Foreman cross-site scripting vulnerability (CNVD-2017-35447)

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A cross-site scripting vulnerability exists in the Facts, Trends, and Statistics pages in Foreman. A...

CVE-2017-15100

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: 1 Facts page, when clicking on the "chart" button and hovering over the chart; 2 Trends page, when checking the graph for a trend based on a such fact; 3 Statistics page, for facts that are...

CVE-2017-15100

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: 1 Facts page, when clicking on the "chart" button and hovering over the chart; 2 Trends page, when checking the graph for a trend based on a such fact; 3 Statistics page, for facts that are...

PT-2017-13869 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman affected versions not specified Description: The issue allows an attacker to perform a stored XSS attack by submitting facts containing HTML to the Foreman server. This can lead to exploitation on certain pages, including the Facts pa...

CVE-2017-15100: Improper Neutralization of Input During Web Page Generation

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: 1 Facts page, when clicking on the "chart" button and hovering over the chart; 2 Trends page, when checking the graph for a trend based on a such fact; 3 Statistics page, for facts that are...

Password Recovery Platform: Wavecrack

A user-friendly Web interface to share an hashcat cracking box among multiple users with some pre-defined options. Outline This Web application can be used to launch asynchronous password cracks with hashcat . The interface tries to be as user-friendly as possible and facilitates the password...

Debian DSA-4021-1 : otrs2 - security update

It was discovered that missing input validation in the Open Ticket Request System could result in privilege escalation by an agent with write permissions for statistics. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Low: Red Hat Enhancement Advisory: Red Hat Virtualization Manager (ovirt-engine) 4.1.7

An update is now available for Red Hat Virtualization Manager. The Red Hat Virtualization Manager is a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities,...

Telnet IoT Honeypot - Python Telnet Honeypot For Catching Botnet Binaries

This project implements a python telnet server trying to act as a honeypot for IoT Malware which spreads over horribly insecure default passwords on telnet servers on the internet. Other than https://github.com/stamparm/hontel or https://github.com/micheloosterhof/cowrie examples, which provides...

CVE-2017-15100

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: 1 Facts page, when clicking on the "chart" button and hovering over the chart; 2 Trends page, when checking the graph for a trend based on a such fact; 3 Statistics page, for facts that are...

web.tricolib.brynmawr.edu XSS vulnerability

Open Bug Bounty ID: OBB-378373 Description| Value ---|--- Affected Website:| web.tricolib.brynmawr.edu Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventi...

CWEs in NVD CVE feed: analysis and complaints

As you probably know, one of the ways to describe the nature of some software vulnerability is to provide corresponding CWE Common Weakness Enumeration ids. Let's see the CWE links in NVD CVE base. I have already wrote earlier how to deal with NVD feed using python in "Downloading and analyzing N...

Design/Logic Flaw

The miner statistics HTTP API in EWBF Cuda Zcash Miner Version 0.3.4b hangs on incoming TCP connections until some sort of request is made such as "GET / HTTP/1.1", which allows for a Denial of Service attack preventing a user from viewing their mining statistics by an attacker opening a session...

CVE-2017-15300

The miner statistics HTTP API in EWBF Cuda Zcash Miner Version 0.3.4b hangs on incoming TCP connections until some sort of request is made such as "GET / HTTP/1.1", which allows for a Denial of Service attack preventing a user from viewing their mining statistics by an attacker opening a session...

CVE-2017-15300

The miner statistics HTTP API in EWBF Cuda Zcash Miner Version 0.3.4b hangs on incoming TCP connections until some sort of request is made such as "GET / HTTP/1.1", which allows for a Denial of Service attack preventing a user from viewing their mining statistics by an attacker opening a session...

CVE-2017-15300

EWBF Cuda Zcash Miner Version 0.3.4b exposes a miner statistics HTTP API that hangs on incoming TCP connections until a request is received (e.g., GET / HTTP/1.1). This causes a Denial of Service where an attacker can open a session via telnet/netcat to the miner’s HTTP API port and prevent viewi...

CVE-2017-15300: Undefined Security Weakness

The miner statistics HTTP API in EWBF Cuda Zcash Miner Version 0.3.4b hangs on incoming TCP connections until some sort of request is made such as "GET / HTTP/1.1", which allows for a Denial of Service attack preventing a user from viewing their mining statistics by an attacker opening a session...

PT-2017-13978

Name of the Vulnerable Software and Affected Versions EWBF Cuda Zcash Miner version 0.3.4b Description The issue concerns the miner statistics HTTP API, which can be exploited for a Denial of Service attack. This occurs because the API hangs on incoming TCP connections until a request is made, su...

Design/Logic Flaw

If extended statistics are enabled via 'set chassis extended-statistics', when executing any operation that fetches interface statistics, including but not limited to SNMP GET requests, the pfem process or the FPC may crash and restart. Repeated crashes of PFE processing can result in an extended...

CVE-2017-10611

If extended statistics are enabled via 'set chassis extended-statistics', when executing any operation that fetches interface statistics, including but not limited to SNMP GET requests, the pfem process or the FPC may crash and restart. Repeated crashes of PFE processing can result in an extended...