[slackware-security] openvpn

New openvpn packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/openvpn-2.3.17-i586-1slack14.2.txz: Upgraded. This update fixes several denial of service issues...

Man-in-the-Middle (MitM) Through Insecure Binary Downloads

ruby-gpgme is vulnerable to man-in-the-middle attacks. The vulnerability exists because the library downloads binary resources via FTP. Also, the issue may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

[SECURITY] Fedora 26 Update: mingw-curl-7.54.1-1.fc26

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

Sophos Web Appliance < 4.3.2 FTP Redirect Page Reflected XSS

According to its self-reported version number, the Sophos Web Appliance software running on the remote host is prior to 4.3.2. It is, therefore, affected by a reflected cross-site scripting XSS vulnerability in the FTP redirect page ftpredirect.php due to improper validation of user-supplied inpu...

Foscam C1 Webcam FTP Hard Coded Password Vulnerability

Summary Hard-coded FTP credentials r:r are included in the Foscam C1 running firmware 1.9.1.12. Knowledge of these credentials would allow remote access to any cameras found on the internet that do not have port 50021 blocked by an intermediate device. Tested Versions Foscam C1 Firmware Version...

Foscam IP Video Camera CGIProxy.fcgi FTP Startup Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters resulting in command injection...

formular.games-academy-ftp.de XSS vulnerability

Vulnerable URL: http://formular.games-academy-ftp.de/info.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

Easy File Sharing HTTP Server 7.2 - POST Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Easy File Sharing HTTP Server 7.2 POST Buffer Overflow', 'Description' = %q This module exploits a POST buffer overflow in the Easy File Sharing F...

CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

Mikrotik RouterOS 6.39.2 FTP CWD Buffer Overflow

import time,sys import socket from ftplib import FTP mikrotik RouterOS v6.39.2 FTp buffer cwd command sultan albalawi if lensys.argv "' print 'Example: 192.168.1.1 21 admin admin' sys.exit1 def myB: print "\x27\x27\x27\x0d\x0a\x20\x20\x20\x20\x20" \ "\x20\x20\x5c\x20\x20\x20\x2d\x20\x20\x2d\x20" ...

Sophos Web Appliance < 4.3.0 FTP Redirect Page Reflected XSS

According to its self-reported version number, the Sophos Web Appliance software running on the remote host is prior to 4.3.0. It is, therefore, affected by a reflected cross-site scripting XSS vulnerability in the FTP redirect page ftpredirect.php due to improper validation of user-supplied inpu...

[slackware-security] bind

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/bind-9.10.5P1-i586-1slack14.2.txz: Upgraded. Fixed denial of service security issue: Some RPZ...

[SECURITY] Fedora 26 Update: wget-1.19.1-3.fc26

GNU Wget is a file retrieval utility which can use either the HTTP or FTP protocols. Wget features include the ability to work in the background while you are logged out, recursive retrieval of directories, file name wildcard matching, remote file timestamp storage and comparison, use of Rest wit...

Design/Logic Flaw

The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342...

CVE-2017-9523

The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342...

CVE-2017-9523

The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342...

CVE-2017-9523

The vulnerability CVE-2017-9523 affects Sophos Web Appliance prior to 4.3.2. It is a reflected cross-site scripting (XSS) issue in the FTP redirect page (ftp_redirect.php) caused by improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this via crafted reques...

CVE-2017-9523

The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342...

EulerOS 2.0 SP2 : java-1.7.0-openjdk (EulerOS-SA-2017-1099)

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2017-835)

An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. CVE-2017-3511 It was found that the JAXP component of...