Server side request forgery (ssrf)

An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A Server-Side Request Forgery SSRF vulnerability exists that could be abused to bypass network access controls...

CVE-2017-11291

Adobe Connect 9.6.2 and earlier is affected by CVE-2017-11291, a Server-Side Request Forgery (SSRF) vulnerability that could bypass network access controls. The issue is documented across multiple sources: the NVD entry for CVE-2017-11291 (CVSS v3: 10.0, NETWORK, HIGH impact on confidentiality/ i...

CVE-2017-11291

An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A Server-Side Request Forgery SSRF vulnerability exists that could be abused to bypass network access controls...

Implementing the CIS 20 Critical Security Controls: Make Your InfoSec Foundation Rock Solid

For almost 10 years, thousands of organizations eager to solidify their security and compliance foundations have found clarity and direction in the the Center for Internet Security’s Critical Security Controls CSCs. This structured set of 20 foundational InfoSec best practices, first published in...

DEBIAN-CVE-2017-17450

net/netfilter/xtosf.c in the Linux kernel through 4.14.4 does not require the CAPNETADMIN capability for addcallback and removecallback operations, which allows local users to bypass intended access restrictions because the xtosffingers data structure is shared across all net namespaces...

Implementing the CIS 20 Critical Security Controls: Delving into More Sophisticated Techniques

Corden Pharma needed a standardized security program to meet customer requirements. Link3 Technologies wanted to prioritize its network security improvements. Telenet was looking for a road map to implement its ISO-27000 compliance program. These three companies — a German pharmaceutical contract...

PostgreSQL Security Bypass Vulnerability (Dec 2017) - Windows

PostgreSQL is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:postgresql:postgresql";...

DEBIAN-CVE-2017-17091

wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string...

CVE-2017-10900

PTW-WMS1 firmware version 2.000.012 allows remote attackers to bypass access restrictions to obtain or delete data on the disk via unspecified vectors...

Implementing the CIS 20 Critical Security Controls: Building Upon Foundational Cyber Hygiene

Most successful cyber attacks exploit known vulnerabilities for which patches are available, or take advantage of weak configuration settings that could have been easily hardened. You can significantly lower the risk of being victimized by this type of common, preventable attack by adopting the...

Cacti Access Restriction Bypass Vulnerability

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . A security vulnerability exists in the authlogin.php file in versio...

borgbackup -- remote users can override repository restrictions

BorgBackup reports: Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers. A user able to access a remote Borg SSH server is able to circumvent access controls post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases 1.0.x...

Vonage VDV23 - Cross-Site Scripting

Vonage VDV23 - Cross-Site Scripting Exploit Title: Vonage Home Router – Stored Xss Date: 16/11/2017 Exploit Author: Nu11By73 Hardware Version: VDV-23: 115 Software Version: 3.2.11-0.9.40 CVE : CVE-2017-16843 NewKeyword Parameter: 1. Login to the router 2. Click advanced setup 3. Click parental...

Vonage VDV23 - Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Vonage Home Router – Stored Xss Exploit Author: Nu11By73 Hardware Version: VDV-23: 115 Software Version: 3.2.11-0.9.40 CVE : CVE-2017-16843 NewKeyword Parameter: Login to the router Click advanced setup Click parental...

Adobe Connect Multiple Vulnerabilities (APSB17-35)

Adobe Connect is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:connect"; ifdescription...

Vonage VDV23 - Cross-Site Scripting

Exploit Title: Vonage Home Router – Stored Xss Date: 16/11/2017 Exploit Author: Nu11By73 Hardware Version: VDV-23: 115 Software Version: 3.2.11-0.9.40 CVE : CVE-2017-16843 NewKeyword Parameter: 1. Login to the router 2. Click advanced setup 3. Click parental controls 4. In the block these keyword...

Implementing the CIS 20 Critical Security Controls: Slash Risk of Cyber Attacks by 85%

If a CISO needed to cut cyber attack risk by 85%, how would this security chief go about accomplishing that? Would the CISO even know where to begin? It’s safe to say that such a mandate would be considered daunting, and maybe even overwhelming. CISOs are scrambling to protect IT infrastructures...

The vulnerability of Huawei FusionServer’s software allows a hacker to bypass access restrictions and execute arbitrary commands.

The vulnerabilities of the FusionServer RH2288V3, FusionServer RH2288HV3, FusionServer XH628V3, FusionServer RH1288V3, FusionServer RH2288A2, FusionServer RH1288A2, FusionServer RH8100V3, FusionServer CH222V3, FusionServer CH220V3, and FusionServer CH121V3 software programs are related to the lac...

couchdb -- multiple vulnerabilities

Apache CouchDB PMC reports: Database Administrator could achieve privilege escalation to the account that CouchDB runs under, by abusing insufficient validation in the HTTP API, escaping security controls implemented in previous releases...

Trend Micro IWSVA 6.5 < 6.5 Build 1737 Multiple Vulnerabilities

The version of Trend Micro InterScan Web Security Virtual Appliance IWSVA installed on the remote host is 6.5 prior to 6.5 Build 1737. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to insecure access controls in the ManagePatches Servl...