CVE-2016-7399

scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense...

Error: "Profile Installation Failed A Network Error Has Occurred" during XenMobile iOS Enrollment

XenMobile iOS enrollment getting error "Profile Installation Failed A network error has occurred" iOS console logs show: Xens-iPhone profiled148 : Error MC: URL request to https://mdmxms.domain.net:8443/zdm/scep/sp-078435ec-0aed-4ba0-bb3d-be665934be12?operation=GetCACert&message=APPLEPROFILE...

c-ares: Single byte out of buffer write

A vulnerability was found in c-ares. A hostname with an escaped trailing dot such as "hello." would have its size calculated incorrectly, leading to a single byte written beyond the end of a buffer on the heap. An attacker able to provide such a hostname to an application using c-ares, could...

CVE-2016-10197

The searchmakenew function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service out-of-bounds read via an empty hostname...

UBUNTU-CVE-2016-10197

The searchmakenew function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service out-of-bounds read via an empty hostname...

Win CE Schannel cert name out of buffer read

curl's TLS server certificate checks are flawed on Windows CE. This vulnerability occurs in the verify certificate function when comparing a wildcard certificate name as returned by the Windows API function CertGetNameString to the hostname used to make the connection to the server. The pattern...

Secure Web unable to access Internal Links with Split Tunnel set to ON via NetScaler Gateway

While trying to access Internal Links or external links with Split Tunnel ON, gets error message as: 'Could not find hostname'...

GLSA-201612-39 : Bash: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201612-39 Bash: Arbitrary code execution A vulnerability was found in the way Bash expands $HOSTNAME. Injecting malicious code into $HOSTNAME could cause it to run each time Bash expands \h in the prompt string. Impact : A remote...

NETGEAR R7000 - Cross-Site Scripting

NETGEAR R7000 - Cross-Site Scripting Exploit Title: Netgear R7000 - XSS via. DHCP hostname Date: 11-12-2016 Exploit Author: Vincent Yiu Contact: https://twitter.com/vysecurity Vendor Homepage: https://www.netgear.com/ Category: Hardware / WebApp Version: V1.0.7.21.1.93 + LATEST to date...

Tenda/Dlink/TP-LINK TD-W8961ND 'DHCP' Cross-Site Scripting Vulnerability

Tenda/Dlink/TP-LINK are all line router manufacturers that have released numerous models of router products. A cross-site scripting vulnerability exists in Tenda/Dlink/TP-LINK TD-W8961ND 'DHCP'. Allows an attacker to inject malicious script code on the application side to manipulate the router dh...

SUSE SLED12 / SLES12 Security Update : bash (SUSE-SU-2016:2872-1) (Shellshock)

This update for bash fixes the following issues : - CVE-2016-7543: Local attackers could have executed arbitrary commands via specially crafted SHELLOPTS+PS4 variables bsc1001299 - CVE-2016-0634: Malicious hostnames could have allowed arbitrary command execution when $HOSTNAME was expanded in the...

SUSE-SU-2016:2872-1 Security update for bash

This update for bash fixes the following issues: - CVE-2016-7543: Local attackers could have executed arbitrary commands via specially crafted SHELLOPTS+PS4 variables bsc1001299 - CVE-2016-0634: Malicious hostnames could have allowed arbitrary command execution when $HOSTNAME was expanded in the...

Hostname Detection via SMB

Binary data 7238.pasl...

RUSTSEC-2016-0001 SSL/TLS MitM vulnerability due to insecure defaults

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks...

SSL/TLS MitM vulnerability due to insecure defaults

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks...

PT-2016-4587 · Openssl · Rust-Openssl

Name of the Vulnerable Software and Affected Versions: rust-openssl versions prior to 0.9.0 Description: The issue is related to SSL/TLS man-in-the-middle attacks due to insecure defaults in the openssl crate for Rust. Specifically, certificate verification is off by default, and there is no API...

SUSE SLES11 Security Update : bind (SUSE-SU-2016:2706-1)

This update for bind fixes the following issues : - A defect in BIND's handling of responses containing a DNAME answer had the potential to trigger assertion errors in the server remotely, thereby facilitating a denial-of-service attack. CVE-2016-8864, bsc1007829. - Fix BIND to return a valid...

SUSE-SU-2016:2706-1 Security update for bind

This update for bind fixes the following issues: - A defect in BIND's handling of responses containing a DNAME answer had the potential to trigger assertion errors in the server remotely, thereby facilitating a denial-of-service attack. CVE-2016-8864, bsc1007829. - Fix BIND to return a valid...

SUSE-SU-2016:2697-2 Security update for bind

This update for bind fixes the following issues: - A defect in BIND's handling of responses containing a DNAME answer had the potential to trigger assertion errors in the server remotely, thereby facilitating a denial-of-service attack. CVE-2016-8864, bsc1007829. - Fix BIND to return a valid...

CURL-CVE-2016-8625 IDNA 2003 makes curl use wrong host

When curl is built with libidn to handle International Domain Names IDNA, it translates them to puny code for DNS resolving using the IDNA 2003 standard, while IDNA 2008 is the modern and up-to-date IDNA standard. This misalignment causes problems with for example domains using the German ß...