CVE-2017-7639

CVE-2017-7639 affects the QNAP NAS application Proxy Server up to version 1.2.0. The issue is improper authentication of requests, enabling potential unauthorized changes to Proxy Server settings. No remediation steps are provided in the documents. CVSS metrics are listed: CVSSv2 base 5.0 (Medium...

CVE-2017-7636

Cross-site scripting XSS vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitrary web script or HTML...

CVE-2017-7636

CVE-2017-7636 is a cross‑site scripting (XSS) vulnerability in the QNAP NAS Proxy Server up to version 1.2.0. The issue enables remote attackers to inject arbitrary web script or HTML into pages served by the Proxy Server. The vulnerability is exploitable remotely over the network, with user inte...

CVE-2017-7635

The CVE-2017-7635 entry concerns QNAP NAS Proxy Server (versions up to 1.2.0) that does not utilize CSRF protections. This lack enables CSRF-style abuse against affected installations, potentially allowing unauthorized state-changing actions initiated by an authenticated user’s session. The provi...

Remote code execution

DISPUTED An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default auto-deployment...

CVE-2018-10682

CVE-2018-10682/10683 (WildFly 10.1.2.Final) : Red Hat entries provide concrete detail that an attacker could access the administration panel on TCP port 9990 without authentication via an optional, potentially unsecured anonymous access path, followed by a misconfiguration (auto-deployment) enabl...

Socks5 Proxy Server

This module provides a socks5 proxy server that uses the builtin Metasploit routing to relay connections...

DEBIAN-CVE-2016-9590

puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage swift. During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf...

UBUNTU-CVE-2016-9590

puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage swift. During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf...

DEBIAN-CVE-2017-2825

In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An attacker can set up a Man-in-the-Middle server to alter trapper requests made between an active Zabbix proxy and Server to trigger this...

UBUNTU-CVE-2017-2825

In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An attacker can set up a Man-in-the-Middle server to alter trapper requests made between an active Zabbix proxy and Server to trigger this...

Solaris 10 (sparc) : 120981-25

Sun Java System Web Proxy Server 4.0.17, Solaris SVR4 patch: Mai. Date this patch was last updated by Sun : Jul/01/11 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Solaris 10 (x86) : 120982-25

Sun Java System Web Proxy Server 4.0.17, x86 SVR4 patch: Mainte. Date this patch was last updated by Sun : Jul/01/11 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Authentication flaw

An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving unhashed tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allow...

ShadowSocks ConnecTion - A Wrapper Tool For Shadowsocks To Consistently Bypass Firewalls

A wrapper tool for shadowsocks to consistently bypass firewalls. Quick start Automatically connect The easiest way to run this tool is just type ssct in terminal, and ssct will acquire available shadowsocks servers from ishadowsocks and connect to it automatically. Connect to a specific server...

IT threat evolution Q2 2017

Targeted attacks and malware campaigns Back to the future: looking for a link between old and new APTs This year's Security Analyst Summit SAS included interesting research findings on several targeted attack campaigns. For example, researchers from Kaspersky Lab and King's College London present...

FreeBSD : subversion -- Arbitrary code execution vulnerability (6e80bd9b-7e9b-11e7-abfe-90e2baa3bafc)

subversion team reports : A Subversion client sometimes connects to URLs provided by the repository. This happens in two primary cases: during 'checkout', 'export', 'update', and 'switch', when the tree being downloaded contains svn:externals properties; and when using 'svnsync sync' with one URL...

CVE-2017-9800

A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...

Design/Logic Flaw

A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...

CVE-2017-9800

A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...