CPP-Ethereum JSON-RPC Incorrect Authorization Vulnerability (CNVD-2018-02798)

CPP-Ethereum is a C++ client for Ethereum Application Programming Platform.JSON-RPC is one of the remote invocation services using JSON as the protocol. An incorrect authorization vulnerability exists in the minersetGasPrice API for JSON-RPC in the CPP-Ethereum commit...

PT-2017-15134 · Libtiff +2 · Libtiff +2

Name of the Vulnerable Software and Affected Versions: LibTIFF version 4.0.8 Description: The issue is related to a heap-based use-after-free in the t2p writeproc function in tiff2pdf.c. There is a report of inability to reproduce this issue from a third-party source. Recommendations: For LibTIFF...

How to gracefully shutdown SD WAN

This articles talks about the procedure on how to shutdown the SD WAN when there is any maintenance activity in place in the DC or Branch...

Microsoft Windows RPC Remote Code Execution Vulnerability

Microsoft Windows is a popular computer operating system. A remote code execution vulnerability exists in Microsoft Windows RPC, which can be exploited by a remote attacker to execute arbitrary code due to improper handling of requests by the Remote Access Service...

mysql: Server: Stored Procedure unspecified vulnerability (CPU Oct 2017)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Stored Procedure. Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

IBM Db2 Stored Procedure Infrastructure Privilege Escalation Vulnerability

BM DB2 is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ibm:db2"; ifdescription...

Amazon Creates Classified US Cloud

Amazon has a cloud for US classified data. The physical and computer requirements for handling classified information are considerable, both in terms of technology and procedure. I am surprised that a company with no experience dealing with classified data was able to do it...

Foscam IP Video Camera Remote Code Execution Vulnerability

Foscam C1 Indoor HD Camera is a wireless HD IP camera from Foscam China. A remote code execution vulnerability exists in the recovery procedure in the Foscam C1 Indoor HD Camera, which stems from the program failing to perform adequate security monitoring. The vulnerability can be exploited to...

CVE-2017-3893

In BlackBerry QNX Software Development Platform SDP 6.6.0, the default configuration of the QNX SDP system did not in all circumstances prevent attackers from modifying the GOT or PLT tables with buffer overflow attacks...

Debian DSA-4017-1 : openssl1.0 - security update

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2017-3735 It was discovered that OpenSSL is prone to a one-byte buffer overread while parsing a malformed...

CVE-2017-3736

There is a carry propagating bug in the x8664 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely...

CVE-2017-10284

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Stored Procedure. Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

Oracle MySQL Stored Procedure Subcomponent Denial of Service Vulnerability

Oracle MySQL is an open source relational database management system from Oracle. The database system is characterized by high performance, low cost, good reliability, etc. MySQL Server is one of the server components. A security vulnerability exists in the Stored Procedure subcomponent of the...

SSL Handshake Failure on ADC Because of Unsupported Ciphers

SSL connection failsbetween the client and the ADCappliance ADC responds with a fatal alert. The description of the alert message is “Handshake Failure 40”. The above screenshot is from a NetScaler trace packet capture. Procedure to run a trace on the ADC is explained in the following document:...

Microsoft Windows Elevation of Privilege Vulnerability (CNVD-2017-30128)

Microsoft Windows is a series of operating systems released by the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows that originates from a program's failure to properly handle calls to Advanced Local Procedure Call ALPC. A local attacker could exploi...

Microsoft Windows Multiple Vulnerabilities (KB4041693)

This host is missing a critical security update according to Microsoft KB4041693 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco IOS XR Software Denial of Service Vulnerability (CNVD-2017-32489)

The Cisco Network Convergence System NCS 5500 Series Routers are a series of 5500 Series routers from Cisco, Inc.IOS XR Software is one of the modular, distributed network operating systems. A denial of service vulnerability exists in the gRPC code of the IOS XR Software in Cisco NCS 5500 Series...

Tapatalk plugin for MyBB SQL Injection Vulnerability

Tapatalk plugin for MyBB is a set of forum browsing plugins for MyBB from Tapatalk, Inc. A SQL injection vulnerability exists in Tapatalk plugin for MyBB versions prior to 4.5.8. A remote attacker can inject arbitrary SQL commands using XML-RPC encrypted documents...

CVE-2017-14652

SQL Injection vulnerability in mobiquo/lib/classTTForum.php in the Tapatalk plugin before 4.5.8 for MyBB allows an unauthenticated remote attacker to inject arbitrary SQL commands via an XML-RPC encoded document sent as part of the user registration process...

CVE-2017-14615

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the...