CVE-2017-3808

A vulnerability in the Session Initiation Protocol SIP UDP throttling process of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient rate...

CVE-2017-3808: Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability in the Session Initiation Protocol SIP UDP throttling process of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient rate...

Fedora 25 : ming (2017-d43d46f1ca)

Release 0.4.8 no ABI or API changes - Add PHP7 compatibility - Fix C++ output of disassembler - Fix heap overflows in parser.c CVE-2017-7578 - Avoid division by zero in listmp3 when no valid frame was found CVE-2016-9265 - Don't try printing unknown block CVE-2016-9828 - Parse Protect tag's...

PT-2017-2029

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions prior to 10.5.2.14900-16 Cisco Unified Communications Manager versions prior to 11.0.1.23900-5 Cisco Unified Communications Manager versions prior to 11.5.1.12900-2 Microsoft Windows affected...

Cisco Unified Communications Manager Denial of Service Vulnerability (cisco-sa-20170419-ucm)

A vulnerability in the Session Initiation Protocol SIP UDP throttling process of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. Copyright C 2017 Greenbone Networks GmbH Some te...

Facebook Delegated Account Recovery SDKs Published for Java, Ruby Apps

Facebook’s Delegated Account Recovery, a protocol that allows applications to delegate account recovery permission to third-party applications, entered its beta phase today with the release of SDKs and additional support for new platforms. The feature has been running on a trial basis since late...

Edit and Replay Network Traffic: tcpreplay

Edit and Replay Network Traffic Tcpreplay is a suite of GPLv3 licensed utilities for UNIX and Win32 under Cygwin operating systems for editing and replaying network traffic which was previously captured by tools like tcpdump and Ethereal / Wireshark . It allows you to classify traffic as client o...

RF Transceiver Transmitter

This module powers an HWBridge-connected radio transceiver, effectively transmitting on the frequency set by the FREQ option. NOTE: Users of this module should be aware of their local laws, regulations, and licensing requirements for transmitting on any given radio frequency. This module requires...

Trello: Rate limiting of incorrect Two Factor Authentication codes not enforced

Trello has a feature which allows the user to enable Two factor authentication to enhance the security. But no Rate Limiting is present on second authentication, i.e. code sent to Registered Mobile Number. Attacker can try as many attempts as he wants to bypass the 2 factor authentication. So usi...

Khan Academy: Rate Limitation Vulnerability (DDos)

Rate limiting on account confirmation emails and forgot password...

Automattic: Authentication Bypass - Chaining two vulnerabilities leads to account takeover at en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/login/ Description and Impact An attacker can perform account takeover by leveraging following two vulnerabilities: Auth Bypass = Username Enumeration + Login Brute Force A. Username Enumeration: ------------------------------- For the...

Joomla JE Video Rate 1.0 SQL Injection

Exploit Title: Joomla! Component JE Video Rate 1.0 - SQL Injection Google Dork: inurl:index.php?option=comjevideorate Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy: https://extensions.joomla.org/extensions/extension/multimedia/multimedia-players/je-video-rate/ Dem...

Joomla JE Video Rate 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component JE Video Rate 1.0 - SQL Injection Google Dork: inurl:index.php?option=comjevideorate Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy:...

Joomla! Component JE Video Rate 1.0 - SQL Injection

Exploit Title: Joomla! Component JE Video Rate 1.0 - SQL Injection Google Dork: inurl:index.php?option=comjevideorate Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy: https://extensions.joomla.org/extensions/extension/multimedia/multimedia-players/je-video-rate/ Dem...

Joomla! Component JE Video Rate 1.0 - SQL Injection

Joomla! Component JE Video Rate 1.0 - SQL Injection Exploit Title: Joomla! Component JE Video Rate 1.0 - SQL Injection Google Dork: inurl:index.php?option=comjevideorate Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy:...

Grab: Authorization bypass using login by phone option+horizontal escalation possible on Grab Android App

Description: After my previous report about 2FA bypass on the Profile Edit endpoint i was interested to find enpoint, which will allow me horizontal privileges escalation. So, I found the endpoint using android app https://p.grabtaxi.com/api/passenger/v2/profiles/activationsms which allow me to...

Oracle Linux 6 / 7 : ntp (ELSA-2017-0252)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0252 advisory. - don't limit rate of packets from sources CVE-2016-7426 - don't change interface from received packets CVE-2016-7429 - fix calculation of root...

ntp, ntpdate, sntp security update

CentOS Errata and Security Advisory CESA-2017:0252 An update for ntp is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

ntp: Client rate limiting and server responses

It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources. A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid responses from its sources...

Moderate: Red Hat Security Advisory: ntp security update

An update for ntp is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...