7809 matches found
Insteon Hub HTTPExecuteGet Firmware Update Information Leak Vulnerability
Summary An exploitable information leak vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly checks the number of GET parameters supplied, leading to an arbitrarily controlled information leak on the whole device memory. An attacker can sen...
Axis Network Camera .srv-to-parhand RCE
This module exploits an auth bypass in .srv functionality and a command injection in parhand to execute code as the root user. Module Options msf use exploit/linux/http/axis/srvparhandrce msf undefinedsrvparhandrce show actions ...actions... msf undefinedsrvparhandrce set ACTION msf...
Reverb.com: Basic auth details is still work on report ( 351555 )
Hi , Seem report 351555 is not full fixed where 434762629765715:PQlkrSHPqqjhIBc0MmUkdjcqpps basic auth details are Still work on login Poc : https://api.cloudinary.com/v11/reverb/usage F309894 Impact information Disclose...
Microsoft Windows: Enable insecure guest logons
This test checks the setting for policy OpenVAS Vulnerability Test $Id: wininsecureguestlogons.nasl 11337 2018-09-11 14:23:53Z emoss $ Check value for Enable insecure guest logons Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is...
Microsoft Windows 10: Service: Xbox Live Auth Manager
This test checks the setting for policy OpenVAS Vulnerability Test $Id: winxboxliveauthmanager.nasl 11344 2018-09-12 06:57:52Z emoss $ Check value for Xbox Live Auth Manager XblAuthManager Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This...
https-proxy-agent memory leak vulnerability
https-proxy-agent is an implementation of an HTTP or HTTPS proxy. A security vulnerability exists in https-proxy-agent versions prior to 2.1.1, which stems from a failure of the program to perform proper filtering. An attacker can exploit this vulnerability by submitting input e.g. JSON to the...
CVE-2016-5299
A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox 50...
Unspecified vulnerability in hapi-auth-jwt2
hapi-auth-jwt2 is a module that supports authentication using JSON Web Tokens JWT in Hapi.js web applications. A security vulnerability exists in hapi-auth-jwt2 version 5.1.1. An attacker can exploit the vulnerability to bypass authentication...
CVE-2018-3739
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter e.g. JSON...
Design/Logic Flaw
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter e.g. JSON...
CVE-2018-3739
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter e.g. JSON...
YzmCMS User Traversal Vulnerability
YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A security vulnerability exists in the password retrieval function of the index.php/member/reset/resetemail.html page in YzmCMS version 3.2 to 3.7, which originates from the validity period of the...
CVE-2016-10526
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly...
CVE-2016-10525
Affects hapi-auth-jwt2 prior to 5.1.2: in try authentication mode, an authentication bypass vulnerability exists, enabling bypass of auth checks. Impact described as complete bypass with high severity; fix is to upgrade to 5.1.2 or later. Documents from GHSA and npm advisory confirm vulnerability...
opensuse-security@xxxxxxxxxxxx</li> <li><span class="identifier"> Date</span>: Tue, 29 May 2018 18:07:29 +0200 (CEST)</li> <li><span class="identifier"> Message-id</span>: <<a href="msg00112.html">[email protected]</a>></li> </ul> <!--X-Head-of-Message-End--> <!--X-Head-Body-Sep-Begin--> </div> <div class="body"> <!--X-Head-Body-Sep-End--> <!--X-Body-of-Message--> openSUSE Security Update: Security update for pdns<br> ______________________________________________________________________________<br> <br> Announcement ID: openSUSE-SU-2018:1462-1<br> Rating: low<br> References: #1092540 <br> Cross-References: CVE-2018-1046<br> Affected Products:<br> SUSE Package Hub for SUSE Linux Enterprise 12<br> ______________________________________________________________________________<br> <br> An update that fixes one vulnerability is now available.<br> <br> Description:<br> <br> <br> pdns was updated to 4.1.2.<br> <br> Security fixes:<br> <br> * Dnsreplay: bail out on a too small outgoing buffer (CVE-2018-1046<br> bsc#1092540)<br> <br> Improvements:<br> <br> * API: increase serial after dnssec related updates<br> * Auth: lower âpacket too shortâ loglevel<br> * Make check-zone error on rows that have content but shouldnât<br> * Auth: avoid an isane amount of new backend connections during an axfr<br> * Report unparseable data in stoul invalid_argument exception<br> * Backport: recheck serial when axfr is done<br> * Backport: add tcp support for alias<br> <br> Bug Fixes:<br> <br> * Auth: allocate new statements after reconnecting to postgresql<br> * Auth-bindbackend: only compare ips in ismaster() (Kees Monshouwer)<br> * Rather than crash, sheepishly report no file/linenum<br> * Document undocumented config vars<br> * Backport #6276 (auth 4.1.x): prevent cname + other data with dnsupdate<br> <br> Misc fixes:<br> <br> * Move includes around to avoid boost L conflict<br> * Backport: update edns option code list<br> * Auth: link dnspcap2protobuf against librt when needed<br> * Fix a warning on botan &gt;= 2.5.0<br> * Auth 4.1.x: unbreak build<br> <br> <br> Patch Instructions:<br> <br> To install this openSUSE Security Update use the SUSE recommended <br> installation methods<br> like YaST online_update or "zypper patch".<br> <br> Alternatively you can run the command listed for your product:<br> <br> - SUSE Package Hub for SUSE Linux Enterprise 12:<br> <br> zypper in -t patch openSUSE-2018-538=1<br> <br> <br> <br> Package List:<br> <br> - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x <br> x86_64):<br> <br> pdns-4.1.2-8.1<br> pdns-backend-godbc-4.1.2-8.1<br> pdns-backend-ldap-4.1.2-8.1<br> pdns-backend-lua-4.1.2-8.1<br> pdns-backend-mydns-4.1.2-8.1<br> pdns-backend-mysql-4.1.2-8.1<br> pdns-backend-postgresql-4.1.2-8.1<br> pdns-backend-remote-4.1.2-8.1<br> pdns-backend-sqlite3-4.1.2-8.1<br> <br> <br> References:<br> <br> <a rel="nofollow" href="https://www.suse.com/security/cve/CVE-2018-1046.html">https://www.suse.com/security/cve/CVE-2018-1046.html</a><br> <a rel="nofollow" href="https://bugzilla.suse.com/1092540">https://bugzilla.suse.com/1092540</a><br> <br> -- <br> To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@xxxxxxxxxxxx<br> For additional commands, e-mail: opensuse-security-announce+help@xxxxxxxxxxxx<br> <br> <!--X-Body-of-Message-End--> <!--X-MsgBody-End--> <!--X-Follow-Ups--> <!-- SwishCommand noindex --> </div> <table class="bodynav"> <tr> <td align="left"> < Previous </td> <td align="right"> Next > </td> </tr> </table> </div> <div class="visualClear"></div> </div> </div> </div> <div id="column-one"> <a name="indexes"></a> <div class="portlet" id="p-topnav"> <div class="pBody"> <ul> <li><a href="threads.html">Thread Index</a></li> <li><a href="author.html">Author Index</a></li> <li><a href="date.html">Date Index</a></li> <li><a href="all.html">All Messages</a></li> </ul> </div> </div> <div class="portlet" id="p-logo"> <a style="background-image: url(/skins/opensuse/opensuse.gif);" href="../" title="Back"></a> </div> <script type="text/javascript"> if (window.isMSIE55) fixalpha(); </script> <a name="search"></a> <div id="p-search" class="portlet" style="white-space: nowrap;"> <h5><label for="searchInput">Search this list</label> (Security update for pdns</h5> <!--X-Subject-Header-End--> <!--X-Head-of-Message--> <ul> <li><span class="identifier"> From</span>)
pdns was updated to 4.1.2. Security fixes: Dnsreplay: bail out on a too small outgoing buffer CVE-2018-1046 bsc1092540 Improvements: API: increase serial after dnssec related updates Auth: lower âpacket too shortâ loglevel Make check-zone error on rows that have content but shouldnât Auth:...
pfSense Post-Auth Command Execution Vulnerability
pfSense is a free and open source firewall and router software under FreeBSD. A command execution vulnerability exists in pfSense Post-Auth. An attacker can exploit this vulnerability to gain privileges to execute commands in the root user's environment...
Avito: Open Redirect via login avito.ru | Protection bypass
Open-redirect using the following vector and social auth: https://www.avito.ru/rossiyalogin?next=///...
Authentication Bypass
json-jwt is vulnerable to authentication bypasses. The library does not properly validate the GCM auth tag length, allowing a malicious user to require at most 256 attempts to forge a valid auth tag...
Make Application Access IT-Friendly
More and more companies are looking at alternatives to VPNs due to the security risks associated with network level access. And increasingly, the goal is to eliminate network trust through a zero trust architecture - which is one of the primary reasons many of these organizations are deploying...
Medium: httpd24
Issue Overview: Use-after-free on HTTP/2 stream shutdown When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this...