New Settings Let Hackers Easily Pentest Facebook, Instagram Mobile Apps

Facebook has introduced a new feature in its platform that has been designed to make it easier for bug bounty hunters to find security flaws in Facebook, Messenger, and Instagram Android applications. Since almost all Facebook-owned apps by default use security mechanisms such as Certificate...

CVE-2019-8981

tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the needbytes value is mismanaged...

F5 Networks BIG-IP : BIG-IP HSB vulnerability (K26455071)

Under certain conditions, hardware systems with a High-Speed Bridge HSB using non-default Layer 2 forwarding configurations may experience a lockup of the HSB. CVE-2019-6604 This vulnerability occurs when all of the following conditions are met : A VLAN group is configured. The...

The compatibility subsystem for running Linux applications allows the Windows Subsystem for Linux operating systems to enable attackers to elevate their privileges and execute arbitrary code.

The vulnerability of the compatibility subsystem for running Linux applications stems from a numerical overflow. Exploiting this vulnerability allows an attacker to enhance their privileges and execute arbitrary code using a specially created application...

PYSEC-2019-203

Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates, which could result in man-in-the-middle attacks...

Low: Red Hat Security Advisory: docker security and bug fix update

An update for docker is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Cisco NX-OS Denial of Service Vulnerability

Cisco NX-OS is a set of data center-grade operating system software used by switches. A denial of service vulnerability exists in Cisco NX-OS version 802.1X. The vulnerability stems from a failure to fully authenticate the input of Extensible Authentication Protocol EAPOL frames on the LAN. An...

The vulnerability of the implementations of the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) in Cisco IP telephones allows a perpetrator to trigger a device reboot and a service failure.

The vulnerability of the Cisco Discovery Protocol and Link Layer Discovery Protocol LLDP implementations in IP-telephone microprogramming systems arises from the lack of checks for the length of certain fields in protocol packets. Exploiting this vulnerability can allow an attacker to trigger a...

tomcat: Host name verification missing in WebSocket client

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88...

[SECURITY] Fedora 28 Update: SDL-1.2.15-31.fc28

Simple DirectMedia Layer SDL is a cross-platform multimedia library desig ned to provide fast access to the graphics frame buffer and audio device...

NVIDIA Windows GPU Display Driver Multiple Vulnerabilities (February 2019)

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities: - A vulnerability in the 3D vision component in which the stereo service software, when opening a file, does not check for hard links. This behavior may...

NVIDIA Windows GPU Display Driver Input Validation Error Vulnerability

The NVIDIA Windows GPU Display Driver is a display driver for Windows systems. An array index reference vulnerability exists in the kernel mode layer nvlddmkm.sys create context command DDI DxgkDdiCreateContext in the NVIDIA Windows GPU display driver. The vulnerability stems from the product usi...

CVE-2019-5668

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiSubmitCommandVirtual in which the application dereferences a pointer that it expects to be valid, but is NULL, which may lead to denial of service or escalation of privileges...

The vulnerability of the OpenSSL cryptographic library’s software, related to the improper functioning of the “error state” mechanism, allows a hacker to transmit unencrypted confidential data over the network.

The vulnerability of the OpenSSL cryptographic library relates to the improper operation of the “error state” mechanism, especially when the functions SSLRead or SSLWrite are called directly by the application. Exploiting this vulnerability allows an attacker to transmit unencrypted confidential...

CVE-2019-7728

An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to improperly implemented TLS certificate checks, a malicious actor could potentially succeed in executing a man-in-the-middle attack for some connections. The Bosch Smart Home App is not affected. iOS Apps are no...

Cisco Firepower Threat Defense Input Validation Vulnerability

Cisco Firepower Threat Defense FTD is a suite of unified software from the U.S. company Cisco Cisco that provides next-generation firewall services. An input validation vulnerability exists in the detection engine in Cisco FTD, which can be exploited by a remote attacker to cause a denial of...

Race condition

A vulnerability in the Cisco Discovery Protocol or Link Layer Discovery Protocol LLDP implementation for the Cisco IP Phone 7800 and 8800 Series could allow an unauthenticated, adjacent attacker to cause an affected phone to reload unexpectedly, resulting in a temporary denial of service DoS...

CVE-2019-1691

A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated, remote attacker to cause the unexpected restart of the SNORT detection engine, resulting in a denial of service DoS condition. The vulnerability is due to the incomplete error handli...

CVE-2019-1684 Cisco IP Phone 7800 and 8800 Series Cisco Discovery Protocol and Link Layer Discovery Protocol Denial of Service Vulnerability

A vulnerability in the Cisco Discovery Protocol or Link Layer Discovery Protocol LLDP implementation for the Cisco IP Phone 7800 and 8800 Series could allow an unauthenticated, adjacent attacker to cause an affected phone to reload unexpectedly, resulting in a temporary denial of service DoS...

The vulnerability of the Decryption Policy Default Action component in Cisco Web Security Appliance routers allows a hacker to block certain SSL connections.

The vulnerability of the Decryption Policy Default Action component in Cisco Web Security Appliance firewalls is related to improper handling of encrypted SSL traffic. Exploiting this vulnerability could allow a malicious actor to block certain SSL connections remotely...