12443 matches found
CVE-2017-11349
dataTaker DT8x dEX 1.72.007 allows remote attackers to compose programs or schedules, for purposes such as sending e-mail messages or making outbound connections to FTP servers for uploading data...
CVE-2017-1000020: Improper Authentication
SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. "eCos Embedded Web Servers used by Multiple Routers and Home devices, while sending SYN Flood or FIN Flood packets fails to validate and handle the packets and does not ask for any si...
CVE-2016-4984: Concurrent Execution using Shared Resource with Improper Synchronization
/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it...
CVE-2016-4984
/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it...
CVE-2016-4984
CVE-2016-4984 affects openldap-servers; the issue is a race condition in /usr/libexec/openldap/generate-server-cert.sh that leads to weak permissions on the TLS certificate. This allows a local authenticated user to obtain the TLS certificate by exploiting the creation/chmod race. The IBM X-Force...
CVE-2016-4984
/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it...
USN-3353-2: Samba vulnerability
USN-3353-1 fixed a vulnerability in Heimdal. This update provides the corresponding update for Samba. Jeffrey Altman, Viktor Dukhovni, and Nicolas Williams discovered that Samba clients incorrectly trusted unauthenticated portions of Kerberos tickets. A remote attacker could use this to impersona...
PT-2017-8636
Name of the Vulnerable Software and Affected Versions openldap-servers affected versions not specified Description The issue concerns a script in openldap-servers that sets weak permissions for the TLS certificate, allowing local users to obtain the certificate by exploiting a race condition...
CVE-2017-1000020
The CVE-2017-1000020 entry describes an authentication bypass in eCos Embedded Web Servers used by multiple routers and home devices. The vulnerability arises when handling SYN/FIN flood packets, where the affected web server fails to validate or require authentication, enabling an attacker to re...
CVE-2017-1000020
SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. "eCos Embedded Web Servers used by Multiple Routers and Home devices, while sending SYN Flood or FIN Flood packets fails to validate and handle the packets and does not ask for any si...
Attackers Using Automated Scans to Takeover WordPress Installs
Attackers have been setting their sights on freshly installed WordPress deployments, taking advantage of users who fail to follow through when it comes to configuring their server’s settings. Researchers at the WordPress security plugin WordFence said Tuesday they observed a significant spike in...
PT-2017-2688
Name of the Vulnerable Software and Affected Versions eCos versions 1 and other versions ECos Embedded Web Servers affected versions not specified Description The issue is related to a web authentication bypass in eCos Embedded Web Servers used by multiple routers and home devices. When sending S...
Katyusha Scanner — Telegram-based Fully Automated SQL Injection Tool
A new powerful hacking tool recently introduced in an underground forum is making rounds these days, allowing anyone to rapidly conduct website scans for SQL injection flaws on a massive scale — all controlled from a smartphone using the Telegram messaging application. Dubbed Katyusha Scanner, th...
Microsoft Addresses NTLM Bugs That Facilitate Credential Relay Attacks
NTLM has a long history of serious vulnerabilities and of causing anxiety for Windows and UNIX server admins. Their collective angst is unlikely to lessen today with the disclosure of a pair of new vulnerabilities in the protocol suite. Microsoft today patched one of the issues among its Patch...
Microsoft Office CVE-2017-0243 Remote Code Execution Vulnerability
Description Microsoft Office is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected Microsoft...
Debian DLA-1019-1 : phpldapadmin security update
It was discovered that there was a cross-site scripting XSS vulnerability in phpldapadmin, a web-based interface for administering LDAP servers. For Debian 7 'Wheezy', this issue has been fixed in phpldapadmin version 1.2.2-5+deb7u1. We recommend that you upgrade your phpldapadmin packages. NOTE:...
EulerOS 2.0 SP2 : pidgin (EulerOS-SA-2017-1131)
According to the version of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service application crash via ...
Git downloads over HTTP
SourceTree downloads the standalone Git and every other zips over HTTP from the Atlassian servers. This is not secure and should be switched to HTTPS...
Threat Round-up for June 30 - July 07
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 30 and July 07. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics,...
