13938 matches found
CVE-2017-6142
Summary : CVE-2017-6142 affects F5 BIG-IP AFM. The early-access"user id" feature on BIG-IP AFM versions 13.0.0, 12.1.0–12.1.2, and 11.6.0–11.6.2 fails to validate the remote server’s identity due to incorrect X.509 certificate verification, enabling potential Man‑in‑the‑Middle attacks for Network...
Some Basic Rules for Securing Your IoT Stuff
Most readers here have likely heard or read various prognostications about the impending doom from the proliferation of poorly-secured "Internet of Things" or IoT devices. Loosely defined as any gadget or gizmo that connects to the Internet but which most consumers probably wouldn't begin to know...
BSA-2018-525
Security Advisory ID : BSA-2018-525 Component : Fabric OS Web GUI Revision : 1.0: Initial XSS vulnerabilities in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS FOS could allow remote unauthenticated attackers to execute arbitrary script code in...
ESF pfSense system_groupmanager.php Command Injection
A command injection vulnerability exists in the web console of the ESF pfSense firewall. The vulnerability is due to a failure on part of the application to properly parse input supplied to the members parameter in the systemgroupmanager.php script...
OWASP-Nettacker - Automated Penetration Testing Framework
OWASP Nettacker project is created to automate information gathering, vulnerability scanning and eventually generating a report for networks, including services, bugs, vulnerabilities, misconfigurations, and other information. This software will utilize TCP SYN, ACK, ICMP and many other protocols...
Adminer v4.3.1 Server Side Request Forgery Exploit
Exploit for multiple platform in category web applications + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ADMINER-UNAUTHENTICATED-SERVER-SIDE-REQUEST-FORGERY.txt + ISR: apparition security Vendor: ==============...
Juniper ScreenOS Information Disclosure Vulnerability (CNVD-2018-04211)
Juniper ScreenOS is a Juniper Networks operating system that runs in the NetScreen family of firewalls. A security vulnerability exists in Juniper ScreenOS version 6.3.0r25, which arises from the program's failure to zero-pad Ethernet packets. An attacker could exploit the vulnerability to obtain...
CVE-2017-18014
An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page Control Center - Log Viewer - in the filter option "Web Server Protection" in the webadmin...
CVE-2017-18014
An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page Control Center - Log Viewer - in the filter option "Web Server Protection" in the webadmin...
Cross site scripting
An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page Control Center - Log Viewer - in the filter option "Web Server Protection" in the webadmin...
CVE-2017-18014
An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page Control Center - Log Viewer - in the filter option "Web Server Protection" in the webadmin...
CVE-2017-18014
Summary: CVE-2017-18014 affects Sophos XG Firewall with SFOS before 17.0.3 MR3. The vulnerability is a persistent XSS in the WAF log page (Control Center → Log Viewer → filter “Web Server Protection”) that is triggered by the HTTP POST User-Agent parameter. It is exploitable by an unauthenticated...
Warning: New Undetectable DNS Hijacking Malware Targeting Apple macOS Users
A security researcher has revealed details of a new piece of undetectable malware targeting Apple's Mac computers—reportedly first macOS malware of 2018. Dubbed OSX/MaMi, an unsigned Mach-O 64-bit executable, the malware is somewhat similar to DNSChanger malware that infected millions of computer...
Juniper SRX series Junos OS security bypass vulnerability
Juniper SRX Series is an SRX Series firewall appliance from Juniper Networks, Inc. Junos is the operating system that runs on it. A security vulnerability exists in Juniper SRX series in Junos OS 12.1X46-D71 prior to version 12.1X46, which stems from a firewall rule that is configured to match...
Sophos XG Firewall SFOS Logging Subsystem Cross-Site Scripting Vulnerability
Sophos XG Firewall is a firewall appliance from Sophos UK.SFOS is the operating system that runs on it.Logging subsystem is one of the logging subsystems. A cross-site scripting vulnerability exists in the WAF log page of the webadmin interface of the Logging subsystem in SFOS versions prior to...
Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access(CVE-2017-18014)
Vulnerability Summary The following advisory describes an unauthenticated persistent XSS that leads to unauthorized root access found in Sophos XG version 17. Sophos XG Firewall “provides unprecedented visibility into your network, users, and applications directly from the all-new control center...
Juniper Networks Releases Security Updates
Juniper Networks has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review the following Juniper Security Advisori...
CVE-2018-0009
On Juniper Networks SRX series devices, firewall rules configured to match custom application UUIDs starting with zeros can match all TCP traffic. Due to this issue, traffic that should have been blocked by other rules is permitted to flow through the device resulting in a firewall bypass...
CVE-2018-0009
On Juniper Networks SRX series devices, firewall rules configured to match custom application UUIDs starting with zeros can match all TCP traffic. Due to this issue, traffic that should have been blocked by other rules is permitted to flow through the device resulting in a firewall bypass...
Race condition
On Juniper Networks SRX series devices, firewall rules configured to match custom application UUIDs starting with zeros can match all TCP traffic. Due to this issue, traffic that should have been blocked by other rules is permitted to flow through the device resulting in a firewall bypass...