Kali Linux 2018.3 Release - Penetration Testing and Ethical Hacking Linux Distribution

Kali 2018.3 brings the kernel up to version 4.17.0 and while 4.17.0 did not introduce many changes, 4.16.0 had a huge number of additions and improvements including more Spectre and Meltdown fixes, improved power management, and better GPU support. New Tools and Tool Upgrades Since our last...

Cisco Prime Data Center Network Manager < 11.0(1) Download Servlet Path Traversal Vulnerability

According to its self-reported version number, the Cisco Prime Data Center Network Manager DCNM installed on the remote host is prior to 11.01. It is, therefore, affected by a path traversal vulnerability in the Download servlet. An authenticated, remote attacker can exploit this, via a specially...

Security Bulletin: IBM® Db2® sensitive information exposure in the error log (CVE-2017-1434).

Summary When a version check to upgrade Db2 to v11.x fails, the connection string is written in the clear in an error message to db2diag.log. Vulnerability Details CVEID: CVE-2017-1434 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server under unusual circumstances, could...

Western Digital WD TV Live Hub RCE Vulnerability

The web server on Western Digital TV Live Hub 3.12.13 allow unauthenticated remote attackers to execute arbitrary code or cause denial of service via crafted HTTP requests to toServerValue.cgi. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced...

Security Bulletin: IBM Tivoli Workload Scheduler (CVE-2014-6271, CVE-2014-7169)

Summary IBM Tivoli Workload Scheduler is not vulnerable to CVE-2014-6271 or CVE-2014-7169 Bash vulnerability as shipped out of the box, but action could be required because Tivoli Workload Scheduler installation on AIX through Launchpad requires bash. Vulnerability Details CVE-2014-6271 and...

Google Chrome V8 - Object Allocation Size Integer Overflow

Google Chrome V8 - Object Allocation Size Integer Overflow There's an integer overflow in computing the required allocation size when instantiating a new javascript object. See the following code in objects.cc // static bool JSFunction::CalculateInstanceSizeForDerivedClass Handle function,...

Google Chrome V8 - Object Allocation Size Integer Overflow

There's an integer overflow in computing the required allocation size when instantiating a new javascript object. See the following code in objects.cc // static bool JSFunction::CalculateInstanceSizeForDerivedClass Handle function, InstanceType instancetype, int requestedembedderfields, int...

Drupal Core Critical RCE Vulnerability (SA-CORE-2018-004) - Linux

Drupal is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; if...

kubernetes security update

1.9.1-2.1.5 - Production built 1.9.1-2.1.5 - Fix the upgrade version check - Remove w/a from Orabug 27125915 1.9.1-2.1.4.dev - Make sure worker node upgrade properly - Orabug 27649898 1.9.1-2.1.3.dev - Ensure that the runtime mounts RO volumes read-only CVE-2017-1002102 - Update Dashboard version...

Twonky Server 7.0.11 - 8.5 Multiple Vulnerabilities - Version Check

Twonky Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:lynxtechnology:twonkyserver";...

Drupal Core Critical RCE Vulnerability (SA-CORE-2018-002) - Linux, Version Check

Drupal is prone to a critical remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Drupal Core Critical RCE Vulnerability (SA-CORE-2018-002) - Windows, Version Check

Drupal is prone to a critical remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Xen arch_domain_create() Function Local APIC Assumption NULL Pointer Dereference Guest-to-host DoS (XSA-256)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a denial of service vulnerability. Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches we...

Icinga 2 Detection (HTTP)

HTTP based detection of Icinga 2. Note: Providing Icinga2 API Credentials can lead to better results. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Blender vcol_to_fcol Integer Overflow Code Execution Vulnerability

Summary An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the...

Hashicorp vagrant-vmware-fusion 4.0.24 - Local root Privilege Escalation Exploit

Exploit for macOS platform in category local exploits I have previously disclosed a couple of bugs in Hashicorp's vagrant-vmware-fusion plugin for vagrant. Unfortunately the 4.0.23 release which was supposed to fix the previous bug I reported didn't address the issue, so Hashicorp quickly put out...

Windows Information Disclosure Vulnerability (KB4049164)

This host is missing an important security update according to Microsoft KB4049164 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Hashicorp vagrant-vmware-fusion 4.0.24 Local Root Privilege Escalation Exploit

Exploit for windows platform in category local exploits I have previously disclosed a couple of bugs in Hashicorp's vagrant-vmware-fusion plugin for vagrant. Unfortunately the 4.0.23 release which was supposed to fix the previous bug I reported didn't address the issue, so Hashicorp quickly put o...

CVE-2014-2029

The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by leveraging use of HTTP to download configuration information from v.percona.com...

UBUNTU-CVE-2014-2029

The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by leveraging use of HTTP to download configuration information from v.percona.com...