Race condition

Race condition in the SSL implementation on Cisco Intrusion Prevention System IPS devices allows remote attackers to cause a denial of service by making many management-interface HTTPS connections during the key-regeneration phase of an upgrade, aka Bug ID CSCui25688...

CVE-2015-0631

Cisco IPS CVE-2015-0631 is a race-condition vulnerability in the SSL/TLS subsystem used by the web management interface. During image upgrading, key/certificate regeneration can be disrupted by a rapid sequence of HTTPS connections to the management interface, allowing a remote attacker to cause ...

CVE-2015-0631

Race condition in the SSL implementation on Cisco Intrusion Prevention System IPS devices allows remote attackers to cause a denial of service by making many management-interface HTTPS connections during the key-regeneration phase of an upgrade, aka Bug ID CSCui25688...

PT-2015-4771

Name of the Vulnerable Software and Affected Versions Cisco Intrusion Prevention System IPS devices affected versions not specified Description A race condition exists in the SSL implementation, allowing remote attackers to cause a denial of service by making many management-interface HTTPS...

DNS Enumeration Script: DNSRecon

DNS reconnaissance is part of the information gathering stage on a penetration test engagement. When a penetration tester is performing a DNS reconnaissance he is trying to obtain as much information as he can regarding the DNS servers and their records. The information that can be gathered can...

Adobe Flash CVE-2 0 1 5-0 3 1 3 new 0day-vulnerability warning-the black bar safety net

In the Adobe Flash Player newly discovered a high risk vulnerability, hackers can take advantage of its large-scale forced-by downloaddrive-by downloadattacks, also known as the“website hanging horse attack”, when you're viewing contains a malicious code of a web page or to access the AD, it will...

Marketo Cloud - Persistent Mail Encoding Vulnerability

Document Title: =============== Marketo Cloud - Persistent Mail Encoding Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1321 Release Date: ============= 2015-01-13 Vulnerability Laboratory ID VL-ID: ==================================== 132...

Symantec Web Gateway OS Authenticated Command Injection

SUMMARY Symantec's Web Gateway SWG Appliance management console is susceptible to operating system command injection by an authenticated but less-privileged user. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec Web Gateway Appliance | 5.2.1 and prior | Symantec Web Gateway 5.2...

Snort 3.0 - Network intrusion prevention and detection system (IDS/IPS)

Snort is the most powerful IPS in the world, setting the standard for intrusion detection. So when we started thinking about what the next generation of IPS looked like we started from scratch. Features Support multiple packet processing threads Shared configuration and attribute table Use a...

Sql injection

SQL injection vulnerability in the IPS Connect service interface/ipsconnect/ipsconnect.php in Invision Power Board aka IPB or IP.Board 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2014-9239

SQL injection vulnerability in the IPS Connect service interface/ipsconnect/ipsconnect.php in Invision Power Board aka IPB or IP.Board 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2014-9239

This CVE refers to a SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) of Invision Power Board (IPB/IP.Board) 3.3.x and 3.4.x up to 3.4.7, exploitable via the id[] parameter. The underlying issue allows remote attackers to execute arbitrary SQL commands....

CVE-2014-9239: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the IPS Connect service interface/ipsconnect/ipsconnect.php in Invision Power Board aka IPB or IP.Board 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id parameter...

PT-2014-8894

Name of the Vulnerable Software and Affected Versions Invision Power Board versions 3.3.x through 3.4.7 Description The issue allows remote attackers to execute arbitrary SQL commands via the id parameter in the IPS Connect service, located at the "interface/ipsconnect/ipsconnect.php" endpoint...

Malformed PDF Version Header

PDF files may include a malformed version header. A remote attacker may use such a header inside PDF files to evade IPS inspection, in order to avoid detection of attacks against various PDF vulnerabilities...

CVE-2014-9002: Undefined Security Weakness

Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary commands via the c parameter in an rpc action...

CVE-2014-8952: Undefined Security Weakness

Multiple unspecified vulnerabilities in Check Point Security Gateway R75.40VS, R75.45, R75.46, R75.47, R76, R77, and R77.10, when the 1 IPS blade, 2 IPsec Remote Access, 3 Mobile Access / SSL VPN blade, 4 SSL Network Extender, 5 Identify Awareness blade, 6 HTTPS Inspection, 7 UserCheck, or 8 Data...

PT-2014-2015

Name of the Vulnerable Software and Affected Versions Check Point Security Gateway versions R75.40VS through R77.10 Description The issue is related to multiple unspecified vulnerabilities in Check Point Security Gateway when certain blade modules are enabled, such as the IPS blade, IPsec Remote...

JavaScript Percent-Encoding Obfuscation

Although various security products provide coverage against many web vulnerabilities, such as ActiveX exploits, these known exploits could potentially bypass security products by using JavaScript obfuscation techniques.An example of such a technique is percent-encoding, also known as URL encoding...

SSL 3.0 MITM Attack

A vulnerability affecting most implementations of SSL 3.0 has been discovered that allows an attacker to decrypt some encrypted contents under certain conditions CVE-2014-3566. The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak...