JVN#70380788: BASP21 vulnerable to mail header injection

BASP21 provided by B21Soft, Inc. contains a mail header injection vulnerability. Impact The header of an email created by BASP21 to be sent from a web application mail form may be altered by an unauthenticated remote attacker. As a result, an unintended email may be sent or a denial-of-service Do...

Cisco Webex Player T29.10 - .ARF Out-of-Bounds Memory Corruption

Cisco Webex Player T29.10 - .ARF Out-of-Bounds Memory Corruption Application: Cisco Webex Player Platforms: Windows Versions: Cisco Webex Meeting Player version T29.10 Author: Francis Provencher of COSIG Website: https://cosig.gouv.qc.ca/en/advisory/ Twitter: @COSIG Date: August 31, 2016 CVE:...

Cisco Webex Player T29.10 - '.ARF' Out-of-Bounds Memory Corruption

Application: Cisco Webex Player Platforms: Windows Versions: Cisco Webex Meeting Player version T29.10 Author: Francis Provencher of COSIG Website: https://cosig.gouv.qc.ca/en/advisory/ Twitter: @COSIG Date: August 31, 2016 CVE: CVE-2016-1415 COSIG-2016-34 1 Introduction 2 Report Timeline 3...

Cisco Webex Player T29.10 - '.WRF' Use-After-Free Memory Corruption

Application: Cisco Webex Player Platforms: Windows Versions: Cisco Webex Meeting Player version T29.10 Author: Francis Provencher of COSIG Website: https://cosig.gouv.qc.ca/en/advisory/ Twitter: @COSIG Date: August 31, 2016 CVE: CVE-2016-1464 COSIG-2016-33 1 Introduction 2 Report Timeline 3...

Cisco Firepower Threat Management Console 6.0.1 - Hard-Coded MySQL Credentials Vulnerability

Exploit for linux platform in category local exploits Cisco Firepower Threat Management Console Hard-coded MySQL Credentials Title: Cisco Firepower Threat Management Console Hard-coded MySQL Credentials Advisory ID: KL-001-2016-005 Publication Date: 2016.10.05 Publication URL:...

Cisco Firepower Threat Management Console 6.0.1 - Remote Command Execution

KL-001-2016-007 : Cisco Firepower Threat Management Console Remote Command Execution Leading to Root Access Title: Cisco Firepower Threat Management Console Remote Command Execution Leading to Root Access Advisory ID: KL-001-2016-007 Publication Date: 2016.10.05 Publication URL:...

Cisco Firepower Threat Management Console 6.0.1 - Local File Inclusion

Cisco Firepower Threat Management Console 6.0.1 - Local File Inclusion KL-001-2016-006 : Cisco Firepower Threat Management Console Local File Inclusion Title: Cisco Firepower Threat Management Console Local File Inclusion Advisory ID: KL-001-2016-006 Publication Date: 2016.10.05 Publication URL:...

Cisco Firepower Threat Management Console Remote Command Execution Leading to Root Access

Vulnerability Details Affected Vendor: Cisco Affected Product: Firepower Threat Management Console Affected Version: Cisco Fire Linux OS 6.0.1 build 37/build 1213 Platform: Embedded Linux CWE Classification: CWE-434: Unrestricted Upload of File with Dangerous Type, CWE-94: Improper Control of...

Ubiquiti Inc.: Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com

Summary This is not a standard vulnerability, but a chain of two more exotic vulnerabilities leading to a full authentication bypass of your SSO login system at sso.ubnt.com via account.ubnt.com. The root cause of this authentication bypass is two-fold: 1. Subdomain ping.ubnt.com was pointing to...

OWOX, Inc.: HTTP Response Splitting(CRLF injection) in bi.owox.com

Hello, I found a CRLF injection vulnerability in bi.owox.com More about HTTP response splitting https://www.owasp.org/index.php/TestingforHTTPSplitting/SmugglingOTG-INPVAL-016 POC Burp Adding a new header with %0d%0a F122461 Regards, Florin...

Vulnerability in OpenSSL - OCSP Status Request extension unbounded memory growth

A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service...

Vulnerability in OpenSSL - Excessive allocation of memory in dtls1_preprocess_fragment()

A DTLS message includes 3 bytes for its length in the header for the message. This would allow for messages up to 16Mb in length. Messages of this length are excessive and OpenSSL includes a check to ensure that a peer is sending reasonably sized messages in order to avoid too much memory being...

Vulnerability in OpenSSL - Certificate message OOB reads

In OpenSSL 1.0.2 and earlier some missing message length checks can result in OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical DoS risk but this has not been observed in practice on common platforms. The messages affected are client certificate, client certificate...

Vulnerability in OpenSSL - Excessive allocation of memory in tls_get_message_header()

A TLS message includes 3 bytes for its length in the header for the message. This would allow for messages up to 16Mb in length. Messages of this length are excessive and OpenSSL includes a check to ensure that a peer is sending reasonably sized messages in order to avoid too much memory being...

Ubuntu 12.04 LTS : linux vulnerability (USN-3082-1)

Chiachih Wu, Yuan-Tsung Lo, and Xuxian Jiang discovered that the legacy ABI for ARM OABI had incomplete access checks for epollwait2 and semtimedop2. A local attacker could use this to possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description bloc...

JVN#49343562: Money Forward Apps for Android vulnerability that allows unintended operations

Money Forward Apps for Android contain a vulnerability where unintended operations may be performed. Impact When a user executes a malicious application, it may perform an unintended operation. Solution Update the Application Update to the latest version according to the information provided by t...

Cisco ASA 9.2(3) - 'EXTRABACON' Authentication Bypass

Exploit for hardware platform in category remote exploits Cisco ASA 9.23 Authentication Bypass EXTRABACON Module Copyright: c 2016 RiskSense, Inc. https://risksense.com License: http://opensource.org/licenses/MIT Release Date: September 15, 2016 Authors: Sean Dillon...

Cisco ASA 9.2(3) - EXTRABACON Authentication Bypass

Cisco ASA 9.23 - EXTRABACON Authentication Bypass Cisco ASA 9.23 Authentication Bypass EXTRABACON Module Copyright: c 2016 RiskSense, Inc. https://risksense.com License: http://opensource.org/licenses/MIT Release Date: September 15, 2016 Authors: Sean Dillon 2E3C8D72353C9B8C9FF797E753EC4C9876D572...

Cisco ASA 9.2(3) EXTRABACON Module / Authentication Bypass

Cisco ASA 9.23 Authentication Bypass EXTRABACON Module Copyright: c 2016 RiskSense, Inc. https://risksense.com License: http://opensource.org/licenses/MIT Release Date: September 15, 2016 Authors: Sean Dillon 2E3C8D72353C9B8C9FF797E753EC4C9876D5727B Zachary Harding...

MS16-105: Cumulative Security Update for Microsoft Edge (3183043)

The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3183043. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these...