Mail.ru: JMX RMI command injection on 195.211.131.82(Mail.ru Gaming)

Externally available Jolokia interface in Mail.Ru Gaming network allowed JMX RMI commands injection Сommand injection in Jolokia JMX. Reading the docs helps. A lot. Also, having good friends who can help you when you need it:...

[SECURITY] Fedora 31 Update: krb5-1.17-45.fc31

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...

SUSE SLED15 / SLES15 Security Update : u-boot (SUSE-SU-2019:2475-1)

This update for u-boot fixes the following issues : Security issues fixed : CVE-2019-13106: Fixed stack-based buffer overflow via a crafted ext4 filesystem that may lead to code execution bsc1144656. CVE-2019-13104: Fixed an underflow that could cause memcpy to overwrite a very large amount of da...

Exim CVE-2019-16928 Heap Buffer Overflow Vulnerability

Description Exim is prone to a heap-based buffer-overflow vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions. Exim versions 4.92 through 4.92.2 are...

V-SOL GPONEPON OLT Platform 2.03 - Cross-Site Request Forgery

V-SOL GPONEPON OLT Platform 2.03 - Cross-Site Request Forgery Exploit Title: V-SOL GPON/EPON OLT Platform 2.03 - Cross-Site Request Forgery Author: LiquidWorm Discovery Date: 2019-09-26 Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd. Product web page: https://www.vsolcn.com Tested on...

CVE-2019-13523

CVE-2019-13523 affects Honeywell Performance IP Cameras and Performance NVRs where the integrated web server can disclose web configuration data in JSON without authentication. Affected IP Cameras include HBD3PR2, H4D3PRV3, HED3PR3, H4D3PRV2, HBD3PR1, H4W8PR2, HBW8PR2, H2W2PC1M, H2W4PER3, H2W2PER...

CVE-2019-16276

It was discovered that net/http through net/textproto in golang does not correctly interpret HTTP requests where an HTTP header contains spaces before the colon. This could be abused by an attacker to smuggle HTTP requests when a proxy or a firewall is placed behind a server implemented in Go or ...

V-SOL GPON/EPON OLT Platform v2.03 Link Manipulation Vulnerability

Summary GPON is currently the leading FTTH standard in broadband access technology being widely deployed by service providers around the world. GPON/EPON OLT products are 1U height 19 inch rack mount products. The features of the OLT are small, convenient, flexible, easy to deploy, high...

SUSE SLED15 / SLES15 Security Update : python-numpy (SUSE-SU-2019:2462-1)

This update for python-numpy fixes the following issues : Non-security issues fixed : Updated to upstream version 1.16.1. bsc1149203 jscSLE-8532 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

Fedora 30 : libnbd (2019-749d828945)

New upstream version 1.0.2. Contains fix for NBD Protocol Downgrade Attack CVE-2019-14842. ---- Add upstream patch to fix nbdsh for nbdkit tests. ---- New stable version 1.0.1. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

What You Need to Know About Next Gen EDR

Endpoint Detection & Response EDR is the main mode of cybersecurity utilized by many organizations. Already recognized in 2012 as its own category, EDR was pushed as the ideal response to the rapidly changing threatscape that until then had been dealt with though not so successfully primarily...

F5 BIG-IQ Centralized Management CVE-2019-6653 HTML Injection Vulnerability

Description F5 BIG-IQ Centralized Management is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal...

Debian DLA-1928-1 : php5 security update

An update has been made to php5, a server-side, HTML-embedded scripting language. Specficially, as reported in 805222, the ability to build extensions in certain older versions of PHP within Debian has been hindered by an upstream change which first appeared in PHP 5.6.15. This update applies a f...

Debian DLA-1931-2 : libgcrypt20 regression update

It was discovered that the fix to address an ECDSA timing attack in the libgcrypt20 cryptographic library was incomplete. For Debian 8 'Jessie', this issue has been fixed in libgcrypt20 version 1.6.3-2+deb8u8. Thanks to Albert Chin-A-Young for the report. We recommend that you upgrade your...

Fedora 29 : znc (2019-154930f99b)

Fixes CVE-2019-12816 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security,...

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 lies in a buffer overflow issue during the processing of input data using the Content-Length header. Exploiting this vulnerability allows an attacker to...

D-Link DSL-2875AL Password Disclosure Vulnerability

D-Link DSL-2875AL is prone to a password disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Dell EMC ECS CVE-2019-3766 Authentication Bypass Vulnerability

Description Dell EMC ECS is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and aid in brute-force attacks; other attacks may also be possible. Versions prior to Dell EMC ECS 3.4.0.0 are vulnerable. Technologies Affected...

EulerOS 2.0 SP3 : libxml2 (EulerOS-SA-2019-2013)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libxml2 in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or...

EulerOS 2.0 SP3 : libssh (EulerOS-SA-2019-2067)

According to the version of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without...