PT-2017-2908

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning Software Releases prior to 12.1 Description A vulnerability in the web interface of Cisco Prime Collaboration Provisioning allows an unauthenticated, remote attacker to bypass authentication and perform...

Intel AMT Vulnerability

Last week, Intel published a security advisory INTEL-SA-00075 regarding a new vulnerability in Intel Active Management Technology AMT, Intel Standard Manageability ISM, and Intel Small Business Technology SBT. The firmware versions impacted are 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6. In...

April 25, 2017—KB4016240 (OS Build 15063.250)

None None...

CVE-2016-1518

The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have...

CVE-2016-1519

The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate...

CVE-2016-1518

The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have...

CVE-2016-1518

CVE-2016-1518 affects the Grandstream Wave app (Android, versions up to 1.0.1.26 and earlier) and Grandstream Video IP phones. The root cause is failure to use HTTPS when downloading provisioning/configuration data from http://fm.grandstream.com/gs/, enabling a man-in-the-middle to spoof provisio...

CVE-2016-1518

The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have...

PT-2017-7961

Name of the Vulnerable Software and Affected Versions Grandstream Wave app versions 1.0.1.26 and earlier Grandstream Video IP phones versions affected versions not specified Description The issue concerns the auto-provisioning mechanism, which fails to use an HTTPS session for downloading...

Cisco IOS XE for Cisco ASR 920 Series Routers Zero Touch Provisioning DoS (cisco-sa-20170322-ztp)

According to its self-reported version, the Cisco IOS XE software running on the remote Cisco ASR 920 Series device is affected by a denial of service vulnerability due to a format string flaw when processing DHCP packets for Zero Touch Provisioning. An unauthenticated, remote attacker can exploi...

Cisco Patches Critical IOx Vulnerability

Cisco Systems patched a critical vulnerability Wednesday that could allow an unauthenticated, remote attacker to execute remote code on affected hardware and gain root privileges. The bug is in Cisco’s Data-in-Motion DMo process, part of the company’s IOx application environment that marries its...

Cisco IOS XE Software for Cisco ASR 920 Series Routers Zero Touch Provisioning Denial of Service Vulnerability

A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted...

Format string

A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vulnerability when processing a crafted...

CVE-2017-3859

A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vulnerability when processing a crafted...

CVE-2017-3859

A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vulnerability when processing a crafted...

CVE-2017-3859

Summary: CVE-2017-3859 is a DHCP-ZTP denial-of-service vulnerability in Cisco IOS XE on the ASR 920 Series. A format-string flaw in processing crafted DHCP packets for Zero Touch Provisioning can allow an unauthenticated, remote attacker to cause an affected device to reload (DoS). The issue affe...

Cisco IOS XE Software for Cisco ASR 920 Series Routers Zero Touch Provisioning Denial of Service Vulnerability

A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vulnerability when processing a crafted...

PT-2017-2016

Name of the Vulnerable Software and Affected Versions Cisco ASR 920 Series Aggregation Services Routers versions 3.13 through 3.18 Description A vulnerability in the DHCP code for the Zero Touch Provisioning feature could allow an unauthenticated, remote attacker to cause an affected device to...

Cobbler 2.8.0 - (Authenticated) Remote Code Execution

!/usr/bin/python """ Exploit title: Cobbler 2.8.x Authenticated RCE. Author: Dolev Farhi Contact: dolevf at protonmail.com @hack6tence Date: 03-16-2017 Vendor homepage: cobbler.github.io Software version: v.2.5.160805 Software Description ===================== Cobbler is a Linux installation serv...

PVS 7.13: XenServer PVS-Accelerator Introduction and Requirements

Note : This feature is only available in XenServer 7.1 and PVS 7.13 or later. XenServer PVS-Accelerator feature offers additional capabilities for customers using XenServer and Citrix Provisioning Services PVS. With this feature, the read requests from a PVS target device can now be cached on eac...