Capturing, Analyzing and Responding to Cyber Attacks: cyberprobe

The Cyberprobe project is an open-source distributed architecture for real-time monitoring of networks against attack. The software consists of two components: a probe, which collects data packets and forwards it over a network in standard streaming protocols. a monitor, which receives the stream...

Xen Information Disclosure Vulnerability (CNVD-2017-28630)

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. There is a security vulnerability in...

spice: Possible buffer overflow via invalid monitor configurations

A vulnerability was discovered in spice server's protocol handling. An authenticated attacker could send specially crafted messages to the spice server, causing out-of-bounds memory accesses, leading to parts of server memory being leaked or a crash...

August 15, 2017—KB4034670 (Preview of Monthly Rollup)

None None...

Wireless Auditing & Security Testing Toolkit: BoopSuite

BoopSuite is an up and coming suite of wireless tools designed to be easy to use and powerful in scope, that support both the 2 and 5 GHz spectrums. Written purely in python. A handshake sniffer CLI and GUI, a monitor mode enabling script and a deauth script are all parts of this suite with more ...

Red-Gate SQL Monitor 3.10 4.2 - Authentication Bypass

Red-Gate SQL Monitor 3.10 4.2 - Authentication Bypass Exploit Title: Red-Gate SQL Monitor authentication bypass Version: Redgate SQL Monitor before 3.10 and 4.x before 4.2 Date: 2017-08-10 Red-Gate made a security announcement and publicly released the fixed version more than two years before thi...

Red-Gate SQL Monitor < 3.10/4.2 - Authentication Bypass Vulnerability

Exploit for windows platform in category web applications Exploit Title: Red-Gate SQL Monitor authentication bypass Version: Redgate SQL Monitor before 3.10 and 4.x before 4.2 Date: 2017-08-10 Red-Gate made a security announcement and publicly released the fixed version more than two years before...

Red-Gate SQL Monitor Authentication Bypass

Exploit Title: Red-Gate SQL Monitor authentication bypass Version: Redgate SQL Monitor before 3.10 and 4.x before 4.2 Date: 2017-08-10 Red-Gate made a security announcement and publicly released the fixed version more than two years before this exploit was published Vendor Advisory:...

Red-Gate SQL Monitor < 3.10 / 4.2 - Authentication Bypass

Exploit Title: Red-Gate SQL Monitor authentication bypass Version: Redgate SQL Monitor before 3.10 and 4.x before 4.2 Date: 2017-08-10 Red-Gate made a security announcement and publicly released the fixed version more than two years before this exploit was published Vendor Advisory:...

BoopSuite - A Suite of Tools for Wireless Auditing and Security Testing

BoopSuite is an up and coming suite of wireless tools designed to be easy to use and powerful in scope, that support both the 2 and 5 GHz spectrums. Written purely in python. A handshake sniffer CLI and GUI, a monitor mode enabling script and a deauth script are all parts of this suite with more ...

Microsoft Windows Performance Monitor XXE Injection Information Disclosure (CVE-2017-0170)

An XML external entity XXE injection vulnerability exists in Windows Performance Monitor component of Microsoft Windows. The vulnerability is due to a failure to properly handle external entity references in XML files...

Linux System Optimizer and Monitoring: Stacer

System optimizer apps are quite the thing on platforms such as Windows and Android. Their usefulness, however, is debatable considering how notorious they are when it comes to using system resources. Stacer was created to better optimize your Linux PC in the sense that it packs quite the list of...

openssh: Bounds check can be evaded in the shared memory manager used by pre-authentication compression support

It was found that the boundary checks in the code implementing support for pre-authentication compression could have been optimized out by certain compilers. An attacker able to compromise the privilege-separated process could possibly use this flaw for further attacks against the privileged...

IDERA Uptime Monitor SQL Injection Vulnerability

IDERA Uptime Monitor is a cross-platform server monitoring software from IDERA. The software provides a server performance, availability and other indicators to collect, summarize and generate reports and other functions. An SQL injection vulnerability exists in the...

XenServer Host Console Not Visible On Some High-Resolution Monitors

Due to resolution incompatibility issues on some high-resolution monitors the host console may not be visible when booted The following monitors have been confirmed to have this issue: Dell, U2312HM, 23", 16:9, 1920 x 1080 Philips, 226V6QSB6, 21.5", 16:9, 1920X1080 AOC, I2280SWD, 22", 16:9,...

Course Name Disclosure

Moodle is vulnerable to course name disclosure. Authenticated attackers can leverage a flaw in admin/tool/monitor/lib.php to find hidden course names by subscribing to rules. These attacks are possible because moodle ignores the moodle/course:viewhiddencourses capability...

Object injection

SECURITY Fix potential object injection vulnerability. CVE-2018-19296. Reported by Sehun Oh of cyberone.kr. Added Tagalog translation, thanks to @StoneArtz Added Malagache translation, thanks to @Hackinet Updated Serbian translation, fixed incorrect language code, thanks to @mmilanovic4 Updated...

Information Disclosure

Moodle is susceptible to unauthorized information access. If the event monitor tool contains site-wide rules, a malicious user can subscribe to them and access sensitive information...

IDERA Uptime Monitor SQL Injection Vulnerability

IDERA Uptime Monitor is a cross-platform server monitoring software from IDERA. The software provides a server performance, availability and other indicators to collect, summarize and generate reports and other functions. An SQL injection vulnerability exists in the...

macOS Fruitfly Backdoor Analysis Renders New Spying Capabilities

LAS VEGAS—The FruitFly backdoor became a known entity in January, but it’s a good bet that for years it had been in the wild, undetected by analysts and security software. The macOS and OS X malware has a number of insidious spying capabilities that would make anyone uneasy, and a variant recentl...