DEBIAN-CVE-2017-2894

An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT packet ove...

Cesanta Mongoose MQTT Information Disclosure Vulnerability

Cesanta Mongoose is a suite of embedded servers from Cesanta, Ireland. An information disclosure vulnerability exists in the MQTT packet parsing feature in Cesanta Mongoose version 6.8. An attacker can exploit this vulnerability by sending specially crafted MQTT packets to obtain information or...

Ubuntu: Security Advisory (USN-3469-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3469-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3469-2 advisory. USN-3469-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...

Unspecified Vulnerability in Apple iOS and macOS Sierra 802.1X

Apple iOS and macOS Sierra are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; macOS Sierra is a specialized operating system developed for Mac computers. 802.1X is one of the Client or Server-based access control and authentication protocol components. A...

Apple macOS High Sierra ATS Information Disclosure Vulnerability

Apple macOS High Sierra is a specialized operating system developed by Apple for Mac computers.ATS is one of the application transport security components. A security vulnerability exists in the ATS component in Apple macOS High Sierra versions prior to 10.13.1. A remote attacker can exploit the...

ALPINE-CVE-2017-1000256

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default...

CVE-2017-3934

CVE-2017-3934 affects McAfee Network Data Loss Prevention (NDLP) server v9.3.x. The vulnerability is due to missing HTTP Strict Transport Security (HSTS) state, enabling MITM attackers to access confidential data by reading files on the web server. Descriptions in connected CNVD/NVD entries corro...

USN-3469-2: Linux kernel (Xenial HWE) vulnerabilities

USN-3469-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Anthony Perard discovered that the Xen virtual block driver did not properly initializ...

USN-3469-1: Linux kernel vulnerabilities

Anthony Perard discovered that the Xen virtual block driver did not properly initialize some data structures before passing them to user space. A local attacker in a guest VM could use this to expose sensitive information from the host OS or other guest VMs. CVE-2017-10911 Bo Zhang discovered tha...

CVE-2017-6161

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.1.2, 11.6.0 - 11.6.1, 11.4.0 - 11.5.4, 11.2.1, when ConfigSync is configured, attackers on adjacent networks may be able to bypass the TLS protections usually...

Huawei FusionSphere Openstack Information Disclosure Vulnerability (CNVD-2017-33879)

Huawei FusionSphere and FusionSphere OpenStack FSO are both Huawei products. The former is a cloud operating system product developed based on the OpenStack framework, and the latter is FusionSphere's cloud platform software in ICT scenarios. Huawei FusionSphere Openstack suffers from an...

CVE-2017-6141

In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel TMM. The Sessio...

libvirt TLS Certificate Validation Vulnerability

libvirt is a set of free , open source support for the mainstream virtualization tools under Linux C function library . A TLS certificate validation vulnerability exists in Libvirt 2.3.0 and later. The vulnerability is caused by an error in the default configuration "verify-peer=no" passed to QEM...

The vulnerability of the WPA2 protocol, which stems from errors in managing the cryptographic keys, allows unauthorized access to encrypted information transmitted over a wireless network.

The vulnerability of the WPA2 protocol, which provides security for wireless Wi-Fi networks, is related to errors in the management of cryptographic keys. Exploiting this vulnerability allows a perpetrator within the range of a Wi-Fi network to gain access to encrypted information transmitted ove...

KRACK Vulnerability in WiFi WPA2

Akamai is aware of a family of vulnerabilities known as the Key Reinstallation Attack or KRACK. These vulnerabilities abuse implementation flaws found in all modern wireless networks using WPA2. The KRACK attack is effective at the protocol level and therefore affects all systems using current Wi...

DDoS attacks on Sweden’ Transport Agencies Delay Train Service

By Waqas The official website of Transportstyrelsen, Swedens Transport Agency STA came under This is a post from HackRead.com Read the original post: DDoS attacks on Sweden Transport Agencies Delay Train Service...

DEBIAN-CVE-2017-14603

In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetricrtp" options allow...

SSL/TLS: Check for `max-age` Attribute in HSTS Header

The remote web server is using a too low value within the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-14797

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...