Cisco Unified Communications Manager SQL Injection Vulnerability (CNVD-2017-27947)

Cisco Unified Communications Manager is an enterprise-class IP telephony call processing system. A SQL injection vulnerability exists in Cisco Unified Communications Manager, which allows remote attackers to submit specially crafted SQL queries to manipulate or obtain database data...

CVE-2017-6758: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the web framework of Cisco Unified Communications Manager 11.51.10000.6 could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is due to insufficient input validation by...

CVE-2017-6757: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco Unified Communications Manager 10.52.10000.5, 11.01.10000.10, and 11.51.10000.6 could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass...

PT-2017-17297

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager version 11.51.10000.6 Description A vulnerability in the web framework could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affect...

PT-2017-18003

Name of the Vulnerable Software and Affected Versions Schweitzer Engineering Laboratories SEL SEL-3620 and SEL-3622 Security Gateway versions R202, R203, R203-V1, R203-V2, R204, R204-V1 Description An issue with improper access control was found, which may allow unauthorized communications to...

CVE-2017-7928: Improper Access Control

An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories SEL SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R203-V1, R203-V2 and, R204, R204-V1. The device does not properly enforce access control while configured for NAT port forwarding, which may...

Authentication flaw

DISPUTED An issue was discovered in SMA Solar Technology products. The SMAdata2+ communication protocol does not properly use authentication with encryption: it is vulnerable to man in the middle, packet injection, and replay attacks. Any setting change, authentication packet, scouting packet, et...

Cisco Unified Communications Manager Directory Traversal Vulnerability (cisco-sa-20170802-ucm1)

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be...

Cisco Unified Communications Manager SQL Injection Vulnerability (cisco-sa-20170802-ucm)

A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a blind SQL injection attack. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

heinekingmedia StashCat for Android, Web and Desktop Arbitrary File Read Vulnerability

heinekingmedia StashCat for Android, Web and Desktop are all products of the German company heinekingmedia. heinekingmedia StashCat for Android is an Android-based enterprise communication software. heinekingmedia StashCat for Web is the web-based version and heinekingmedia StashCat for Desktop i...

Cisco Unified Communications Manager SQL Injection Vulnerability

A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker could exploit this...

Cisco Unified Communications Manager Directory Traversal Vulnerability

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is due to insufficient input validation by the affected...

Unspecified Vulnerability in Oracle Communications Convergence

Oracle Communications is Oracle's suite of applications for rapidly delivering and monetizing digital life communications.Communications Convergence is one of the components used for cable communications. A security vulnerability exists in the Mail Proxy dojo subcomponent of the Communications...

A week in security (July 17 – July 23)

Over the last week, we have covered Play Protect, android’s new security system and how the Dutch police ran Hansa Market after the take down of Alpha Bay, both major players on the Dark Web. We also provided some tips on how to stay cyber safe this summer. We also saw how the Terror exploit kit...

Exploit for CVE-2016-6271

CVE-2016-6271 CVE-2016-6271https://vulners.com/cve/CVE-201...

Bad Code Library Triggers Devil's Ivy Vulnerability in Millions of IoT Devices

Tens of millions of products ranging from airport surveillance cameras, sensors, networking equipment and IoT devices are vulnerable to a flaw that allows attackers to remotely gain control over devices or crash them. The vulnerability, dubbed Devil’s Ivy, was identified by ​researchers at Senrio...

Experts in Lather Over ‘gSOAP’ Security Flaw

Axis Communications -- a maker of high-end security cameras whose devices can be found in many high-security areas -- recently patched a dangerous coding flaw in virtually all of its products that an attacker could use to remotely seize control over or crash the devices. The problem wasn't specif...

Remotely Exploitable Flaw Puts Millions of Internet-Connected Devices at Risk

Security researchers have discovered a critical remotely exploitable vulnerability in an open-source software development library used by major manufacturers of the Internet-of-Thing devices that eventually left millions of devices vulnerable to hacking. The vulnerability CVE-2017-9765, discovere...

HackerOne: Content Security Policy not applied to error pages at multiple HackerOne endpoints

HackerOne CSP "script-src" includes "unsafe-inline" bypass via % and %" ----- Summary & Description We utilize a strict Content Security Policy and a safe-by-default templating language to effectively neutralize Cross-Site Scripting XSS. We encrypt all network communications with SSL/TLS...

CVE-2017-1183

IBM Tivoli Monitoring Portal v6 could allow a local network adjacent attacker to modify SQL commands to the Portal Server, when default client-server communications, HTTP, are being used. IBM X-Force ID: 123494...