CVE-2017-3854

A vulnerability in the mesh code of Cisco Wireless LAN Controller WLC software could allow an unauthenticated, remote attacker to impersonate a WLC in a meshed topology. The vulnerability is due to insufficient authentication of the parent access point in a mesh configuration. An attacker could...

CVE-2017-3831

The CVE-2017-3831 issue affects Cisco Mobility Express 1800 Series Access Points. It is an authentication bypass in the web-based GUI that could allow an unauthenticated, remote attacker to gain full administrator privileges by sending a crafted HTTP request to the GUI. Root cause: improper imple...

Protecting Your Web Apps with AppSpider Defend Until They Can Be Patched

AppSpider scans can detect exploitable vulnerabilities in your applications, but once these vulnerabilities are detected how long does it take your development teams to create code fixes for them? In some cases it could take several days to weeks before a fix/patch to resolve the vulnerability ca...

amigo-browser.ru XSS vulnerability

Vulnerable URL: http://amigo-browser.ru/dkit-hps/?chid=12930partnerid=dse.1:812270,dse.2:812274,hp.1:812269,hp.2:812273,pult.1:812271,pult.2:812275,any.2:812272,any:812268=fDrYpMqTUQ=818068=hdclub"alert/OPENBUGBOUNTY/...

The vulnerabilities in iOS and Mac OS X operating systems allow attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the IDS-Connectivity component for iOS and Mac OS X is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack by using notifications regarding network connection changes...

Race condition

A vulnerability in the Stream Control Transmission Protocol SCTP decoder of the Cisco NetFlow Generation Appliance NGA with software before 1.11a could allow an unauthenticated, remote attacker to cause the device to hang or unexpectedly reload, causing a denial of service DoS condition. The...

CVE-2017-3826

Cisco NetFlow Generation Appliances NGA 3140, NGA 3240, and NGA 3340 contain a DoS vulnerability in the SCTP decoder due to incomplete validation of SCTP packets on monitored data ports. An unauthenticated remote attacker can cause the device to hang or reload by sending malformed SCTP packets; p...

cics-info NSE Script

Using the CICS transaction CEMT, this script attempts to gather information about the current CICS transaction server region. It gathers OS information, Datasets files, transactions and user ids. Based on CICSpwn script by Ayoub ELAASSAL. Script Arguments cics-info.trans Instead of gathering all...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none...

CVE-2016-4721

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the "IDS - Connectivity" component, which allows man-in-the-middle attackers to spoof calls via a "switch caller" notification...

CVE-2016-4721

CVE-2016-4721 affects Apple’s IDS - Connectivity component on iOS < 10.1 and macOS

DEBIAN-CVE-2016-10134

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggleids array parameter in latest.php...

UBUNTU-CVE-2016-10134

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggleids array parameter in latest.php...

SQL Injection Vulnerability in Ocean CMS zyapi.php Page

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the Ocean CMS zyapi.php page. The lack of filtering of the '$ids' parameter allows attackers to exploit the vulnerability to obtain sensitive information about the database...

CVE-2017-3801

Cisco UCS Director privilege escalation (CVE-2017-3801) affects the web-based GUI in Cisco UCS Director 6.0.0.0 and 6.0.0.1. The root cause is improper RBAC after enabling the Developer Menu, enabling an authenticated, local user with an end-user profile to add catalogs containing arbitrary workf...

Information disclosure

A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...

CVE-2017-3813

A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...

CVE-2017-3807

CVE-2017-3807 is a heap overflow vulnerability in Cisco ASA Software’s Clientless SSL VPN CIFS code, affecting ASA 5500 Series, 5500-X Series, ASAv, and related platforms (releases 9.0–9.6). The root cause is insufficient validation of user-supplied input, exploitable via a crafted URL over IPv4/...

CVE-2016-9244

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer SSL session IDs from other sessions. It is possible...