CVE-2017-8038: Credentials readable from CredHub endpoint | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected Credhub-release version 1.1.0 only Description CredHub access control lists ACLs enforce whether an authenticated user can perform an operation on a credential. For installations using ACLs, the ACL was bypassed for the CredHub...

SSH MITM - SSH Man-In-The-Middle Tool

This penetration testing tool allows an auditor to intercept SSH connections. A patch applied to the OpenSSH v7.5p1 source code causes it to act as a proxy between the victim and their intended SSH server; all plaintext passwords and sessions are logged to disk. Of course, the victim's SSH client...

UPDATE: OWASP Dependency-Check 2.1.0!

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP Dependency-Check 2.1.0! What I like about this release...

Cyber Insurance Rates to Rise – What Should I Do?

Organizations manage risk in three ways: they accept it, they take out insurance against it, or they take active measures to diminish its potential impact. These active measures commonly include deploying or enhancing or removing technology, updating policies and procedures, instituting training...

Commentary on US Election Security

Good commentaries from Ed Felten and Matt Blaze. Both make a point that I have also been saying: hacks can undermine the legitimacy of an election, even if there is no actual voter or vote manipulation. Felten: The second lesson is that we should be paying more attention to attacks that aim to...

The vulnerability of the SAP HANA database management system allows a hacker to execute arbitrary code.

The vulnerability of the SAP HANA database management system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, using vectors that include audit logs. This is referred to as SAP Security Note 2170806...

Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) -

Exploit for linux platform in category local exploits / Linuxldsohwcap64.c for CVE-2017-1000366, CVE-2017-1000379 Copyright C 2017 Qualys, Inc. myimportanthwcaps adapted from elf/dl-hwcaps.c, part of the GNU C Library: Copyright C 2012-2017 Free Software Foundation, Inc. This program is free...

WordPress WP Security Audit Log plugin <= 2.4.3 - Reflected Cross-Site Scripting (XSS) Vulnerability

Reflected Cross-Site Scripting XSS Vulnerability exists in AjaxDisableCustomField function, in the file /wp-security-audit-log.php. The "notice" variable is printed on the front-end without escaping it. Solution Update the plugin...

System Integrity Management Platform: SIMP

System Integrity Management Platform The System Integrity Management Platform SIMP is an Open Source framework designed around the concept that individuals and organizations should not need to repeat the work of automating the basic components of their operating system infrastructure. Expanding...

unrar 5.40 - 'VMSF_DELTA' Filter Arbitrary Memory Write

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1286&desc=6 It appears that the VMSFDELTA memory corruption that was reported to Sophos AV in 2012 and fixed there was actually inherited from upstream unrar. For unknown reasons the information did not reach upstream rar or was...

OpenVPN Patches Critical Remote Code Execution Vulnerability

OpenVPN has this week patched four vulnerabilities, including a critical remote code execution bug, a little more than a month after the results of two security audits of the open source VPN software were published. The patches were released after private disclosures in May and June by researcher...

SUSE SLED12 / SLES12 Security Update : openvpn (SUSE-SU-2017:1622-1) (SWEET32)

This update for openvpn fixes the following issues : - CVE-2016-6329: Show which ciphers should no longer be used in openvpn --show-ciphers bsc995374 - CVE-2017-7478: openvpn: Authenticated user can DoS server by using a big payload in PCONTROL bsc1038709 - CVE-2017-7479: openvpn: Denial of Servi...

Vulners Cloud Agents for Vulnerability Management

A very good news! Vulners Team is ready to present complete functionality for vulnerability audit. And it's not just an Audit API that you have to use somehow in your own scripts, but an enterprise ready product, like agent-based vulnerability scanning in Qualys and Tenable. You can try it for...

Enterprise Security: EAA Exceeds Compliance Standards

I sat down again with John Payne, Akamai's Chief Architect of Infrastructure and Security, as well as Keith Hillis, Director IT Risk & Security. We spoke about enterprise security compliance, and how Enterprise Application Access EAA exceeds Akamai's requirements and simplifies the process for...

SUSE-SU-2017:1622-1 Security update for openvpn

This update for openvpn fixes the following issues: - CVE-2016-6329: Show which ciphers should no longer be used in openvpn --show-ciphers bsc995374 - CVE-2017-7478: openvpn: Authenticated user can DoS server by using a big payload in PCONTROL bsc1038709 - CVE-2017-7479: openvpn: Denial of Servic...

glibc: heap/stack gap jumping via unbounded stack allocations

A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap or different memory region and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process sta...

NSA Arsenal of Eclipsedwing reproduce-bug warning-the black bar safety net

Blurbs From the shadow Brokers published the NSA leaks tool, and the brightest great God continually published leaked tool various exp reproduction process, and WannaCry, the EternalRocks ransomware virus is raging, no one do not exhibit leakage of the tools of power, but the leaks tool in light...

IBM Informix Dynamic Server - Code Injection / Remote Code Execution

!/usr/local/bin/python """ IBM Informix Dynamic Server doconfig PHP Code Injection Remote Code Execution Vulnerability 0DAY Bonus: free XXE bug included! Download: https://www-01.ibm.com/marketing/iwm/iwm/web/reg/download.do?source=swg-informixfpd&SPKG=dl&lang=enUS&cp=UTF-8&dlmethod=http Twitter:...

WordPress: [mercantile.wordpress.org] Reflected XSS

@zeeshan found a bypass for 230234. Payload used : constructor.constructor'alertdocument.domain' URL to trigger XSS : https://mercantile.wordpress.org/?s=%26%23123%3B%26%23123%3Bconstructor.constructor%28%27alert%28document.domain%29%27%29%28%29%7D%7D&posttype=product ----- Soon after another XSS...

Huawei UMA Product Information Disclosure Vulnerability (CNVD-2017-12922)

Huawei Unified Maintenance Audit UMA is a unified IT core resource operation and maintenance management and security audit platform designed for carriers, government, finance, electric power and large enterprises. Huawei UMA products have information leakage vulnerabilities, which can be exploite...