79 matches found
CVE-2020-29658
Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation...
CVE-2020-29658
CVE-2020-29658 affects Zoho ManageEngine Application Control Plus before 100523. The issue is an insecure SSL configuration for Nginx that enables Privilege Escalation. Documents provide CVSS scores (2.0/3.1) indicating high to critical impact, but there are no exploit details or remediation step...
Install Apache Zeppelin and connect it to AWS Athena for data exploration, visualization and collaboration
Introduction Apache Zeppelin is a Web-based, open source, notebook system that enables data-driven, interactive data analytics and collaborative documents with SQL. At Imperva Research Group we use it on a daily basis to query data from the Threat Research Data Lake using AWS Athena query engine...
Truegaze - Static Analysis Tool For Android/iOS Apps Focusing On Security Issues Outside The Source Code
A static analysis tool for Android and iOS applications focusing on security issues outside the source code such as resource strings, third party libraries and configuration files. Requirements Python 3 is required and you can find all required modules in the requirements.txt file. Only tested on...
"Cannot complete request" when logging on via NetScaler using dual factor authentication and SSON to StoreFront Server 3.14
After configuring a remote portal with StoreFront servers load balanced with NetScaler, a user authenticates and they get the error "Cannot complete your request". From the event Viewer logs of the StoreFront SF server: "An error occurred while using SSL configuration for endpoint 0.0.0.443. The...
Fedora 28 : mysql-mmm (2018-ca5321b5ff)
Multi-Master Replication Manager for MySQL mmmagentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon...
F5 Networks BIG-IP : TMM vulnerability (K46940010)
A malformed Transport Layer Security TLS handshake causes the Traffic Management Microkernel TMM to stop responding, leading to a disruption of service. This issue is only exposed on the data plane when a Proxy SSL configuration is enabled. The control plane is not impacted by this issue...
htrace.sh - Simple Shell Script To Debugging HTTP/HTTPS Traffic Tracing, Response Headers And Mixed-Content
htrace.sh is a shell script that allows you to validate your domain configuration and catch any errors e.g. redirect loops. It also displays basic information about the ssl configuration if available, response headers, checks for mixed content and performs security scans using Nmap scripts and...
Insecure Connection
wildfly-iiop-openjdk is vulnerable to Insecure Connection. The library does not properly enforce the configuration when SSL is required, leading to insecure plaintext connections when the setting is enabled...
Security Bulletin: Vulnerabilities in OpenSSL affect Rational ClearCase (CVE-2015-0209, CVE-2015-0286, CVE-2015-0288, CVE-2015-0293)
Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM Rational ClearCase. Rational ClearCase has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0209 DESCRIPTION: OpenSSL could allow a remote attacker to execute...
Security Bulletin: Vulnerability with Diffie-Hellman ciphers affects IBM Tivoli Netcool Service Quality Manager (CVE-2015-4000)
Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM Tivoli Netcool Service Quality Manager. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the...
Security Bulletin: Vulnerability in SSLv3 affects Tivoli Storage Manager Administration Center (CVE-2014-3566)
Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Tivoli Storage Manager Administration Center. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to...
CVE-2018-5513
On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.3, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, a malformed TLS handshake causes TMM to crash leading to a disruption of service. This issue is only exposed on the data plane when Proxy SSL configuration is enabled. The control plane is not impact...
CVE-2018-5513
On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.3, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, a malformed TLS handshake causes TMM to crash leading to a disruption of service. This issue is only exposed on the data plane when Proxy SSL configuration is enabled. The control plane is not impact...
TAC Xenta 511 / 911 Credential Disclosure
Exploit Title: TAC Xenta 511 and 911 Credentials Disclosure Date: 25.05.2018 Exploit Author: Marek Cybul Vendor Homepage: https://download.schneider-electric.com/files?pFileName=TACXenta911SDS-XENTA911.pdf Version: 5.17 Schneider Electric TAC Xenta 911 and 511 PLCs Directory traversal in help...
TAC Xenta 511/911 - Directory Traversal
Exploit Title: TAC Xenta 511 and 911 Credentials Disclosure Date: 25.05.2018 Exploit Author: Marek Cybul Vendor Homepage: https://download.schneider-electric.com/files?pFileName=TACXenta911SDS-XENTA911.pdf Version: 5.17 Schneider Electric TAC Xenta 911 and 511 PLCs Directory traversal in help...
TAC Xenta 511911 - Directory Traversal
TAC Xenta 511911 - Directory Traversal Exploit Title: TAC Xenta 511 and 911 Credentials Disclosure Date: 25.05.2018 Exploit Author: Marek Cybul Vendor Homepage: https://download.schneider-electric.com/files?pFileName=TACXenta911SDS-XENTA911.pdf Version: 5.17 Schneider Electric TAC Xenta 911 and 5...
Fedora 27 : mysql-mmm (2018-e31f52c5ee)
Multi-Master Replication Manager for MySQL mmmagentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon...
CVE-2013-3734
The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow 1 man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or 2 attackers to obtain sensitive information by...