DejaVU - Open Source Deception Framework

Deception techniques if deployed well can be very effective for organizations to improve network defense and can be a useful arsenal for blue teams to detect attacks at very early stage of cyber kill chain. But the challenge we have seen is deploying, managing and administering decoys across larg...

Mozilla Firefox Design Vulnerability (CNVD-2018-11791)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 60, which stems from a failure of the web console and JavaScript debugger to filter all output with hyperlinks. A remote...

console-io authentication bypass vulnerability

Cloud Commander is a Web file manager with console and editor. console-io is one of the Web-based console programs. A security vulnerability exists in console-io 2.2.13 and earlier versions, which stems from the program not configuring socket.io to perform authentication. A remote attacker could...

CVE-2016-10615

The CVE-2016-10615 issue affects the curses package, where the library downloads binary resources over HTTP. The underlying problem is insecure HTTP delivery, enabling a MitM attacker to swap the requested binary, potentially leading to remote code execution on the host. The connected advisories ...

CVE-2016-10615

curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled...

CVE-2016-10532

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running...

CVE-2016-10532

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running...

Authentication flaw

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running...

CVE-2016-10532

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running...

CVE-2016-10532

The CVE-2016-10532 issue concerns the console-io module, specifically versions 2.2.13 and earlier, where socket.io is not configured to require authentication. This allows an attacker to connect via WebSocket, bypass authentication, and execute commands with the same privileges as the console-io ...

Quest KACE System Management Appliance 8.0 (Build 8.0.318) XSS / Traversal / Code Execution / SQL Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Quest KACE System Management Appliance Multiple Vulnerabilities 1. Advisory Information Title: Quest KACE System Management Appliance Multiple Vulnerabilities Advisory ID: CORE-2018-0004 Advisory URL:...

Unspecified Security Bypass Vulnerability in SAP Management Console

SAP Management Console is a management console for SAP products. An unspecified security bypass vulnerability exists in SAP Management Console. An attacker could use this vulnerability to bypass certain security restrictions and perform unauthorized actions, resulting in further attacks...

Open Source Deception Framework: DejaVU

Deception techniques if deployed well can be very effective for organizations to improve network defense and can be a useful arsenal for blue teams to detect attacks at very early stage of cyber kill chain. But the challenge we have seen is deploying, managing and administering decoys across larg...

GridGain Directory Traversal Vulnerability

GridGain is a suite of in-memory computing platforms from GridGain Systems.Visor GUI Console is one of the visualization consoles. A directory traversal vulnerability exists in the Visor GUI Console in GridGain. A remote attacker can exploit this vulnerability to read arbitrary files via speciall...

CVE-2017-2607

jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes SECURITY-382. Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins user...

Cross site scripting

jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes SECURITY-382. Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins user...

The Provisioning Server either cannot be found or shows as **down** in the Provisioning Services Console.

The Provisioning Server either cannot be found or shows as down in the Provisioning Services Console. The Provisioning Server might be unavailable...

The Soap service is not running on the PVS server

The Soap Server service isn't running.This service is needed to allow logging in to the Provisioning Services Console...

SA149: CSRF Vulnerability in CA and MTD

SUMMARY The Symantec Content Analysis CA and Mail Threat Defense MTD management consoles are susceptible to a cross-site request forging CSRF vulnerability. A remote attacker can use phishing or other social engineering techniques to access the management console with the privileges of an...

ovirt-engine: account enumeration through login to web console

The ovirt-engine web console login form returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts...