12442 matches found
thttpd Buffer Overflow Vulnerability
The htpasswd implementation of thttpd is affected by a buffer overflow that can be exploited remotely to perform code execution. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Unable to See All Virtual Servers Present on an Instance Using NetScaler MAS
Unable to see all the virtual servers that are present on an instance using NetScaler MAS...
New Research: Crypto-mining Drives Almost 90% of All Remote Code Execution Attacks
It’s early in 2018 and we have already witnessed one of the top contenders in this year’s web application attacks. Continuing the trend from the last months of 2017, crypto-mining malware is quickly becoming attackers’ favorite modus operandi. In December 2017, 88 percent of all remote code...
HP Web Jetadmin Multiple Cross-Site Scripting Vulnerabilities - Windows
HP Web Jetadmin is prone to multiple cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Design/Logic Flaw
A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...
CVE-2017-5803
A Remote Disclosure of Information vulnerability in HPE NonStop Servers using SSH Service version L series: T0801L02 through T0801L02^ABX; J and H series: T0801H01 through T0801H01^ACA was found...
Design/Logic Flaw
A Remote Disclosure of Information vulnerability in HPE NonStop Servers using SSH Service version L series: T0801L02 through T0801L02^ABX; J and H series: T0801H01 through T0801H01^ACA was found...
CVE-2017-5803
A Remote Disclosure of Information vulnerability in HPE NonStop Servers using SSH Service version L series: T0801L02 through T0801L02^ABX; J and H series: T0801H01 through T0801H01^ACA was found...
CVE-2017-5803
CVE-2017-5803 describes a remote information disclosure in HPE NonStop Servers via the SSH service. Affected products are HPE NonStop Server SSH on L-series (T0801L02 through T0801L02^ABX) and J/H-series (T0801H01 through T0801H01^ACA). The vulnerability enables an attacker with network access (n...
PT-2018-8279
Name of the Vulnerable Software and Affected Versions HPE NonStop Servers using SSH Service version L series: T0801L02 through T0801L02^ABX HPE NonStop Servers using SSH Service version J and H series: T0801H01 through T0801H01^ACA Description A Remote Disclosure of Information issue was found in...
CVE-2017-5803: Exposure of Sensitive Information to an Unauthorized Actor
A Remote Disclosure of Information vulnerability in HPE NonStop Servers using SSH Service version L series: T0801L02 through T0801L02^ABX; J and H series: T0801H01 through T0801H01^ACA was found...
Coalition, Inc.: Non-Cloudflare IPs allowed to access origin servers
Hello Security Team, Summary: Like report 255978 It is possible to access origin servers served by nginx and not cloudflare. Description: Even though these IP's don't serve a functional version of the app it is possible to enable DDoS attacks by bypassing cloudflare protections. Steps To Reproduc...
Two Nasty Outlook Bugs Fixed in Microsoft’s Feb. Patch Tuesday Update
Microsoft issued 50 security fixes as part of its February Patch Tuesday release, covering vulnerabilities in Windows, Office, Internet Explorer, Edge and its JavaScript engine ChakraCore. Fourteen of the vulnerabilities are labeled as critical, 34 as important and two as moderate. Two notable...
February 13, 2018—KB4074587 (Security-only update)
None None...
February 13, 2018—KB4074598 (Monthly Rollup)
None None...
MISP app/Controller/ServersController.php file OS command injection vulnerability
MISP is a suite of open source software solutions for collecting, storing, distributing and sharing cybersecurity metrics and threats cybersecurity event analysis and malware analysis. A security vulnerability exists in the app/Controller/ServersController.php file in MISP version 2.4.87. An...
Valve: ImageMagick GIF coder vulnerability leading to memory disclosure
Due to CVE-2017-15277, portions of server memory on some steamcommunity web servers could be leaked via image updates. An attacker would not be able to control what memory would be returned, but system information could be obtained. I was able to arbitrarily disclose server memory on...
Hardcoded credentials
VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information, and consequently execute arbitrary code, via a crafted certificate, as demonstrated by leveraging a hardcoded...
CVE-2018-6827
VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information, and consequently execute arbitrary code, via a crafted certificate, as demonstrated by leveraging a hardcoded...