733 matches found
SET v7.7 - The Social-Engineer Toolkit “Blackout”
The Social-Engineer Toolkit SET was created and written by the founder of TrustedSec. It is an open-source Python-driven tool aimed at penetration testing around Social-Engineering. SET has been presented at large-scale conferences including Blackhat, DerbyCon, Defcon, and ShmooCon. With over two...
Linux Gather TOR Hidden Services
This module collects the hostnames name and private keys of any TOR Hidden Services running on the target machine. It will search for torrc and if found, will parse it for the directories of Hidden Services. However, root permissions are required to read them as they are owned by the user that TO...
DEBIAN-CVE-2017-7938
Stack-based buffer overflow in DMitry Deepmagic Information Gathering Tool version 1.3a Unix allows attackers to cause a denial of service application crash or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname string...
New Clues Surface on Shamoon 2's Destructive Behavior
Researchers on Monday reported progress in piecing together some of the missing pieces of the Shamoon 2 puzzle that have been eluding them when it comes to lateral network movement and execution of the Disttrack malware component used in past campaigns. Shamoon 2 uses a combination of legitimate...
USN-3143-1 c-ares vulnerability
Gzob Qq discovered that c-ares incorrectly handled certain hostnames. A remote attacker could use this issue to cause applications using c-ares to crash, resulting in a denial of service, or possibly execute arbitrary code...
Tenda/Dlink/Tplink TD-W8961ND - 'DHCP' Cross-Site Scripting
Document Title: =============== Tenda, Dlink & Tplink TD-W8961ND - DHCP XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1990 Release Date: ============= 2016-11-28 Vulnerability Laboratory ID VL-ID: ====================================...
Tenda / D-Link / TP-Link DHCP Cross Site Scripting
Document Title: =============== Tenda, Dlink & Tplink TD-W8961ND - DHCP XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1990 Release Date: ============= 2016-11-28 Vulnerability Laboratory ID VL-ID: ====================================...
Tenda, Dlink & Tplink TD-W8961ND - DHCP XSS Vulnerability
Document Title: =============== Tenda, Dlink & Tplink TD-W8961ND - DHCP XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1990 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20372...
SUSE SLED12 / SLES12 Security Update : bash (SUSE-SU-2016:2872-1) (Shellshock)
This update for bash fixes the following issues : - CVE-2016-7543: Local attackers could have executed arbitrary commands via specially crafted SHELLOPTS+PS4 variables bsc1001299 - CVE-2016-0634: Malicious hostnames could have allowed arbitrary command execution when $HOSTNAME was expanded in the...
Design/Logic Flaw
The ssl.matchhostname function in CPython aka Python before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate...
CVE-2013-7440
The ssl.matchhostname function in CPython aka Python before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate...
CVE-2013-7440
Removed by vendor...
DNS reconnaissance tool: Fierce
Fierce is a DNS reconnaissance tool for locating non-contiguous IP space Fierce is a semi-lightweight scanner that helps locate non-contiguous IP space and hostnames against specified domains. It’s really meant as a pre-cursor to nmap, unicornscan, nessus, nikto, etc, since all of those require...
Mozilla: Trailing whitespace in IP address hostnames can bypass same-origin policy (MFSA 2015-122)
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin, and conduct cross-site scripting XSS attacks, by appending whitespace characters to an IP address string...
UBUNTU-CVE-2015-7195
The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in hostnames within Location headers, which allows remote attackers to obtain sensitive information via vectors involving a redirect...
Certain escaped characters in host of Location-header are being treated as non-escaped — Mozilla
Security researcher Frans Rosén reported that URLs with certain escaped characters in hostnames are parsed incorrectly. This leads to parsing being abandoned when an effected escaped character is encountered followed by a navigation to the previously parsed version of the URL. When combined with ...
PT-2015-6835
Name of the Vulnerable Software and Affected Versions PolarSSL versions 1.x through 1.2.16 ARM mbed TLS formerly PolarSSL versions 1.3.x through 1.3.13 ARM mbed TLS formerly PolarSSL versions 2.x through 2.1.1 Description A heap-based buffer overflow issue exists, allowing remote SSL servers to...
CVE-2015-1269
The DecodeHSTSPreloadRaw function in net/http/transportsecuritystate.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string...
Design/Logic Flaw
The DecodeHSTSPreloadRaw function in net/http/transportsecuritystate.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string...
CVE-2015-1269
CVE-2015-1269 affects Google Chrome and related Chromium-based packages. The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc failed to canonicalize DNS hostnames before comparing against HSTS/HPKP preload entries, enabling bypass of access restrictions via hostnames that end...