CVE-2018-11086

Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin...

Rollout or Not: the Benefits and Risks of iOS Remote Hot Patching

Previously On iOS Remote Hot Patching Apple’s detailed app review process has resulted in greater security for iOS apps made available through the App Store. However, this review process can be lengthy, which negatively impacts developers who need to quickly patch a buggy or insecure app. As a...

MikroTik RouterOS - sshd (ROSSSH) Remote Heap Corruption

During an audit the Mikrotik RouterOS sshd ROSSSH has been identified to have a remote previous to authentication heap corruption in its sshd component. Exploitation of this vulnerability will allow full access to the router device. This analysis describes the bug and includes a way to get...

MikroTik RouterOS - sshd (ROSSSH) Remote Heap Corruption

MikroTik RouterOS - sshd ROSSSH Remote Heap Corruption During an audit the Mikrotik RouterOS sshd ROSSSH has been identified to have a remote previous to authentication heap corruption in its sshd component. Exploitation of this vulnerability will allow full access to the router device. This...

[SECURITY] Fedora 16 Update: gitolite3-3.04-4.fc16

Gitolite allows a server to host many git repositories and provide access to many developers, without having to give them real userids on the server. The essential magic in doing this is ssh's pubkey access and the authorized keys file, and the inspiration was an older program called gitosis...

Undocumented account vulnerability in Avaya P550R/P580/P880/P882 switches

Undocumented account vulnerability in Avaya P550R/P580/P880/P882 switches 1. Problem Description Two undocummented accounts with default passwords allow access via telnet and the web interface to Cajun P550R/P580/P880/P882 switches. Both accounts give developer access to the switch. The...