13609 matches found
PortSwigger Web Security: burp does not validate the common name of the presented collaborator server certificate
Burp is not validating correctly if the presented certificate in collaborator server. It warns if it is a self signed one, but if it is a legitimate one any valid CA, it appears not to be checking the CN. This is an issue for the polling service, since it allows for the connection to be intercept...
DEBIAN-CVE-2017-0356
A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters...
Vulnerability of the setup_ntlmv2_rsp() function (fs/cifs/cifsencrypt.c) in the Linux kernel, allowing a hacker to trigger a service denial
The vulnerability of the setupntlmv2rsp function fs/cifs/cifsencrypt.c in the Linux kernel is related to a pointer dereferencing error. Exploiting this vulnerability could allow an attacker, operating remotely, to cause a kernel panic on the vulnerable system when it connects to a CIFS Common...
CVE-2018-1273
creationtimestamp| type| source ---|---|--- 2018-04-11 20:15:28+00:00| seen| https://t.me/canyoupwnme/3562 2018-12-11 15:50:28+00:00| seen| MISP/5c0fd6cc-f868-4dca-890c-1ea30a021402 2020-10-09 15:40:34+00:00| seen| MISP/1e58e188-7443-497f-a296-717763199581 2023-06-14 21:10:03+00:00| seen|...
CVE-2018-1000156
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's...
CVE-2018-7600
creationtimestamp| type| source ---|---|--- 2018-03-29 07:45:13+00:00| exploited| https://t.me/informationsecuritychannel/15484 2018-04-08 23:48:18+00:00| seen| Telegram/TeeNgrrY0L3KeGx9XI6I6zSAk3-UpIJYpsGjVAUSIY2 2018-04-12 14:48:13+00:00| exploited| https://t.me/R0Crew/546 2018-04-12...
Drupalgeddon 2
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. Recent assessments: J3rryBl4nks at March 03, 2020 3:50pm UTC reported:...
Moderate: Red Hat Security Advisory: openstack-tripleo-common and openstack-tripleo-heat-templates update
An update for openstack-tripleo-common and openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 12.0 Pike. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...
Oracle Linux 7 : slf4j (ELSA-2018-0592)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-0592 advisory. 0:1.7.4-4 - Disallow EventData deserialization by default CVE-2018-8088 Tenable has extracted the preceding description block directly from the Oracle Linux...
Forgot About Default Accounts? No Worries, GoScanSSH Didn’t
This blog post was authored by Edmund Brumaghin, Andrew Williams, and Alain Zidouemba. Executive Summary During a recent Incident Response IR engagement, Talos identified a new malware family that was being used to compromise SSH servers exposed to the internet. This malware, which we have named...
Distributed Network Vulnerability Scanner: Prowler
Prowler is a Network Vulnerability Scanner implemented on a Raspberry Pi Cluster, first developed during Singapore Infosec Community Hackathon – HackSmith v1.0. Capabilities Scan a network a particular subnet or a list of IP addresses for all IP addresses associated with active network devices...
File Permission Manipulation Via Symlink Attack
hadoop-common-yarn is vulnerable to file permission manipulation. Using a symlink attack in a public tar archive, attackers can change the permissions on files to be world-readable...