Nextcloud: Missing X-Content-Type-Options

Nextcloud doesn't have a header settings for X-Content-Type Options which means it is vulnerable to MIME sniffing. The only defined value, "nosniff", prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome...

Design/Logic Flaw

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as filemode= by manipulating for example the domain parameter of the samba URL...

CVE-2018-12561

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as filemode= by manipulating for example the domain parameter of the samba URL...

CVE-2018-12561

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as filemode= by manipulating for example the domain parameter of the samba URL...

DEBIAN-CVE-2018-12561

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as filemode= by manipulating for example the domain parameter of the samba URL...

CVE-2018-12561

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as filemode= by manipulating for example the domain parameter of the samba URL...

CVE-2018-12561

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as filemode= by manipulating for example the domain parameter of the samba URL...

DHCP Client - Command Injection (DynoRoot) Exploit

Exploit for linux platform in category remote exploits This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DHCP Client Command Injection DynoRoot', 'Description' = %q This module exploits the...

Microsoft Windows: User Account Control: Detect application installations and prompt for elevation

This policy setting determines the behavior of application installation detection for the entire system. Some software might attempt to install itself after being given permission to run. The user may give permission for the program to run because the program is trusted. Then the user is prompted...

Microsoft Windows: User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

This policy setting determines the behavior of the elevation prompt for accounts that have administrative credentials. C Microsoft Corporation 2017. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

Linux Meterpreter, Reverse TCP Inline

Run the Meterpreter / Mettle server payload stageless This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Module generated by tools/modules/generatemettlepayloads.rb module MetasploitModule CachedSize = 1061912 include...

Microsoft Windows: Network access: Restrict anonymous access to Named Pipes and Shares

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnaanonymousaccesspipedshares.nasl 11337 2018-09-11 14:23:53Z emoss $ Check value for Network access: Restrict anonymous access to Named Pipes and Shares Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks...

Microsoft Windows: Network access: Named Pipes that can be accessed anonymously

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnapipesaccessedanonym.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Network access: Named Pipes that can be accessed anonymously Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Windows: Network access: Let Everyone permissions apply to anonymous users

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnapermissionsanonymoususer.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Network access: Let Everyone permissions apply to anonymous users Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks...

Security update for ImageMagick (moderate)

This update for ImageMagick to version 7.0.7-34 fixes the following issues: The following security issue was fixed: - Fixed numerous use of uninitialized values, integer overflow, memory exceeded, and timeouts. The following non-security issues were fixed: - Added support for reading eXIf chunks ...

New Data Privacy Regulations

When Marc Zuckerberg testified before both the House and the Senate last month, it became immediately obvious that few US lawmakers had any appetite to regulate the pervasive surveillance taking place on the Internet. Right now, the only way we can force these companies to take our privacy more...

Microsoft Windows: Microsoft network client: Send unencrypted password to third-party SMB servers

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winncunencryptedpasswordsmb.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Microsoft network client: Send unencrypted password to third-party SMB servers Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone...

Microsoft Windows: Microsoft network server: Digitally sign communications (always)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnssigncommunicationalways.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Microsoft network server: Digitally sign communications always Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Windows: Microsoft network client: Digitally sign communications (always)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winncdigitallysigncommunicationsalways.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Microsoft network client: Digitally sign communications always Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone...

DumpsterDiver - Tool To Search Secrets In Various Filetypes

DumpsterDiver is a tool used to analyze big volumes of various file types in search of hardcoded secret keys e.g. AWS Access Key, Azure Share Key or SSH keys. Additionally, it allows creating a simple search rules with basic conditions e.g. reports only csv file including at least 10 email...