Cisco AnyConnect Secure Mobility Client Local Privilege Escalation Vulnerability

A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. The vulnerability is due to incomplete input...

Security Advisory - Two Command Injection Vulnerabilities in Huawei UMA

The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA has two command injection vulnerabilities due to the lack of validation on special fields. A...

Security Advisory - Uncontrolled Format String Vulnerability on Multiple Products

Several Huawei routers and switches have an uncontrolled format string vulnerability when processing partial commands. An authenticated attacker could exploit this vulnerability to cause a denial of service. Vulnerability ID: HWPSIRT-2016-07011 This vulnerability has been assigned Common...

Security Advisory - IPv6 Neighbor Discovery Crafted Packet Denial of Service Vulnerability

There is a vulnerability in the IP Version 6 IPv6 Neighbor Discovery packet process of multiple products, successful exploit could allow an unauthenticated, remote attacker to cause an affected device to start dropping legitimate IPv6 neighbors as legitimate ND times out, leading to a denial of...

Security Advisory - Information Leak Vulnerability in Huawei FusionSphere Product

The open-source component Xenstore in the FusionSphere has an information leak vulnerability due to loose security settings. Successful exploit could allow an authenticated attacker to obtain partial information from virtual machines. Vulnerability ID: HWPSIRT-2016-06067. Huawei has released...

Cisco Exploit Leaked in NSA Hack Modifies to Target Latest Version of Firewalls

Recently released NSA exploit from "The Shadow Brokers" leak that affects older versions of Cisco System firewalls can work against newer models as well. Dubbed ExtraBacon, the exploit was restricted to versions 8.4.4 and earlier versions of Cisco's Adaptive Security Appliance ASA – a line of...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation for some of t...

Cisco Firepower Management Center Remote Command Execution Vulnerability

A vulnerability in the web-based GUI of Cisco Firepower Management Center and Cisco Adaptive Security Appliance ASA 5500-X Series with FirePOWER Services could allow an authenticated, remote attacker to perform unauthorized remote command execution on the affected device. The vulnerability is due...

Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP code of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected...

Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability

A vulnerability in the command-line interface CLI parser of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, local attacker to create a denial of service DoS condition or potentially execute arbitrary code. An attacker could exploit this vulnerability by invoking certa...

Cisco Unified Communications Manager Information Disclosure Vulnerability

A vulnerability in the User Data Services UDS Application Programming Interface API for Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view confidential information that should require authentication. The vulnerability is due to improper authentication...

Cisco Application Policy Infrastructure Controller Enterprise Module Remote Code Execution Vulnerability

A vulnerability in the Grapevine update process of the Cisco Application Policy Infrastructure Controller Enterprise Module APIC-EM could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the root user. The vulnerabilit...

Cisco WebEx Meetings Server Information Disclosure Vulnerability

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data. The vulnerability is due to lack of proper authentication controls. An attacker could exploit this vulnerability to learn sensitive information about the application. Cisco has...

Cisco Firepower Management Center Privilege Escalation Vulnerability

A vulnerability in the web-based GUI of Cisco Firepower Management Center and Cisco Adaptive Security Appliance ASA 5500-X Series with FirePOWER Services could allow an authenticated, remote attacker to elevate the privileges of user accounts on the affected device. The vulnerability is due to...

Security Advisory - Input Validation Vulnerability in Huawei Access Controllers

There is an input validation vulnerability in Huawei access controllers AC. Due to the lack of input validation, an attacker may craft malformed Control And Provisioning of Wireless Access Points CAPWAP protocol packets and send them to the device, causing the device to restart. Vulnerability ID:...

Security Advisory - Brute Force Cracking Vulnerability in Huawei Servers

Huawei server has a brute-force cracking vulnerability due to the lack of authentication protection mechanisms. A remote attacker may obtain user passwords via a brute force attack. Vulnerability ID: HWPSIRT-2016-05247 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE...

Security Advisory - Information Leak Vulnerability in Some Huawei Servers

Some Huawei servers have an information leak vulnerability. The servers allow users to select security encryption algorithms. If an insecure encryption algorithm is selected, an attacker may decrypt ciphertext data, causing information leaks. Vulnerability ID: HWPSIRT-2016-07019 This vulnerabilit...

Security Advisory - Improper Input Validation Vulnerability in AnyMail

Huawei AnyMail has an improper input validation vulnerability when opening compressed email attachments. Successful exploit could cause AnyMail to crash and exit. Vulnerability ID: HWPSIRT-2016-06099 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2016-6826...

Security Advisory - Cleartext Storage of Crytographic Key Vulnerability in FusionCompute

FusionCompute has a key cleartext storage vulnerability. Successful exploit could allow an attacker to obtain AES keys. Vulnerability ID: HWPSIRT-2016-06076 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2016-6827. Huawei has released software updates to fix...

SUSE-SU-2016:2053-1 Security update for libvirt

This update for libvirt fixes one security issue: - CVE-2016-5008: Empty VNC password disables authentication. bsc987527 Additionally, the update includes the following non-security fixes: - Improve waiting for block job readines in virsh. bsc989755 - Parse negative values in augeas lenses...