute $ git clone https://github.com/m4ll0k/SMBrute.git smbrute $ cd smbrute $ pip3 install pysmb, humanfriendly $ python3 smbrute.py Usage: $ python3 smbrute.py -h...

CVE-2018-0244

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy to drop the Server Message Block SMB protocol if a malware file is detected. The vulnerability is due to how the SMB protocol handle...

CVE-2018-0244

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy to drop the Server Message Block SMB protocol if a malware file is detected. The vulnerability is due to how the SMB protocol handle...

CVE-2018-0244

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy to drop the Server Message Block SMB protocol if a malware file is detected. The vulnerability is due to how the SMB protocol handle...

Cisco Firepower System Software Server Message Block File Policy Bypass Vulnerability

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy to drop the Server Message Block SMB protocol if a malware file is detected. The vulnerability is due to how the SMB protocol handle...