Ansible: Compromised remote hosts can lead to running commands on the Ansible controller

An input validation vulnerability was found in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server...

Description of the cumulative update for Office Communications Server 2007 R2, Unified Communications Managed API 2.0 Core Redist 64-bit: November 2010

Describes the bugs that are resolved in the cumulative update for Office Communications Server 2007 R2, Unified Communications Managed API 2.0 Core Redist 64-bit that is dated November 2010.SummaryThis article describes the issue that is fixed in the cumulative update for Office Communications...

The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability in AWS, Google Cloud, Rackspace and Digital Ocean

Recently, I found that Digital Ocean suffered from a security vulnerability in their domain import system which allowed for the takeover of 20K domain names. If you haven’t given that post a read I recommend doing so before going through this write up. Originally I had assumed that this issue was...

Xfinity Gateway - Cross-Site Request Forgery

Xfinity Gateway - Cross-Site Request Forgery EXPLOIT TITLE: CSRF RCE XFINITY WEB GATEWAY AUTHOR: Pabstersac DATE: 1ST OF AUGUST 2016 CVE: N/A CATEGORY: REMOTE CONTACT: [email protected] IF ANYONE HAS COMMUNICATION WITH VENDOR PLEASE NOTIFY THEM SINCE THEY HAVE IGNORED ME. CSRF FOR COMCAST...

[SECURITY] Fedora 24 Update: ansible-2.2.0.0-3.fc24

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

The vulnerability of the Windows operating system, which allows a hacker to crack the password

The vulnerability of the Windows operating system is related to incorrect checking of NTLM SSO requests for MSAs. Exploiting this vulnerability allows a malicious actor to select a password by using brute-force attacks on NTLM password hashes...

August 23, 2016 — KB3176934 (OS Build 14393.82)

None None...

MS16-088: Description of the security update for SharePoint Server 2016: July 12, 2016

None None...

CVE-2016-1289

The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager EPNM 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request, as demonstrated by discovering managed-device credentials, aka Bug ID...

Design/Logic Flaw

The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager EPNM 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request, as demonstrated by discovering managed-device credentials, aka Bug ID...

Wiping a Managed device by XenMobile

In Citrix Endpoint Management, admins perform device and app security actions from the Manage Devices page. Device actions include revoke, lock, unlock, and wipe. App security actions include app lock and app wipe. For details, see...

[SECURITY] Fedora 22 Update: ansible-2.0.2.0-1.fc22

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

Thru Managed File Transfer Portal SQL Injection Vulnerability

Thru Managed File Transfer Portal is a web-based file transfer application. A SQL injection vulnerability exists in Thru Managed File Transfer Portal version 9.0.2. The program fails to filter the values of the sortorder and letterrange attributes, allowing an attacker to inject arbitrary SQL...

Symantec ITMS Inventory Solution Application Denial Functionality Bypass

SUMMARY The Inventory Solution component of Symantecs IT Management Agent, the client portion of Symantec IT Management Suite ITMS powered by Altiris, can be configured to deny one or more applications from running on a windows managed client as part of IT management functions. A determined user...

GE MultiLink Series Hard-coded Credential Vulnerability

OVERVIEW GE has identified a hard-coded credential vulnerability in GE’s MultiLink series managed switches. GE has produced new firmware versions to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following MultiLink products are affected: GE ML8...

Thru Managed File Transfer Portal 9.0.2 - SQL Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-056 Product: Thru Managed File Transfer Portal Manufacturer: Thru Affected Versions: 9.0.2 Tested Versions: 9.0.2 Vulnerability Type: SQL Injection CWE-89 Risk Level: High Solution Status: Open Manufacturer Notification:...

Thru Managed File Transfer Portal 9.0.2 - SQL Injection

Exploit for asp platform in category web applications Product: Thru Managed File Transfer Portal Manufacturer: Thru Affected Versions: 9.0.2 Tested Versions: 9.0.2 Vulnerability Type: SQL Injection CWE-89 Risk Level: High Solution Status: Open Manufacturer Notification: 2015-10-28 Solution Date:...

Thru Managed File Transfer Portal 9.0.2 Insecure Direct Object Reference

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-059 Product: Thru Managed File Transfer Portal Manufacturer: Thru Affected Versions: 9.0.2 Tested Versions: 9.0.2 Vulnerability Type: Insecure Direct Object Reference CWE-932 Risk Level: Medium Solution Status: Fixed...

Thru Managed File Transfer Portal 9.0.2 Insecure Direct Object Reference

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-064 Product: Thru Managed File Transfer Portal Manufacturer: Thru Affected Versions: 9.0.2 Tested Versions: 9.0.2 Vulnerability Type: Insecure Direct Object Reference CWE-932 Risk Level: Medium Solution Status: Fixed...

Thru Managed File Transfer Portal 9.0.2 - SQL Injection

Thru Managed File Transfer Portal 9.0.2 - SQL Injection -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-056 Product: Thru Managed File Transfer Portal Manufacturer: Thru Affected Versions: 9.0.2 Tested Versions: 9.0.2 Vulnerability Type: SQL Injection CWE-89 Risk Level: Hig...