11307 matches found
Security update for wget (important)
This update for wget fixes the following security issues: - CVE-2017-13089,CVE-2017-13090: Missing checks for negative remainingchunksize in skipshortbody and fdreadbody could cause stack buffer overflows, which could have been exploited by malicious servers. bsc1064715,bsc1064716 This update was...
CVE-2017-6159
F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 are vulnerable to a denial of service attack when the MPTCP option is enabled on a virtual server. Data plane is vulnerable when using the MPTCP option of a TC...
CVE-2017-6160
In F5 BIG-IP AAM and PEM software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.4.1 to 11.5.4, a remote attacker may create maliciously crafted HTTP request to cause Traffic Management Microkernel TMM to restart and temporarily fail to process traffic. This issue is exposed on virtual servers...
CVE-2017-6160
In F5 BIG-IP AAM and PEM software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.4.1 to 11.5.4, a remote attacker may create maliciously crafted HTTP request to cause Traffic Management Microkernel TMM to restart and temporarily fail to process traffic. This issue is exposed on virtual servers...
F5 Networks BIG-IP : TMM vulnerability (K19430431)
A remote attacker may create maliciously crafted HTTP request to cause Traffic Management Microkernel TMM to restart and temporarily fail to process traffic. This issue is exposed on virtual servers using a Policy Enforcement profile or a Web Acceleration profile. CVE-2017-6160 Impact The Traffic...
Android Private Internet Access Denial Of Service
Original post here: http://wwws.nightwatchcybersecurity.com/2017/10/25/advisory-pia-android-app-cve-2017-15882/ SUMMARY The Android application provided by Private Internet Access PIA VPN service can be crashed by downloading a large file containing a list of current VPN servers. This can be...
HackerOne: Private partial disclosure of h1 infrastructure
Description I've found that following servers & services can be potentially interesting when attacking h1-infrastructure: Payments Admin ██████ API Docs ██████████ API █████████ MailCatcher ██████████ Story Book ███ Karma ████████ Core Test Server █████████ Core Staging ████ Core Production...
[SECURITY] Fedora 25 Update: procmail-3.22-44.fc25
Procmail can be used to create mail-servers, mailing lists, sort your incoming mail into separate folders/files real convenient when subscribing to one or more mailing lists or for prioritising your mail, preprocess your mail, start any programs upon mail arrival e.g. to generate different chimes...
Anonymous SQL Execution in Oracle Advanced Support
A little over a year ago I was performing a penetration test on a client's external environment. One crucial step in any external penetration test is mapping out accessible web servers. The combination of nmap with EyeWitness make this step rather quick as we can perform port scanning for web...
Oracle Sun Systems Products Suite SPARC M7, T7 and S7 based Servers Component Denial of Service Vulnerability
Oracle Sun Systems Products Suite is a suite of Sun systems products from Oracle Corporation.SPARC M7, T7, and S7 based Servers are among the servers that... A security vulnerability exists in the Firmware subcomponent of the SPARC M7, T7, and S7 based Servers component of the Oracle Sun Systems...
newrelic_rpm Gem Discloses Sensitive Information
Ruby agent 3.2.0 through 3.5.3.23 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information database credentials and SQL statements by sniffing the network and deserializing the data...
OpenJDK: no default network operations timeouts in FtpClient (Networking, 8181612)
It was found that the FtpClient implementation in the Networking component of OpenJDK did not set connect and read timeouts by default. A malicious FTP server or a man-in-the-middle attacker could use this flaw to block execution of a Java application connecting to an FTP server...
Moderate severity vulnerability that affects rails
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.fromxml Hashfromxml method, which uses XmlSimple XML::Simple unsafely, as demonstrated by reading passwords fro...
XSS Vulnerability in JIRA Issue Export
A search endpoint is vulnerable to an XSS injection in certain cases. Normally, the browser will urlencode its requests, but some proxy servers and load balancers will decode URL data by default. see http://stackoverflow.com/questions/31266629/nginx-encoding-normalizing-part-of-uri...
XSS Vulnerability in JIRA Issue Export
A search endpoint is vulnerable to an XSS injection in certain cases. Normally, the browser will urlencode its requests, but some proxy servers and load balancers will decode URL data by default. see http://stackoverflow.com/questions/31266629/nginx-encoding-normalizing-part-of-uri...
CVE-2017-10314
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Memcached. Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromis...
Code injection
Vulnerability in the SPARC M7, T7, S7 based Servers component of Oracle Sun Systems Products Suite subcomponent: Firmware. The supported version that is affected is Prior to 9.7.6.b. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where SPARC M7,...
CVE-2017-10099
CVE-2017-10099 affects SPARC M7, T7, and S7 based Servers (Firmware subcomponent) in Oracle Sun Systems Products Suite. The vulnerability is exploitable locally on systems where the SPARC hardware runs; with a logon, an attacker can cause a hang or frequent, repeatable crashes (complete denial of...