CVE-2019-2539

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection. Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

CVE-2019-2503

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection Handling. Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with access to the physical...

CVE-2019-2539: Undefined Security Weakness

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection. Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

CVE-2019-2503: Undefined Security Weakness

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection Handling. Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with access to the physical...

PT-2018-2334

Name of the Vulnerable Software and Affected Versions Astra Linux affected versions not specified Description The issue is related to the pam authentication module in Astra Linux, where domain users cannot obtain mandatory labels during authentication when the connection to the domain server is...

ABB M2M ETHERNET Detection

Detection of ABB M2M ETHERNET. The script sends a connection request to the server and attempts to detect ABB M2M ETHERNET and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respecti...

Xxe

S3 Browser before 8.1.5 contains an XML external entity XXE vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol...

Citrix Workspace app fails with "cannot connect to the server" when connected externally

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Receiver for MAC and Windows failing to add store...

IBM WebSphere MQ Channel Name Bruteforce

This module uses a dictionary to bruteforce MQ channel names. For all identified channels it also returns if SSL is used and whether it is a server-connection channel. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

PT-2018-2395

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 5.6.42 and prior Oracle MySQL versions 5.7.24 and prior Oracle MySQL versions 8.0.13 and prior Description The issue is related to insufficient access control in the MySQL Server component, specifically in the Server:...

Sentrifugo Detection

Detection of Sentrifugo. The script sends a connection request to the server and attempts to detect Sentrifugo and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Swarmpit UI Detection

Detection of Swarmpit Web UI. The script sends a connection request to the server and attempts to detect Swarmpit UI and to extract its version if possible. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Security Bulletin: Security vulnerabilities have been identified in data server connection and product integration shipped with InfoSphere Optim Query Workload Tuner [for LUW, z/OS] (CVE-2016-5546 CVE-2016-5548 CVE-2016-5549 CVE-2016-5547 CVE-2016-2183)

Summary Data server connection and product integration are shipped as a component of InfoSphere Optim Query Workload Tuner for LUW, z/OS. Information about security vulnerabilities affecting data server connection and product integration have been published in a security bulletin. Vulnerability...

App Layering: How to force the ELM to use a specific SMB version for file servers

In the ELM, when connecting to a file share, we test all the SMB versions that we support, from top to bottom, until we get a successful login. We specifically try 3.02, 3.0, 2.1, 2.0 and 1.0, in that order, before giving up. An SMB server is supposed to return "Not Supported" when an attempt is...

Design/Logic Flaw

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may b...

Design/Logic Flaw

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an...

PT-2018-7254

Name of the Vulnerable Software and Affected Versions: WebORB for Java version 5.1.1.0 Description: The issue concerns the Java implementations of AMF3 deserializers in WebORB for Java, which derive class instances from java.io.Externalizable instead of following the AMF3 specification's...

PT-2018-7252

Name of the Vulnerable Software and Affected Versions: Pivotal/Spring Spring-flex affected versions not specified Description: The issue concerns the Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex, which derive class instances from java.io.Externalizable instead of...

CVE-2018-2762

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection. Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQ...

CVE-2018-2762: Undefined Security Weakness

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection. Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQ...