KONE KGC 4.6.4 DoS / Code Execution / LFI / Bypass

Vulnerabilities in KONEs Group Controller KGC ------------------------------------------------------------------------- Introduction ============ Vulnerabilities were identified in the KONE Group Controller KGC. These were discovered during a black box assessment and therefore the vulnerability...

KONE KGC 4.6.4 - Multiple Vulnerabilities

KONE KGC versions 4.6.4 and below suffer from unauthenticated remote code execution, denial of service, local file inclusion, and missing FTP access control vulnerabilities. Vulnerabilities in KONEs Group Controller KGC -------------------------------------------------------------------------...

Thousands of MikroTik Routers Hijacked for Eavesdropping

A full 7,500+ MikroTik routers are forwarding their owners’ traffic to eavesdropping cybercriminals – while 239,000 more have had their Socks4 proxy enabled, maliciously and surreptitiously. This means the bad actors can gain access to any of the files or data being passed by the router to and fr...

CVE-2018-16231

Michael Roth Software Personal FTP Server PFTP through 8.4f allows remote attackers to cause a denial of service daemon crash via an unspecified sequence of FTP commands...

CVE-2018-16231

Michael Roth Software Personal FTP Server PFTP through 8.4f allows remote attackers to cause a denial of service daemon crash via an unspecified sequence of FTP commands...

CVE-2018-16231

The CVE-2018-16231 entry concerns Michael Roth Software Personal FTP Server (PFTP) up to version 8.4f. The issue is a remote-denial-of-service that crashes the daemon via an unspecified sequence of FTP commands. The connected documents do not provide concrete technical details such as the exact v...

BusyGasper Malware Packs a Simple but Potent Punch

A small malware campaign is leveraging spyware called BusyGasper, which is highly effective at collecting data on Android phones and exfiltrating it. The malware is unsophisticated, but loaded with 100 uniquely implemented features ranging from device sensor listeners, motion detectors and the...

[slackware-security] libX11

New libX11 packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libX11-1.6.6-i586-1slack14.2.txz: Upgraded. This update fixes some security issues: Fixed crash on invalid reply...

Dell PowerScale OneFS FTP Detection

Binary data isilononefsftpdetect.nbin...

PT-2018-2192 · D Link · D-Link Central Wifimanager Cwm-100

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFiManager CWM-100 version 1.03 r0098 Description: The issue is related to the FTP service, which allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting in a Server-Side Request Forgery SSRF...

[SECURITY] Fedora 28 Update: libxml2-2.9.8-4.fc28

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

SUSE-SU-2018:2181-1 Recommended update for yast2-ftp-server

This update for yast2-ftp-server fixes the following issues: Feature update: fate321043: Added additional searchkeys to desktop file. Security issues fixed: - bsc921303: Drop SSLv2 and SSLv3 as it is dropped for security reason for vsftpd. Bug fixes: - bsc1041829: Do not modify value when Browse...

Service Bulletin 130: Updated File Naming Conventions for FTP

Abstract Direct this service bulletin to the persons at customer locations who are responsible for opening Problem Management Reports PMRs for the TPF products. This bulletin expands on information distributed in Service Bulletin 84: File Naming Conventions for FTP and Service Bulletin 112: New F...

Debian DSA-4259-1 : ruby2.3 - security update

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in incorrect processing of HTTP/FTP, directory traversal, command injection, unintended socket creation or information disclosure. This update also fixes several issues in RubyGems which could...

CVE-2018-10916

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server,...

CVE-2018-10916

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server,...

CVE-2018-10916

CVE-2018-10916 affects the FTP client lftp up to version 4.8.3, where remote file name sanitization can trigger removal of all files in the current working directory during reverse mirroring against a malicious FTP server. The issue is a local integrity risk stemming from improper handling of rem...

CVE-2018-10916

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server,...

CVE-2018-10916

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server,...

UBUNTU-CVE-2018-10916

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server,...