1537 matches found
Your Cache is Exposed
On February 28, Akamai recorded a 1.35 Tbps DDoS attack against one of our customers. The attack was driven by a relatively new vector, memcached reflection. Possibly the largest publicly disclosed DDoS attack to date, the memcached attack was more than twice the size of the largest DDoS attacks...
DokuWiki Reflection File Download Vulnerability
DokuWiki is a German software developer Andreas Gohr developed a PHP-based Wiki engine , it is mainly used for small and medium-sized team and personal website knowledge base management , and provides version control , full-text search and permission control and other functions . A security...
Dozer command execution vulnerability
Dozer is a mapper for Java beans that copies data from one object to another. A security vulnerability exists in Dozer that stems from the program's use of reflection-based methods for type conversion. The vulnerability can be exploited by a remote attacker to execute arbitrary code using special...
Arbitrary Code Execution
dozer is vulnerable to arbitrary code execution attacks. It incorrectly uses a reflection-based approach to type conversion which allows attackers to execute code through serialized objects...
CVE-2014-9515
Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object...
CVE-2014-9515
Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object...
CVE-2014-9515
CVE-2014-9515 affects Dozer: the vulnerability stems from reflection-based type conversion during object mapping, enabling remote code execution via specially crafted serialized objects. The NVD entry lists a high/critical impact (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; base scores up to 9.8) with n...
PT-2017-6361 · Apache · Dozer
Name of the Vulnerable Software and Affected Versions: Dozer affected versions not specified Description: The issue is related to Dozer's improper use of a reflection-based approach to type conversion. This might allow remote attackers to execute arbitrary code via a crafted serialized object...
openSUSE: Security Advisory for cacti (openSUSE-SU-2017:3051-1)
The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
FreeBSD : cacti -- multiple vulnerabilities (db570002-ce06-11e7-804e-c85b763a2f96)
cacti reports : Changelog issue1057: CVE-2017-16641 - Potential vulnerability in RRDtool functions issue1066: CVE-2017-16660 in remoteagent.php logging function issue1066: CVE-2017-16661 in view log file issue1071: CVE-2017-16785 in globalsession.php Reflection XSS %NASLMINLEVEL 70300 C Tenable...
RHEL 6 / 7 : Red Hat JBoss Enterprise Application Platform 6.4.18 (RHSA-2017:3240)
The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3240 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release...
RHEL 7 : httpd (RHSA-2017:3194)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3194 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: It was discovered that...
RHEL 6 / 7 : Red Hat JBoss Web Server (RHSA-2017:3113)
The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3113 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. OpenSSL is a toolkit that implement...
reflector - Burp plugin able to find reflected XSS on page in real-time while browsing on site
Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type whitelist. How to use Afte...
SUSE SLES12 Security Update : apache2 (SUSE-SU-2017:2756-1) (Optionsbleed)
This update for apache2 fixes several issues. These security issues were fixed : - CVE-2017-9798: Prevent use-after-free use of memory that allowed for an information leak via OPTIONS bsc1058058 - CVE-2017-9788: Uninitialized memory reflection in modauthdigest could have lead to leakage of...
Remote code execution
By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz...
SUSE-SU-2017:1961-1 Security update for apache2
This update for apache2 fixes the following issues: Security issue fixed: - CVE-2017-9788: Uninitialized memory reflection in modauthdigest. bsc1048576 Bug fixes: - Include individual sysconfig.d files instead of the whole sysconfig.d directory. - Include sysconfig.d/include.conf after httpd.conf...
Apache Httpd < 2.4.27 : Uninitialized memory reflection in mod_auth_digest
The value placeholder in Proxy-Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments. by modauthdigest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior...
Apache Httpd < 2.2.34 : Uninitialized memory reflection in mod_auth_digest
The value placeholder in Proxy-Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments. by modauthdigest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior...