CVE-2018-8608: Improper Neutralization of Input During Web Page Generation

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises version 8 does not properly sanitize a specially crafted web request to an affected Dynamics server, aka "Microsoft Dynamics 365 on-premises version 8 Cross Site Scripting Vulnerability." This affects Microsoft...

PT-2018-1785

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 on-premises version 8 Description A remote code execution issue exists due to the server's failure to properly sanitize web requests. This can be exploited by a remote attacker using a specially crafted SQL query,...

CVE-2018-18566

The SIP service in Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allow remote attackers to obtain sensitive phone configuration information by leveraging use with an on-premise installation with Skype for Business...

WinRM Service cannot process the Request

Challenge When attempting to add an On-Prem or Hybrid organization to Veeam Backup for Office 365 the following error occurs: The WinRM service cannot process the request because the request needs to be sent to a different machine. Use the redirect information to send the request to a new machine...

What I expect from IT Asset Inventory

The main problem of vulnerability management, in my opinion, is that it is not always clear whether we know about ALL network hosts existing in our infrastructure or not. So, not the actual process of scanning and the detection of vulnerabilities, but the lack of knowledge what we should scan...

CVE-2018-5758

The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing attackers to read arbitrary files...

Xxe

The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing attackers to read arbitrary files...

CVE-2018-5758

The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing attackers to read arbitrary files...

CVE-2018-5758

Summary: CVE-2018-5758 affects Aurea Jive Jive-n 9.0.2.1 On-Premises. The vulnerability arises in the Upload File functionality (upload.jspa), enabling an XML External Entity (XXE) attack via a crafted file to read arbitrary files. The provided sources consistently describe the flaw as an XXE in ...

CVE-2018-5758

The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing attackers to read arbitrary files...

CVE-2018-6324

F-Secure Radar on-premises before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers upon a user login...

CVE-2018-6189

F-Secure Radar on-premises before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request body in an outbound request for the /api/latest/vulnerabilityscans/tags/batch resource, aka a "suggested metadata tags for assets" issue...

PT-2018-17478

Name of the Vulnerable Software and Affected Versions F-Secure Radar on-premises versions prior to 2018-02-15 Description The issue concerns an unvalidated redirect that occurs when a user logs in, triggered by the ReturnUrl parameter. Recommendations For versions prior to 2018-02-15, update to a...

PT-2018-17394

Name of the Vulnerable Software and Affected Versions F-Secure Radar on-premises versions prior to 2018-02-15 Description The issue involves a problem with suggested metadata tags for assets. It is related to an outbound request for the "/api/latest/vulnerabilityscans/tags/batch" API endpoint,...

Cyber resilience for the modern enterprise

Many organizations are undergoing a digital transformation that leverages a mix of cloud and on-premises assets to increase business efficiency and growth. While increased dependence on technology is necessary for this transformation, and to position the business for success, it does pose risks...

CVE-2017-6094

CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC address of its WAN interface and a certain "chk" value 48bit derived from the MAC. The algorithm used to compute the "chk" was disclosed ...

The vulnerability of the add_pseudoheader function in the Dnsmasq DNS server allows a hacker to cause a service failure.

The vulnerability of the addpseudoheader function in the Dnsmasq DNS server arises from the loss of a significant number of bits in cases where parameters addmac, addcpeid, or addsubnet are specified. Exploiting this vulnerability allows a malicious actor to cause a service failure through a...

CVE-2017-14706

DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web...

Authentication flaw

DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web...

Design/Logic Flaw

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webservices/stream/tail.php. An iToken authentication parameter is required but can be obtained by...