CVE-2014-9634: Undefined Security Weakness

Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session...

DGA-Detection - DGA Domain Detection using Bigram Frequency Analysis

More and more malware is being created with advanced blocking circumvention techniques. One of the most prevalent techniques being used is the use of Domain Generation Algorithms which periodically generates a set of Domains to contact a C&C server. The majority of these DGA domains generate rand...

Hanbanggaoke IP Camera - Arbitrary Password Change

Hanbanggaoke IP Camera - Arbitrary Password Change Vulnerability summary The following advisory describes an arbitrary password change vulnerability found in Hanbanggaoke webcams. Beijing Hanbang Technology, “one of the first enterprises entering into digital video surveillance industry, has been...

Struts2 new flaws vulnerability bug（S2-052 presents the use case, and face the vulnerability flaws of the enterprise-the race against time-vulnerability warning-the black bar safety net

Prior to the black bar safety net it S2-052）vulnerabilities done in a special thematic report, I believe we also have understand! Recently from the Cisco Talos experimental study of the analysis chamber and NVISO laboratory for the research staff also found that there was an attacker of real use ...

PT-2017-12869

Name of the Vulnerable Software and Affected Versions tcpdump versions prior to 4.9.2 Description The issue is related to a buffer over-read in the LLDP parser, specifically in the lldp mgmt addr tlv print function within print-lldp.c. Recommendations For versions prior to 4.9.2, update to versio...

jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303)

Subversion Plugin improperly checked permissions, requiring just Item/Build instead of Item/Configure when used. This allows a user to specify an attacker-controlled Subversion server which can then be used to collect credentials used by the Subversion plugin...

EulerOS 2.0 SP2 : tcpdump (EulerOS-SA-2017-1180)

According to the versions of the tcpdump package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple out of bounds read and integer overflow vulnerabilities were found in tcpdump affecting the decoding of various protocols. An attacker...

EulerOS 2.0 SP1 : tcpdump (EulerOS-SA-2017-1179)

According to the versions of the tcpdump package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple out of bounds read and integer overflow vulnerabilities were found in tcpdump affecting the decoding of various protocols. An attacker...

One One Travel App Has Logic Design Flaws

One Rent Car is a new energy car time-share rental APP developed by Beijing One Rent Technology Co. One One Travel APP has a logical design vulnerability, attackers can successfully log in by grabbing packets to obtain the verification code...

Logic design flaws in the Android version of the E-Care Online APP (Patient Side)

E-nursing online platform is a platform that provides professional nursing services for the majority of users through the development of an innovative health care service model by Shenyang Shengtai Internet Technology Co. There is a logical design vulnerability in the Android version of the...

Only Circle app has a logic design flaw

The Only Circle app is a circle DIY platform with social features. There is a vulnerability in the logic design of the Only Circle app. An attacker can register any account, reset any password and perform unauthorized operations by capturing packets and blasting CAPTCHA...

Huicheng Gold app has logic design flaws

The Huicheng Gold app is an internet-based lending software. There is a logical design vulnerability in the Huicheng Gold Service app. Attackers can log into other users' systems, reset arbitrary passwords and perform unauthorized operations by capturing verification codes through packet grabbing...

Phoenix Gold app has logic design flaws

Phoenix Gold app is a financial information service platform created by Shenzhen Jinshi Internet Financial Service Co. Phoenix Gold Service app has a logical design vulnerability. Attackers can log in to other users' systems, reset arbitrary passwords and perform unauthorized operations by...

Rice Gold app has logic design flaws

Paddy Gold app is a financial service platform created by Xiamen Golden Paddy Financial. A logical design vulnerability exists in the Paddy Gold app. Attackers can log in to other users' systems, reset arbitrary passwords and perform unauthorized operations by capturing authentication codes in a...

Chongqing Cable Networks Come to the Point app suffers from overstepping access vulnerability

Lai Dot app is an exclusive service for Chongqing Cable broadband subscribers to watch videos, just download and install the client on smart mobile terminals such as cell phones and flat-panel computers and then access Chongqing Cable WIFI network to enjoy the viewing experience. Chongqing Cable ...

People's Liberation Army Naval General Hospital Android app has password bypass vulnerability

The Naval General Hospital app is a handheld medical platform launched by the Naval General Hospital of the Chinese People's Liberation Army. A password bypass vulnerability exists in the People's Liberation Army Naval General Hospital Android App. An attacker can log into the VIP account and...

Monitoring Windows Console Activity (Part 2)

This is the second of two blogs that discuss the implementation of the Windows console architecture from years past, with a primary focus on the current implementation present on modern versions of Windows. Read our first blog, "Monitoring Windows Console Activity Part 1," for more. Capturing the...

PT-2017-13226

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager for Clustered Data ONTAP versions prior to 7.2P1 Description The issue makes it easier for remote attackers to capture an unspecified cookie by intercepting its transmission within an HTTP session, as the secur...

CVE-2017-14053: Exposure of Sensitive Information to an Unauthorized Actor

NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

Override access vulnerability in the Academic Management System of the Gardener Teaching and Learning Management Platform

The Gardener Instructional Management Platform is a comprehensive school management platform that focuses on teaching as an integrated management program. There is an override access vulnerability in the academic management system of the Gardener Teaching Management Platform. After logging in to...