11258 matches found
Amplification Attacks
PowerDNS Recursor is vulnerable toamplification attacks. It does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafte...
Researcher Demonstrates 4 New Variants of HTTP Request Smuggling Attack
A new research has identified four new variants of HTTP request smuggling attacks that work against various commercial off-the-shelf web servers and HTTP proxy servers. Amit Klein, VP of Security Research at SafeBreach who presented the findings today at the Black Hat security conference, said th...
Researcher Demonstrates 4 New Variants of HTTP Request Smuggling Attack
A new research has identified four new variants of HTTP request smuggling attacks that work against various commercial off-the-shelf web servers and HTTP proxy servers. Amit Klein, VP of Security Research at SafeBreach who presented the findings today at the Black Hat security conference, said th...
Black Hat Presentation - Web Cache Entanglement
Overview Akamai is aware of the 'Web Cache Entanglement: Novel Pathways to Poisoning' presentation at BlackHat on August 5, 2020. Two security vulnerabilities related to our content delivery networks' caching functionality were presented as part of this research. Akamai would like to thank James...
[SECURITY] Fedora 32 Update: clamav-0.102.4-1.fc32
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...
Pi-hole Command Injection Vulnerability
Pi-hole is a multi-platform, network-wide ad-blocking tool with support for... ,.., A command injection vulnerability exists in Pi-Hole 4.4. An attacker can exploit this vulnerability by writing to /etc/pihole/dns-servers.conf to achieve elevation of privilege...
Fedora: Security Advisory for clamav (FEDORA-2020-dd0c20d985)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
active-servers.com Cross Site Scripting vulnerability OBB-1243049
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-12620
Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection shell metacharacters after an IP address...
Zoom Bug Allowed Snoopers Crack Private Meeting Passwords in Minutes
Popular video conferencing app Zoom recently fixed a new security flaw that could have allowed potential attackers to crack the numeric passcode used to secure private meetings on the platform and snoop on participants. Zoom meetings are by default protected by a six-digit numeric password, but...
EulerOS 2.0 SP8 : golang (EulerOS-SA-2020-1804)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, becau...
HPESBHF04019 rev.5 - Systems with Secure Boot enabled and GRUB2 vulnerability, Multiple Local Arbitrary Code Execution
Potential Security Impact: Local: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Intelligent Provisioning Gen10 and Gen10 Plus Servers - Prior to v3.46, Gen9 v2.82, Gen8 v1.72 HPE Service Pack for ProLiant - Prior to 2020.03.2 HPE SmartStart Scripting...
Undetectable Linux Malware Targeting Docker Servers With Exposed APIs
Cybersecurity researchers today uncovered a completely undetectable Linux malware that exploits undocumented techniques to stay under the radar and targets publicly accessible Docker servers hosted with popular cloud platforms, including AWS, Azure, and Alibaba Cloud. Docker is a popular...
Undetectable Linux Malware Targeting Docker Servers With Exposed APIs
Cybersecurity researchers today uncovered a completely undetectable Linux malware that exploits undocumented techniques to stay under the radar and targets publicly accessible Docker servers hosted with popular cloud platforms, including AWS, Azure, and Alibaba Cloud. Docker is a popular...
Embedthis GoAhead < 4.1.4, 5.x < 5.1.2 Replay Attack Vulnerability
Embedthis GoAhead is prone to a replay attack vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:embedthis:goahead";...
Security Bulletin: Novalink is impacted by Man in the middle vulnerability in WebSphere Application Server Liberty (CVE-2014-3603)
Summary Novalink uses WebSphere Application Server Liberty. There is a man in the middle vulnerability in WebSphere Application Server Liberty. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2014-3603 DESCRIPTION: Shibboleth Identity Provider IdP and OpenSAML Java could...
CVE-2020-15103
In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data th...
DJI Drone App Riddled With Privacy Issues, Researchers Allege
Leading commercial drone maker DJI is hitting back against researcher allegations that its Android mobile application is riddled with privacy holes. One includes that the app continues to run in the background even after it’s been closed and collects sensitive data from users without consent. The...
XSS Vulnerability in ZTE Servers
Shenzhen ZTE Mobile Communications Co., Ltd. was founded in 2002, headquartered in Shenzhen High-tech Industrial Park, for the national high-tech enterprises. An XSS vulnerability exists in the ZTE server, which can be exploited by attackers to obtain user cookie information...
PYSEC-2020-51
In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12...