pfSense < 2.3.3 Multiple Vulnerabilities (SA-17_01 - SA-17_03)

According to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106503; scriptversion"1.12"; scriptcvsdate"Date: 2019/11/08...

pfSense < 2.3.1-p5 Multiple Vulnerabilities (SA-16_07 / SA-16_08)

According to its self-reported version number, the remote pfSense install is prior to 2.3.1-p5. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106502;...

pfSense < 2.3.1 Multiple Vulnerabilities (SA-16_03 / SA-16-04)

According to its self-reported version number, the remote pfSense install is prior to 2.3.1. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106500; scriptversion"1.12";...

pfSense < 2.1.4 Multiple Vulnerabilities (SA-14_08 - SA-14_12)

According to its self-reported version number, the remote pfSense install is prior to 2.1.4. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106490; scriptversion"1.5"; scriptcvsdate"Date: 2019/04/05 23:25:05";...

pfSense < 2.3.4-p1 Multiple Vulnerabilities (SA-17_05 / SA-17_06)

According to its self-reported version number, the remote pfSense install is prior to 2.3.4-p1. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106505;...

pfSense < 2.2.1 Multiple Vulnerabilities (SA-15_02 - SA-15_04)

According to its self-reported version number, the remote pfSense install is prior to 2.2.1. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106493; scriptversion"1.7...

pfSense < 2.2.3 Multiple Vulnerabilities (SA-15_07) (Logjam)

According to its self-reported version number, the remote pfSense install is prior to 2.2.3. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106495;...

pfSense < 2.3.1-p1 Multiple Vulnerabilities (SA-16_05)

According to its self-reported version number, the remote pfSense install is prior to 2.3.1-p1. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106501;...

coTURN server unsafe telnet admin portal default configuration vulnerability

Summary An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server...

coTURN TURN server unsafe loopback forwarding default configuration vulnerability

Summary An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running o...

Trend Micro Threat Discovery Appliance 2.6.1062r1 Remote Code Execution Exploit

Exploit for linux platform in category remote exploits !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance /opt/TrendMicro/MinorityReport/bin/ Then, all we do is create /engptnstores/prod/sensorSDK/data/si/dlpkill.sh with malicious code and get it executed... Notes: ====== - For thi...

Trend Micro Threat Discovery Appliance 2.6.1062r1 - 'dlp_policy_upload.cgi' Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance /opt/TrendMicro/MinorityReport/bin/ Then, all we do is create /engptnstores/prod/sensorSDK/data/si/dlpkill.sh with malicious code and get it executed... Notes: ====== - For this particular PoC, all I did was exec a bind shell using...

Juniper Junos Custom Application UUID Rule Handling Remote Firewall Bypass Vulnerability (JSA10836)

According to its self-reported version number, the remote Junos device is affected by a firewall bypass vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106393; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/04/22";...

F5 BIG-IP Advanced Firewall Manager Man-in-the-Middle Attack Vulnerability

F5 BIG-IP Advanced Firewall Manager AFM is a firewall manager from F5 USA that scales to stop high-volume DDoS attacks that can overwhelm load balancers, firewalls, and even networks.The Configuration utility... A security vulnerability exists in the early access "user id" feature in F5 BIG-IP AF...

Code injection

X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 12.1.0-12.1.2, and 11.6.0-11.6.2, and thus did not properly validate the remote server's identity on certain versions of BIG-IP...

CVE-2017-6142

X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 12.1.0-12.1.2, and 11.6.0-11.6.2, and thus did not properly validate the remote server's identity on certain versions of BIG-IP...

CVE-2017-6142

Summary : CVE-2017-6142 affects F5 BIG-IP AFM. The early-access"user id" feature on BIG-IP AFM versions 13.0.0, 12.1.0–12.1.2, and 11.6.0–11.6.2 fails to validate the remote server’s identity due to incorrect X.509 certificate verification, enabling potential Man‑in‑the‑Middle attacks for Network...

CVE-2017-6142: Improper Certificate Validation

X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 12.1.0-12.1.2, and 11.6.0-11.6.2, and thus did not properly validate the remote server's identity on certain versions of BIG-IP...

Some Basic Rules for Securing Your IoT Stuff

Most readers here have likely heard or read various prognostications about the impending doom from the proliferation of poorly-secured "Internet of Things" or IoT devices. Loosely defined as any gadget or gizmo that connects to the Internet but which most consumers probably wouldn't begin to know...

BSA-2018-525

Security Advisory ID : BSA-2018-525 Component : Fabric OS Web GUI Revision : 1.0: Initial XSS vulnerabilities in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS FOS could allow remote unauthenticated attackers to execute arbitrary script code in...