Watch Out IT Admins! Two Unpatched Critical RCE Flaws Disclosed in rConfig

If you're using the popular rConfig network configuration management utility to protect and manage your network devices, here we have an important and urgent warning for you. A cybersecurity researcher has recently published details and proof-of-concept exploits for two unpatched, critical remote...

Persistence – Netsh Helper DLL

Netsh is a Windows utility which can be used by administrators to perform tasks related to the network configuration of a system and perform modifications on the host based Windows firewall. Netsh functionality can be extended with the usage of DLL files. This capability enable red teams to use...

CVE-2019-17367

OpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless/radio1.network1, firewall, firewall/zones, firewall/forwards, firewall/rules, network/wan, network/wan6, or network/lan under /cgi-bin/luci/admin/network/...

SUSE-SU-2019:2671-1 Security update for crowbar-core, crowbar-openstack, grafana, novnc, openstack-keystone, openstack-neutron, openstack-neutron-lbaas, openstack-nova, openstack-tempest, python-pysaml2, python-urllib3, rubygem-chef, rubygem-easy_diff, sleshammer

This update for crowbar-core, crowbar-openstack, grafana, novnc, openstack-keystone, openstack-neutron, openstack-neutron-lbaas, openstack-nova, openstack-tempest, python-pysaml2, python-urllib3, rubygem-chef, rubygem-easydiff, sleshammer fixes the following issues: In python-pysaml2 the followin...

CVE-2008-2359

The default configuration of consolehelper in system-config-network before 1.5.10-1 on Fedora 8 lacks the USER=root directive, which allows local users of the workstation console to gain privileges and change the network configuration...

[SECURITY] Fedora 30 Update: systemd-241-12.git1e19bcd.fc30

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

CB TAU Threat Intelligence Notification: State-Sponsored Espionage Group Targeting Multiple Verticals with ‘Crosswalk’

FireEye recently reported on APT41, a Chinese state-sponsored espionage group. The group has been documented as targeting healthcare, high-tech, and telecommunications companies for traditional corporate espionage purposes. Additionally this group has also targeted companies in the video game...

dhclient, dhcp security update

CentOS Errata and Security Advisory CESA-2019:2060 An update for dhcp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CentOS 7 : dhcp (CESA-2019:2060)

An update for dhcp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Google Android Information Disclosure Vulnerability (CNVD-2019-37950)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. System in Android Q suffers from an information disclosure vulnerability. The vulnerability stems from errors such as configuration during operation of a networked system or product. An attacker...

Google Android Information Disclosure Vulnerability (CNVD-2019-37949)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. System in Android Q suffers from an information disclosure vulnerability. The vulnerability stems from errors such as configuration during operation of a networked system or product. An attacker...

Google Android Media Framework Information Disclosure Vulnerability (CNVD-2019-38576)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. Media Framework is one of the multimedia development frameworks. An information disclosure vulnerability exists in Media framework in Android Q. The vulnerability originates in a...

Google Android Framework Information Disclosure Vulnerability (CNVD-2019-39727)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA, of which Framework is a component of the Android framework. An information disclosure vulnerability exists in Framework in Android. The vulnerability stems from errors such as configuration durin...

Google Android Information Disclosure Vulnerability (CNVD-2019-38549)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. An information disclosure vulnerability exists in System in Android. The vulnerability stems from errors such as configuration during operation of a networked system or product. An attacker could...

Google Android Information Disclosure Vulnerability (CNVD-2019-38540)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. An information disclosure vulnerability exists in System in Android. The vulnerability stems from errors such as configuration during operation of a networked system or product. An attacker could...

Google Android Framework Information Disclosure Vulnerability (CNVD-2019-39705)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA, of which Framework is a component of the Android framework. An information disclosure vulnerability exists in Framework in Android. The vulnerability stems from errors such as configuration durin...

Google Android Information Disclosure Vulnerability (CNVD-2019-28865)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. An information disclosure vulnerability exists in System in Android Q. The vulnerability stems from errors such as configuration during operation of a networked system or product. An attacker cou...

Endian Firewall 3.3.0 Cross Site Scripting

Exploit Title: Endian Firewall cross-site scripting XSS Date: 08/22/2019 Exploit Authors: Milad Soltanian + G0dfather @irpwn Vendor Homepage: https://www.endian.com Version : 3.3.0 An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

OPENSUSE-SU-2019:1858-1 Security update for ansible

This update for ansible fixes the following issues: Ansible was updated to version 2.8.1: Full changelog is at /usr/share/doc/packages/ansible/changelogs/ - Bugfixes - ACI - DO not encode querystring - ACI modules - Fix non-signature authentication - Add missing directory provided via...

Critical RCE Bug Found Lurking in Avaya VoIP Phones

A decade-old remote code-execution RCE bug has been found, unpatched, in an Avaya desk phone that’s used at 90 percent of Fortune 100 companies. If exploited, attackers could remotely take over the operation of the phone, exfiltrate audio and potentially even “bug” the phone to listen in...