CVE-2017-11361

Inteno routers have a JUCI ACL misconfiguration that allows the "user" account to read files, write to files, and add root SSH keys via JSON commands to ubus. Exploitation is sometimes easy because the "user" password might be "user" or might match the Wi-Fi key...

CVE-2017-11361

Inteno routers have a JUCI ACL misconfiguration that allows the "user" account to read files, write to files, and add root SSH keys via JSON commands to ubus. Exploitation is sometimes easy because the "user" password might be "user" or might match the Wi-Fi key...

CVE-2017-11361

Inteno routers are affected by CVE-2017-11361 due to a JUCI ACL misconfiguration. The issue allows the low-privilege "user" account to read and write files and to add a root SSH key by sending JSON commands to ubus. Exploitation is sometimes easy because the "user" password might be the default "...

CVE-2017-11361: Improper Privilege Management

Inteno routers have a JUCI ACL misconfiguration that allows the "user" account to read files, write to files, and add root SSH keys via JSON commands to ubus. Exploitation is sometimes easy because the "user" password might be "user" or might match the Wi-Fi key...

PT-2017-11959

Name of the Vulnerable Software and Affected Versions Inteno routers affected versions not specified Description The issue concerns a JUCI ACL misconfiguration in Inteno routers, allowing the user account to read files, write to files, and add root SSH keys via JSON commands to ubus. This...

CentOS 6 : kernel (CESA-2017:1723)

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2017:1723 An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

PT-2017-11743 · Cz.Nic +1 · Knot Dns +1

Name of the Vulnerable Software and Affected Versions: Knot DNS versions prior to 2.4.5 Knot DNS versions 2.5.x prior to 2.5.2 Description: The issue is related to a flaw in the TSIG protocol implementation. This flaw allows an attacker with a valid key name and algorithm to bypass TSIG...

Debian DLA-961-1 : mosquitto security update

CVE-2017-7650: Pattern based ACLs can be bypassed by clients that set their username/client id to or +. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third-party authentication/access control plugins for...

[SECURITY] [DSA 3865-1] mosquitto security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3865-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 29, 2017 https://www.debian.org/security/faq -...

DEBIAN-CVE-2016-10377

In Open vSwitch OvS 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow in lib/flow.c in the function miniflowextract, permitting remote bypass of the access control list enforced by the switch...

CVE-2016-10377

In Open vSwitch OvS 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow in "lib/flow.c" in the function "miniflowextract", permitting remote bypass of the access control list enforced by the switch...

CVE-2016-10377: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Open vSwitch OvS 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow in lib/flow.c in the function miniflowextract, permitting remote bypass of the access control list enforced by the switch...

PT-2017-17865

Name of the Vulnerable Software and Affected Versions Mosquitto versions prior to 1.4.12 Description The issue allows clients to bypass pattern-based ACLs by setting their username/client ID to '' or '+'. This enables locally or remotely connected clients to access MQTT topics they do not have...

PT-2017-7891

Name of the Vulnerable Software and Affected Versions Open vSwitch version 2.5.0 Description A malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow in the function miniflow extract in lib/flow.c, permitting remote bypass of the...

Debian: Security Advisory (DSA-3865-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Zomato: Amazon S3 bucket misconfiguration (share)

Hi, Description I have discovered one of your Amazon S3 bucket and tested it via the AWS command line tool on Linux. It looks like permissions are not well configured and allow dangerous actions to everyone. The vulnerable bucket is: zomato-share PoC: aws s3 ls s3://zomato-share aws s3 cp test...

PT-2017-2750

Name of the Vulnerable Software and Affected Versions NoviWare versions through NW400.2.6 Description The issue arises from a bug in the NoviWare software distribution when applying ACL modifications, which can inadvertently expose network interfaces of the cliengine and noviengine services. This...

PT-2017-2749

Name of the Vulnerable Software and Affected Versions NoviWare versions through NW400.2.6 Description The issue is caused by a stack-based buffer overflow in the ACL component of the NoviWare operating system. This can be exploited by a remote attacker using specially crafted network packets...