Mail.ru: Double authentication bypass

Report describes current behavior of "Bind session to IP" and "Disable parallel session" security settings and is unrelated to authentication. While behavior doesn't match to reporter's expectation e.g. mobile and desktop sessions may exist in parallel despite of the settings current behavior is...

Multiple vulnerabilities in CG-WGR1200

Overview CG-WGR1200 provided by Corega Inc is a wireless LAN router. CG-WGR1200 contains multiple vulnerabilities listed below. Buffer Overflow CWE-119 - CVE-2017-10852 Buffer Overflow CWE-78 - CVE-2017-10853 Authentication bypass CWE-306 - CVE-2017-10854 Taizoh Tsukamoto of Mitsui Bussan Secure...

Default Password 'St0r@ge!' for 'administrator' Account

The account 'administrator' on the remote host has the default password 'St0r@ge!'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. var account = "administrator"; var password = "St0r@ge!";...

PT-2018-3026 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.15.8 Description: The issue is related to the fd locked ioctl function in the Linux kernel, specifically in the floppy driver. It allows an attacker to obtain a kernel pointer by sending the FDGETPRM ioctl,...

PT-2018-3977 · Foolabs +2 · Xpdf +2

Name of the Vulnerable Software and Affected Versions: xpdf version 4.00 Description: The issue is related to infinite recursion in the AcroForm::scanField function in AcroForm.cc, which can be exploited to launch a denial of service attack via a specific pdf file due to the lack of loop checking...

PT-2018-4061 · Elinks +2 · Elinks +2

Name of the Vulnerable Software and Affected Versions: ELinks version 0.12 Twibright Links version 2.3 Description: The issue is related to missing SSL certificate validation. Recommendations: For ELinks version 0.12, update to a version that includes proper SSL certificate validation. For...

Elastic Kibana Arbitrary Code Execution Vulnerability - Windows

Kibana version 6.1.0 had an arbitrary code execution vulnerability in the Math.js package SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2018-1443

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 28.0.0.161 Description The issue is related to a use-after-free vulnerability, which occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. This can allo...

Spectre Variant 2 (CVE 2017-5715) Branch Target Injection Update Disable (KB4078130)

This host is missing a critical update according to Microsoft KB4078130 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux/x86 - Disable ASLR Security + Obfuscated Shellcode (23 bytes)

Linux/x86 - Disable ASLR Security + Obfuscated Shellcode 23 bytes. Shellcode exploit for Linuxx86 platform ;Title : Linux/x86 - Disable ASLR Security obfuscated shellcode - 23 bytes ;Date : 24 Jan 2018 ;Author : 0xAlaufi ;Tested on : Linux/x86 Ubuntu 12.04.5 global start section .text start: jmp...

Linux/x86 - Disable ASLR Security + Obfuscated Shellcode (23 bytes)

;Title : Linux/x86 - Disable ASLR Security obfuscated shellcode - 23 bytes ;Date : 24 Jan 2018 ;Author : 0xAlaufi ;Tested on : Linux/x86 Ubuntu 12.04.5 global start section .text start: jmp zero2 zero18: mov al,0x4 jmp zero19 zero1a: mov al,0x6 jmp zero1b zeroc: push 0x72702f2f jmp zerod zero12:...

Linux/x86 - Disable Shadowing Shellcode (42 bytes)

include const char sc= "\x31\xdb" //xor ebx,ebx "\x8d\x43\x17" //LEA eax,ebx + 0x17 /LEA is FASTER than push and pop! "\x99" //cdq "\xcd\x80" //int 80 //setuid0 shouldn't returns -1 right? ; "\xb0\x0b" //mov al,0bh "\x52" //push edx /Termina la cadena con un 0 "\x68\x63\x6f\x6e\x76" //push dword...

PT-2018-16857 · Malwarebytes +1 · Malwarebytes Premium +1

Name of the Vulnerable Software and Affected Versions: Malwarebytes Premium version 3.3.1.2183 Description: The issue allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e018 in the driver file...

PT-2018-16852 · Malwarebytes +1 · Malwarebytes Premium +2

Name of the Vulnerable Software and Affected Versions: Malwarebytes Premium version 3.3.1.2183 Description: The issue allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e008 in the driver file...

Oracle Linux 6 : kernel (ELSA-2018-0008)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0008 advisory. - x86 specctrl: svm: specctrl at vmexit needs per-cpu areas functional Waiman Long 1519797 1519796 CVE-2017-5715 - x86 specctrl: Eliminate redundnat...

Fedora 26 : shellinabox (2017-1dc71e1acd)

Disable SSHv1 options. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenab...

CVE-2017-17476

Open Ticket Request System OTRS 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email...

Kibana 6.1.1 security update

Kibana arbitrary code execution issue ESA-2017-24 Kibana version 6.1.0 had an arbitrary code execution vulnerability in the Math.js package which is used by math aggregations in Time Series Visual Builder. Kibana users could construct a math aggregation capable of executing arbitrary code on the...

PT-2017-12914 · Bouncy Castle +1 · Bouncycastle Tls +1

Name of the Vulnerable Software and Affected Versions: BouncyCastle TLS versions prior to 1.0.3 Description: The issue provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated, allowing an attacker to recover the private key from a vulnerable applicatio...

PT-2017-4058 · Spring +2 · Spring +3

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.8.10 and earlier FasterXML jackson-databind versions 2.9.x through 2.9.3 Description: The issue allows for unauthenticated remote code execution due to an incomplete fix for a deserialization flaw. This c...