CVE-2018-17868

DASAN H660GW devices have Stored XSS in the Port Forwarding functionality...

CVE-2018-17867

The Port Forwarding functionality on DASAN H660GW devices allows remote attackers to execute arbitrary code via shell metacharacters in the cgi-bin/advnatvirsvr.asp Addr parameter aka the Local IP Address field...

CVE-2018-17867

The CVE-2018-17867 entry concerns DASAN H660GW devices, where the Port Forwarding functionality can be abused by remote attackers to execute arbitrary code via shell metacharacters in the cgi-bin/adv_nat_virsvr.asp Addr (Local IP Address) parameter. NVD data indicates a high-severity impact with ...

CVE-2018-17868

CVE-2018-17868 affects DASAN H660GW devices with a Stored XSS vulnerability in the Port Forwarding functionality. According to the connected records, the issue is a stored cross-site scripting flaw in the router’s web interface, enabling injection of malicious scripts via Port Forwarding settings...

Debian DLA-1500-2 : openssh regression update

The security update of OpenSSH announced as DLA 1500-1 introduced a bug in openssh-client: when X11 forwarding is enabled via system-wide configuration in sshconfig or via -X command line switch, but no DISPLAY is set, the client produces a 'DISPLAY 'null' invalid; disabling X11 forwarding'...

SUSE-SU-2018:2685-1 Security update for openssh

This update for openssh provides the following fixes: Security issues fixed: - CVE-2017-15906: Stricter checking of operations in read-only mode in sftp server bsc1065000. - CVE-2016-10012: Remove pre-auth compression support from the server to prevent possible cryptographic attacks bsc1016370. -...

spring-framework: Multipart content pollution

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application server A receives input from a remote client, and then uses that input to make a...

HackerOne: @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.

Hola amigos, First off, I know RFCs are annoying. Second of all, namespace attacks are a btch. With that out of the way, here is an Inti-bug that was discovered as a result of reading RFC2142 very carefully. Brief summary of RFC2142 RFC2142 defines a standard set of email addresses that cover...

Win-PortFwd - Powershell Script To Setup Windows Port Forwarding Using Native Netsh Client

Powershell script to setup windows port forwarding using native netsh client. Install: git clone https://github.com/deepzec/Win-PortFwd.git Usage: .\win-portfwd.ps1 or powershell.exe -noprofile -executionpolicy bypass -file .\win-portfwd.ps1 Note: This script require admin privileges to run, this...

Input validation

Atlassian Floodlight Atlassian Floodlight Controller version 1.2 and earlier versions contains a Denial of Service vulnerability in Forwarding module that can result in Improper type cast in Forwarding module allows remote attackers to cause a DoSthread crash.. This attack appear to be exploitabl...

CVE-2018-1000617

Atlassian Floodlight Atlassian Floodlight Controller version 1.2 and earlier versions contains a Denial of Service vulnerability in Forwarding module that can result in Improper type cast in Forwarding module allows remote attackers to cause a DoSthread crash.. This attack appear to be exploitabl...

CVE-2018-1000617

Atlassian Floodlight Atlassian Floodlight Controller version 1.2 and earlier versions contains a Denial of Service vulnerability in Forwarding module that can result in Improper type cast in Forwarding module allows remote attackers to cause a DoSthread crash.. This attack appear to be exploitabl...

CVE-2018-1000617

Atlassian Floodlight Atlassian Floodlight Controller version 1.2 and earlier versions contains a Denial of Service vulnerability in Forwarding module that can result in Improper type cast in Forwarding module allows remote attackers to cause a DoSthread crash.. This attack appear to be exploitabl...

CVE-2018-1000617

Atlassian Floodlight Controller versions 1.2 and earlier are affected by a Denial of Service in the Forwarding module due to an improper type cast. This remote, network-exploitable issue can cause thread crashes. The provided documents do not specify a remediation version or patch details.

Security update for Mozilla Thunderbird (moderate)

This update for Mozilla Thunderbird to version 52.9.0 fixes multiple issues. Security issues fixed, inherited from the Mozilla common code base MFSA 2018-16, bsc1098998: - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when using focus -...

F5 BIG-IP Denial of Service Vulnerability (CNVD-2018-17656)

The F5 BIG-IP Edge Gateway serves as an access solution that provides SSL VPN remote access, security, application acceleration and high availability for remote users. A denial of service vulnerability exists in F5 BIG-IP due to an excessive consumption of the target traffic management microkerne...

Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2016-2125, CVE-2016-2126)

Summary IBM Storwize V7000 Unified is shipped with Samba, for which a fix is available for security vulnerabilities. Vulnerability Details Samba is used in IBM Storwize V7000 Unified to enable file management and authentication services for Microsoft Windows environments. CVEID: CVE-2016-2125...

CVE-2017-16118

The CVE-2017-16118 entry concerns the forwarded module used by Express.js to parse the X-Forwarded-For header. A crafted input can trigger a regular expression denial of service (ReDoS), blocking the event loop and causing a denial of service. Connected sources corroborate a ReDoS issue in the fo...

VulnCheck KEV: CVE-2016-3225

The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application that forwards an authentication...

SingTel Backdoor Detection (ForgotDoor)

The remote SingTel router may be contain a backdoor. Certain SingTel routers had their administrative web interfaces port-forwarded to public-facing addresses by customer support after users requested customer service. Depending on the configuration, the router may require no credentials, default...