CVE-2019-1880 Cisco Unified Computing System BIOS Signature Bypass Vulnerability

A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System UCS C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware image file. An...

CVE-2019-1880: Insufficient Verification of Data Authenticity

A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System UCS C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware image file. An...

Command Execution Vulnerability in Qiji Transportation Fortress Servers

Zhejiang Qiji Technology Co., Ltd. is a company mainly engaged in computer hardware and software, network products, technology development and other projects. A command execution vulnerability exists in the server side of the Qiji Operations and Maintenance Fortress, which can be exploited by an...

CVE-2019-11982: Improper Neutralization of Input During Web Page Generation

A remote cross site scripting vulnerability was identified in HPE Integrated Lights-Out 4 iLO 4 earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 iLO 5 for Gen10 Servers earlier than version v1.39...

Infosecurity Europe: Cryptojacking is Making a Comeback

LONDON, UK – With cryptocurrency prices skyrocketing, the threat of cryptomining malware, used to mine various types of cryptocurrencies, is continuing to worry the security industry. Case in point: Recently researchers uncovered the Nansh0u campaign, a cryptojacking campaign that mines an...

GandCrab Ransomware Shutters Its Operations

The GandCrab ransomware group is shutting down, according to posts on the Dark Web. Researchers David Montenegro and Damian spotted the announcements over the weekend. Start of GandCrab Ransomware : 28-1-2018 .. 🦀🦀🦀 Close of GandCrab Ransomware : 1-6-2019 .. ☠️☠️☠️@RajSamani @ValthekOn @JohnFokker...

Amazon Linux 2 : openssh (ALAS-2019-1216)

An issue was discovered in OpenSSH. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned only directory traversal attacks are prevented. A...

50k Servers Infected with Cryptomining Malware in Nansh0u Campaign

Up to 50,000 servers were infected over the past four months as part of a high-profile cryptojacking campaign, believed to orchestrated by Chinese-language adversaries. Researchers with Guardicore Labs, who disclosed the campaign Wednesday, said that the Nansh0u​ campaign named due to a text file...

Medical industry struggles with PACS data leaks

In the medical world, sharing patient data between organizations and specialists has always been an issue. X-Rays, notes, CT scans, and any other data or related files have always existed and been shared in their physical forms slides, paperwork. When a patient needed to take results of a test to...

Sql injection

Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...

CVE-2019-10852

Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...

sshtron

This is a multiplayer Tron game accessible via SSH. The game is written in Go and uses the SSH protocol to allow multiple players to play together over a network. The game is designed to be played on a server, and players can connect to the server using SSH to play. The game uses a simple...

Arbitrary Code Execution

Mutt is vulnerable to arbitrary code execution vulnerability. The vulnerability exists in an unknown code block of the component IMAP Server Handler. Remote IMAP servers could execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic...

Heap-Based Buffer Overflow

PHP is vulnerable to heap-based buffer overflow vulnerability. The vulnerability exists in the ext/mysqlnd/mysqlndwireprotocol.c in PHP. Remote MySQL servers could cause a denial of service or possibly have unspecified other impact via crafted field metadata...

Microsoft SharePoint Elevation of Privilege Vulnerability (CNVD-2019-39031)

Microsoft SharePoint is a browser-based collaboration and document management platform. An elevation of privilege vulnerability exists in Microsoft SharePoint. An attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint Server to conduct a...

May 14, 2019—KB4494440 (OS Build 14393.2969) - EXPIRED

None None...

EulerOS Virtualization 3.0.1.0 : mariadb (EulerOS-SA-2019-1554)

According to the versions of the mariadb packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before...

HPESBHF03932 rev.2 - HPE Products using certain Intel UEFI Reference Code, Local Escalation of Privilege, Denial of Service Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL360 Gen10 Server Firmware prior to 2.04 04/18/2019 HPE ProLiant DL160 Gen10 Server Firmware prior to 2.04 04/18/2019 HPE ProLiant DL180...

EulerOS Virtualization 3.0.1.0 : openssh (EulerOS-SA-2019-1426)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The processopen function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, whi...

Security Bulletin: Vulnerability in SSLv3 affects ITCAM for APPLICATION DIAGNOSTICS Agent for HTTP Servers (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in ITCAM for APPLICATION DIAGNOSTICS Agent for HTTP Servers Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote...