1431 matches found
CVE-2019-10627
CVE-2019-10627 is an integer overflow to buffer overflow in PostScript image handling used by PostScript- and PDF-compatible interpreters in IPS-based HP Inkjet printers prior to 2019.2. The root cause is incorrect buffer size calculation, enabling a vulnerability that can overflow buffers in aff...
Huawei Data Communication: Out-Of-Bound Read Vulnerability in Some Huawei Products (huawei-sa-20191023-01-buffer)
There is an out of bound read vulnerability in some Huawei products. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
ThreatIngestor - Extract And Aggregate Threat Intelligence
An extendable tool to extract and aggregate IOCs from threat feeds. Integrates out-of-the-box with ThreatKB and MISP, and can fit seamlessly into any existing worflow with SQS, Beanstalk, and custom plugins. Overview ThreatIngestor can be configured to watch Twitter, RSS feeds, or other sources,...
Tracking CVE-2019-11043 PHP Vulnerability – An Uncommon Chain of Events
On October 22, security researcher Omar Ganiev published a tweet regarding remote code execution vulnerability in PHP-FPM the FastCGI Process Manager running on the Nginx server. The tweet includes a link to a GitHub repository with an explanation of the vulnerability and a PoC proof-of-concept f...
Decrypting What Zero Trust Is, And What It Likely Isn’t
It’s always an indicator of confusion when instead of hearing “I want Q” I’m asked “what is Q?”. In this case the ‘Q’ is Zero Trust. I’ll try and give my best take on what I understand Zero Trust to be. History Repeats Let’s start with the background. Quite a while back the Jericho Forum proposed...
Omise: Found Origin IP's Lead To Access To [ Grafana Instance , PgHero Instance [ Can SQL Injection ]
Hello through RECON for on go.exchange i found origin ip's on https://censys.io/ipv4?q=go.exchange That's allow to the attacker to access to Many Instances Like Grafana But Need Crediantles And Access To PgHero and TokenModel · GO.Exchange where the attacker can use pghero to Execute postgresql...
CVE-2019-5592
Multiple padding oracle vulnerabilities Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled,...
CVE-2019-5592
Multiple padding oracle vulnerabilities Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled,...
Design/Logic Flaw
Multiple padding oracle vulnerabilities Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled,...
CVE-2019-5592
CVE-2019-5592 describes padding oracle vulnerabilities in FortiOS SSL Deep Inspection with CBC padding in the FortiOS IPS engine. Affected FortiGate/FortiOS IPS versions (5.000–5.006, 4.000–4.036, 4.200–4.219, and 3.547 and below) configured with SSL Deep Inspection policies and the IPS sensor en...
CVE-2019-5592
Multiple padding oracle vulnerabilities Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled,...
CVE-2019-5592
Multiple padding oracle vulnerabilities Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled,...
Spring RCE exploit I can’t explain
I’ve just found some variant of Struts exploit that surprised me by obfuscation technique: GET...
Spyse.Py - Python API Wrapper And Command-Line Client For The Tools Hosted On Spyse.Com
Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and business...
The vulnerability in the implementation of the ips_init_phase1 function in the Linux operating system’s kernel allows a hacker to trigger a service failure.
The vulnerability in the implementation of the ipsinitphase1 function, which is called from the ipsinsertdevice handler in the loaded module drivers/scsi/ips.ko of the Linux operating system, stems from a memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...
Three Network Security Questions with CEITEC’s CIO
Ireneo Demanarig is the Chief Information Officer at CEITEC S.A. located in Porto Alegre, Rio Grande do Sul, Brazil. CEITEC is a microelectronics manufacturer that specializes in solutions such as automatic identification RFID and smartcards, application-specific integrated circuits ASICs aimed a...
WordPress Register IPs plugin <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability found by Juliobox in WordPress Register IPs plugin versions = 1.8.0. Solution Update the WordPress Register IPs plugin to the latest available version at least 1.8.1...
Register IPs <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
The Register IPs WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting XSS security vulnerability...
