Design/Logic Flaw

A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System IPICS Universal Media Services UMS could allow an unauthenticated, remote attacker to modify configuration parameters of the UMS and cause the system to become unavailable. Affect...

CVE-2016-6397: Improper Authentication

A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System IPICS Universal Media Services UMS could allow an unauthenticated, remote attacker to modify configuration parameters of the UMS and cause the system to become unavailable. Affect...

CVE-2016-6440

The Cisco Unified Communications Manager CUCM may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. More Information: CSCuz64683 CSCuz64698. Known Affected Releases: 11.01.10000.10, 11.51.10000.6, 11.50.99838.4. Know...

CVE-2016-6440

The Cisco Unified Communications Manager CUCM may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. More Information: CSCuz64683 CSCuz64698. Known Affected Releases: 11.01.10000.10, 11.51.10000.6, 11.50.99838.4. Know...

Information disclosure

The Cisco Unified Communications Manager CUCM may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. More Information: CSCuz64683 CSCuz64698. Known Affected Releases: 11.01.10000.10, 11.51.10000.6, 11.50.99838.4. Know...

CVE-2016-6440

CVE-2016-6440 affects Cisco Unified Communications Manager (CUCM). Root cause: lack of input sanitization for iframe data in HTTP requests, enabling an attacker to display data inside an iframe and trigger clickjacking (phishing) without user interaction. Affected releases include CUCM 11.0(1.100...

CVE-2016-6440

The Cisco Unified Communications Manager CUCM may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. More Information: CSCuz64683 CSCuz64698. Known Affected Releases: 11.01.10000.10, 11.51.10000.6, 11.50.99838.4. Know...

PT-2016-6914

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager CUCM versions 11.01.10000.10 through 11.51.10000.6 Cisco Unified Communications Manager CUCM version 11.50.99838.4 Description The issue allows data to be displayed inside an iframe within a web page,...

CVE-2016-6440: Improper Input Validation

The Cisco Unified Communications Manager CUCM may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. More Information: CSCuz64683 CSCuz64698. Known Affected Releases: 11.01.10000.10, 11.51.10000.6, 11.50.99838.4. Know...

Dyn DDoS Work of Script Kiddies, Not Politically Motivated Hackers

New research on the source of Friday’s DDoS attack against DNS provider Dyn indicates that script kiddies are likely responsible, rather than a politically motivated actor. Researchers at Flashpoint dismissed numerous claims of responsibility that separately linked the attack to the Russian...

Chinese Manufacturer Recalls IOT Gear Following Dyn DDoS

Hangzhou Xiongmai said that it will recall millions of cameras sold in the U.S. in response to Friday’s DDoS attack against DNS provider Dyn that kept a number of web-based services such as Twitter, Github and others offline for much of the day. The Chinese manufacturer sells OEM white-label...

The RFC 5114 saga

Back in January I posed a question "to the Internet": What the heck is RFC 5114? It looks like a lot happened since then around it. I would like to use this post to recollect some of the stuff around RFC5114 . Chapter 0: October 2007 RFC5114 draft was submitted to the IETF . Chapter I: January 20...

Lenovo ThinkVantage Communications Utility 3.0.42.0 Privilege Escalation Vulnerability

Exploit for windows platform in category local exploits Exploit Title: Lenovo ThinkVantage Communications Utility - Unquoted Service Path Privilege Escalation Date: 10/19/2016 Exploit Author: Joey Lane Version: 3.0.42.0 Tested on: Windows 7 Professional The Lenovo ThinkVantage Communications...

Mirai Bots More Than Double Since Source Code Release

The Mirai malware continues to recruit vulnerable IoT devices into botnets at a record pace, one that’s only gone up since the source code for Mirai was made public two weeks ago. Level 3 Communications, a telecommunications company and Internet service provider in Colorado, has identified the...

[SECURITY] Fedora 23 Update: openssh-7.2p2-6.fc23

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

Lenovo ThinkVantage Communications Utility 3.0.42.0 - Unquoted Service Path Privilege Escalation

Lenovo ThinkVantage Communications Utility 3.0.42.0 - Unquoted Service Path Privilege Escalation Exploit Title: Lenovo ThinkVantage Communications Utility - Unquoted Service Path Privilege Escalation Date: 10/19/2016 Exploit Author: Joey Lane Version: 3.0.42.0 Tested on: Windows 7 Professional Th...

Lenovo ThinkVantage Communications Utility 3.0.42.0 - Unquoted Service Path Privilege Escalation

Exploit Title: Lenovo ThinkVantage Communications Utility - Unquoted Service Path Privilege Escalation Date: 10/19/2016 Exploit Author: Joey Lane Version: 3.0.42.0 Tested on: Windows 7 Professional The Lenovo ThinkVantage Communications Utility installs 2 services with unquoted service paths. Thi...

Novell NetIQ Sentinel CVE-2016-1000031 Remote Code Execution Vulnerability

Description Novell NetIQ Sentinel is prone to a security vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Novell NetIQ Sentinel version 7.4x are vulnerable. Technologies Affected Apache Commons FileUpload 1.0...

Cisco Unified Communications Manager iFrame Data Clickjacking Vulnerability (cisco-sa-20161012-ucm)

The Cisco Unified Communications Manager CUCM may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. Protection mechanisms should be used to prevent this type of attack. Copyright C 2016 Greenbone Networks GmbH Some...

Cisco Unified Communications Manager Clickjacking Vulnerability

Cisco Unified Communications Manager CUCM, Unified CM is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A clickjacking vulnerability has been...