110 matches found
Information Disclosure
libvirt is vulnerable to information disclosure. It was found that libvirt created insecure iptables rules on the host when a guest system was configured for IP masquerading, allowing the guest to use privileged ports on the host when accessing network resources. A privileged guest user could use...
CVE-2019-11331
Network Time Protocol NTP, as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks. Mitigation On Red Hat Enterprise Linux 6 and later, switching from ntp to chrony is recommended. Amo...
ATT&CK +osquery = Love
I had the ability to live-stream MITRE's ATT&CKcon, a two-day event where organizations came together as a community to share their best practices with leveraging the ATT&CK framework. At this conference, Scott Lundgren, Chief Architect at Carbon Black ,presented “ATT&CK + osquery = Love,” where ...
Researchers discover vulnerabilities in smart assistants’ voice commands
Virtual personal assistants VPA, also known as smart assistants like Amazon’s Alexa and Google’s Assistant, are in the spotlight for vulnerabilities to attack. Take, for example, that incident about an Oregon couple’s Echo smart speaker inadvertently recording their conversation and sending it to...
CVE-2017-1711
IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-Force ID: 134532...
CVE-2017-1711
IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-Force ID: 134532...
FaceDancer 21 - New Universal Case for PenTests
Document Title: =============== FaceDancer 21 - New Universal Case for PenTests References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1960 STL Files Download: https://www.vulnerability-lab.com/resources/documents/FaceDancer2-STL-Files.rar Vulnerability Magazine:...
ICMP IP Tunnel: ICMPTunnel
icmptunnel works by encapsulating your IP traffic in ICMP echo packets and sending them to your own proxy server. The proxy server decapsulates the packet and forwards the IP traffic. The incoming IP packets which are destined for the client are again encapsulated in ICMP reply packets and sent...
Document URI misrepresentation and masquerading — Mozilla
Mozilla security researcher mozbugra4 reported that through an interaction of frames and browser history it was possible to make the browser believe attacker-supplied content came from the location of a previous page in browser history. This allows for cross-site scripting XSS attacks by loading...
Scientific Linux Security Update : libvirt on SL5.x i386/x86_64
It was found that libvirt did not set the user-defined backing store format when creating a new image, possibly resulting in applications having to probe the backing store to discover the format. A privileged guest user could use this flaw to read arbitrary files on the host. CVE-2010-2239 It was...
Safari < 5.1.4 Multiple Vulnerabilities
Binary data 800987.prm...
Safari < 5.1.4 Multiple Vulnerabilities
Binary data 6346.prm...
Safari < 5.1.4 Multiple Vulnerabilities
The version of Safari installed on the remote host reportedly is affected by several issues : - Look-alike characters in a URL could be used to masquerade a website. CVE-2012-0584 - Web page visits may be recorded in browser history even when private browsing is active. CVE-2012-0585 - Multiple...
CentOS Update for libvirt CESA-2010:0615 centos5 i386
The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...
Flaw in Microsoft Windows SAM Processing Allows Continued Administrative Access Using Hidden Regular User Masquerading After Compromise (2010-M$-001)
---------------------------------------------------------- www.ExploitDevelopment.com 2010-M$-001 ---------------------------------------------------------- TITLE: Flaw in Microsoft Windows SAM Processing Allows Continued Administrative Access Using Hidden Regular User Masquerading After Compromi...
libvirt security update
CentOS Errata and Security Advisory CESA-2010:0615 Updated libvirt packages that fix two security issues and three bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System CVS...
Low: Red Hat Security Advisory: libvirt security and bug fix update
Updated libvirt packages that fix two security issues and three bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings...
Chat Bots Are Trying to Fake You Out
Web robots, commonly referred to as “bots,” are software programs written to do automated tasks, like crawling the Web looking for new sites. They also appear in chat rooms and instant messaging services masquerading as real people. Read the full article. cnet...
Safari < 4.0.3 Multiple Vulnerabilities
The version of Safari installed on the remote Windows host is earlier than 4.0.3. Such versions are potentially affected by several issues : - A buffer overflow exists in the handling of EXIF metadata that ccould lead to a crash or arbitrary code execution. CVE-2009-2188 - A vulnerability in...
CVE-2009-1283
glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glfpassword cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection...