CVE-2016-7115

Buffer overflow in the handlepacket function in mactelnet.c in the client in MAC-Telnet 0.4.3 and earlier allows remote TELNET servers to execute arbitrary code via a long string in an MTCPTYPEPASSSALT control packet...

Denial of Service Vulnerability in Multiple Intel Solid-State Drive DC Series Products

The Intel Solid-State Drive DC series is available in some Lenovo System X servers. A denial of service vulnerability exists in multiple Intel Solid-State Drive DC Series products. An attacker could exploit the vulnerability to cause a denial of service condition...

Hardcoded credentials

Virtual servers in F5 BIG-IP systems 11.2.1 HF11 through HF15, 11.4.1 HF4 through HF10, 11.5.3 through 11.5.4, 11.6.0 HF5 through HF7, and 12.0.0, when configured with a TCP profile, allow remote attackers to cause a denial of service Traffic Management Microkernel restart via crafted network...

CVE-2016-5023

CVE-2016-5023 affects F5 BIG-IP TMM when virtual servers are configured with a TCP profile. The vulnerability allows a remote attacker to cause a denial-of-service (TMM restart) by sending crafted TCP traffic. Affected versions include various 11.x and 12.0.0 releases with TCP profiles; impact is...

Security Advisory - Resource Management Vulnerability in Huawei Servers

Some Huawei servers have a resource management vulnerability in the iBMC Intelligent Baseboard Management Controller. A local attacker could exploit this vulnerability to exhaust iBMC resources and cause a denial of service. Vulnerability ID: HWPSIRT-2016-05251 This vulnerability has been assigne...

Multiple Huawei Server Authentication Bypass Vulnerabilities

Huawei is a Chinese provider of information and communications solutions. An authentication bypass vulnerability exists in multiple Huawei servers, which can be exploited by an attacker to bypass the authentication mechanism...

HP Integrated Lights-Out (iLO) Multiple Vulnerabilities

HP Integrated Lights-Out iLO is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Advisory - Information Leak Vulnerability in Some Huawei Servers

Some Huawei servers have an information leak vulnerability. The servers allow users to select security encryption algorithms. If an insecure encryption algorithm is selected, an attacker may decrypt ciphertext data, causing information leaks. Vulnerability ID: HWPSIRT-2016-07019 This vulnerabilit...

Glibc DNS Resolver Vulnerability

A vulnerability in the GNU libc glibc DNS resolver allows remote code execution CVE-2015-7547. However, this issue can be exploited only from a DNS server that is under the control of an attacker. Ref 91886. This glibc issue is only exploitable by an attacker controlling the DNS server configured...

FreeBSD : FreeBSD -- Incorrect error handling in PAM policy parser (6e8f9003-6007-11e6-a6c3-14dae9d210b8)

The OpenPAM library searches for policy definitions in several locations. While doing so, the absence of a policy file is a soft failure handled by searching in the next location while the presence of an invalid file is a hard failure handled by returning an error to the caller. The policy parser...

Misuse of Language: 'Cyber'

Threatpost Op-Ed is a regular feature where experts contribute essays and commentary on what’s happening in security and privacy. Today’s contributors are Dave Dittrich and Katherine Carpenter. The terms “cyber war” and “cyber weapon” are thrown around casually, often with little thought to their...

vBulletin 5.2.2 / 4.2.3 / 3.8.9 Server Side Request Forgery

============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-6483 - Release date: 05.08.2016 - Severity: High ============================================= I. VULNERABILITY ------------------------- vBulletin = 5.2....

Asterisk TLS Certificate Common Name NULL Byte Vulnerability (AST-2015-003)

Asterisk is prone to a certificate bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk"; if...

PoloMeeting Video Conferencing Software Elevation of Privilege Vulnerability

PoloMeeting video conferencing software is a network video conferencing system, the system supports full HD, distributed cluster architecture, the main features of the system include: remote audio and video communication, electronic whiteboard, document collaboration, file transfer, text...

CVE-2016-2830

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses...

Code injection

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses...

[SECURITY] Fedora 24 Update: python-autobahn-0.10.9-1.gitcf10233.fc24

Autobahn a networking library that is part of the Autobahn project and prov ides implementations of The WebSocket Protocol http://tools.ietf.org/html/rfc6455 The Web Application Messaging Protocol WAMP http://wamp.ws for Twisted and asyncio on Python 2 & 3 and for writing servers and clients...

Researchers Go Inside a Business Email Compromise Scam

LAS VEGAS – Poor operational security on the part of Nigerian scammers running a Business Email Compromise BEC scheme has given researchers a window into their operations. Dell SecureWorks today published a report at Black Hat USA 2016 on what the criminals involved call wire-wire, or “waya-waya....

Mozilla: Favicon network connection persists when page is closed (MFSA 2016-62)

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses...

CVE-2016-2830

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses...