Cisco Firepower Management Center and FireSIGHT System Software Cross-Site Request Forgery Vulnerability

A cross-site request forgery CSRF vulnerability for Cisco Firepower Management Center and Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of CSRF protections by an affected device. An attacker could...

Cisco IOS XE Software NAT Denial of Service Vulnerability

A vulnerability in the implementation of Network Address Translation NAT functionality in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper handling of malformed ICMP packets by the affected software. ...

Security Advisory - Path Traversal Vulnerability in Multiple Huawei Products

Multiple Huawei products have a path traversal vulnerability. Due to the insufficient path validation, an authenticated attacker may exploit this vulnerability to download some files without authorization, causing information leak. Vulnerability ID: HWPSIRT-2016-07025 This vulnerability has been...

Security Advisory - Privilege Escalation Vulnerability in Huawei Multiple Smart Phones

There is a privilege escalation vulnerability in Android kernel due to the lack of a parameters check. An attacker may trick a user into installing a malicious application, and the application can modify the data of kernel to crash the system or escalate user privilege. Vulnerability ID:...

Cisco Email Security Appliance Internal Testing Interface Vulnerability

A vulnerability in Cisco IronPort AsyncOS for Cisco Email Security Appliances ESA could allow an unauthenticated, remote attacker to obtain complete control of an affected device. The vulnerability is due to the presence of a Cisco internal testing and debugging interface intended for use during...

Cisco Cloud Services Platform 2100 Remote Command Execution Vulnerability

A vulnerability in the web interface of Cisco Cloud Services Platform CSP 2100 could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability is due to insufficient sanitization of specific values received as part of a user-supplied HTTP request...

Cisco Application-Hosting Framework HTTP Header Injection Vulnerability

A vulnerability in the Cisco Application-hosting Framework CAF component for Cisco IOS and IOS XE Software with the IOx feature set could allow an unauthenticated, remote attacker to cause a CAF user to download a file controlled by the attacker. The vulnerability is due to insufficient input...

Cisco Firepower Management Center and FireSIGHT System Software SSLIinspection Bypass Vulnerability

A vulnerability in SSL inspection for Cisco Firepower Management Center and Cisco FireSIGHT System software could allow an unauthenticated, remote attacker to bypass configured do-not-decrypt rules in the SSL policy rule set. The vulnerability is due to lack of verification of the user input...

Cisco Cloud Services Platform 2100 Command Injection Vulnerability

A vulnerability in the web-based GUI of the Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the root user. The vulnerability is due to insufficient sanitization of user-supplie...

Cisco Application Policy Infrastructure Controller Binary Privilege Escalation Vulnerability

A vulnerability in the installation procedure for Cisco Application Policy Infrastructure Controller APIC devices could allow an authenticated, local attacker to gain root-level privileges. The vulnerability is due to incorrect installation and permissions settings for binary files when installin...

Cisco IOS and IOS XE Software Application-Hosting Framework Unauthorized File Access Vulnerability

A vulnerability in the Cisco application-hosting framework CAF for Cisco IOS and IOS XE Software with the IOx feature set could allow an authenticated, remote attacker to read arbitrary files on a targeted system. The vulnerability is due to insufficient input validation by the affected framework...

Security Advisory - DoS Vulnerability in Multiple Huawei Products

There is a DoS vulnerability in some Huawei products. A remote attacker can directly access the device through a certain URL without login authentication, which can make the device restart. Vulnerability ID: HWPSIRT-2016-06063 This vulnerability has been assigned Common Vulnerabilities and...

Security Advisory - DoS Vulnerability in Multiple Huawei Products

There is a DoS vulnerability in some Huawei products. Since the device does not validate the parameters in a certain command, an attacker with certain permissions could log in and deliver the command containing a malicious parameter to make the device restart. Vulnerability ID: HWPSIRT-2016-06064...

Security Advisory - DOS Vulnerability in Video Driver of Huawei Smart Phone

There is a Denial of Service DoS vulnerability in the video driver of some Huawei products. An attacker may trick a user into installing a malicious application, and the application can send given parameter to video driver to reboot the system. Vulnerability ID: HWPSIRT-2016-08046 This...

Cisco finds new Zero-Day Exploit linked to NSA Hackers

Network equipment vendor Cisco is finally warning its customers of another zero-day vulnerability the company discovered in the trove of NSA's hacking exploits and implants leaked by the group calling itself "The Shadow Brokers." Last month, the Shadow Brokers published firewall exploits, implant...

CVE-2016-4741

The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an HTTPS session for retrieving updates...

CVE-2016-4741

The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an HTTPS session for retrieving updates...

Design/Logic Flaw

The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an HTTPS session for retrieving updates...

CVE-2016-4741

The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an HTTPS session for retrieving updates...

CVE-2016-4741

CVE-2016-4741 : In iOS up to version 9.x, the Assets component could be exploited by a network-positioned attacker to block software updates by abusing the lack of HTTPS when retrieving updates. The NVD entry describes an update-blocking MITM condition, and Apple’s security content for iOS 10 con...