CVE-2017-5244

Routes used to stop running Metasploit tasks either particular ones or all tasks allowed GET requests. Only POST requests should have been allowed, as the stop/stopall routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting...

CVE-2017-5244

Routes used to stop running Metasploit tasks either particular ones or all tasks allowed GET requests. Only POST requests should have been allowed, as the stop/stopall routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting...

CVE-2017-5244: Cross-Site Request Forgery (CSRF)

Routes used to stop running Metasploit tasks either particular ones or all tasks allowed GET requests. Only POST requests should have been allowed, as the stop/stopall routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting...

PT-2017-16418

Name of the Vulnerable Software and Affected Versions Metasploit versions prior to 4.14.0 Update 2017061301 Description A security issue allowed GET requests to stop running tasks, which should only be allowed via POST requests, as these actions change the service state. This could have enabled a...

The installer of SemiDynaEXE provided by Geospatial Information Authority of Japan (GSI) may insecurely load Dynamic Link Libraries

Overview The installer of SemiDynaEXE SemiDynaEXE2008.EXE provided by Geospatial Information Authority of Japan GSI contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Eili Masami of Tachibana Lab. reported this vulnerability to IPA...

Error: "Stop error code 0x00000074 (BAD_SYSTEM_CONFIG_INFO)" When You Start VDI

The following error is displayed when you boot VDI: Stop error code 0x00000074 BADSYSTEMCONFIGINFO...

Empirical Project Monitor - eXtended vulnerable to cross-site scripting

Overview Empirical Project Monitor - eXtended provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA contains a stored cross-site scripting vulnerability CWE-79. Note that this vulnerability is different from JVN11326581. Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. report...

OracleVM 3.2 : Unbreakable / etc (OVMSA-2017-0106)

The remote OracleVM system is missing necessary patches to address critical security updates : - nfsd: stricter decoding of write-like NFSv2/v3 ops J. Bruce Fields Orabug: 25986995 CVE-2017-7895 - ocfs2/o2net: o2netlistendataready should do nothing if socket state is not TCPLISTEN Tariq Saeed...

Unbreakable Enterprise kernel security update

2.6.39-400.295.2 - nfsd: stricter decoding of write-like NFSv2/v3 ops J. Bruce Fields Orabug: 25986995 CVE-2017-7895 2.6.39-400.295.1 - ocfs2/o2net: o2netlistendataready should do nothing if socket state is not TCPLISTEN Tariq Saeed Orabug: 25510857 - IB/CORE: sync the resouce access in fmrpool...

Update for the .NET Framework 4.5.2 on Windows Server 2012 (KB4020506): May 2, 2017

Update for the .NET Framework 4.5.2 on Windows Server 2012 KB4020506: May 2, 2017 View products that this article applies to. Introduction This article describes an update for the .NET Framework 4.5.2 on Windows Server 2012. The update fixes the issue that is described in Knowledge Base article...

Microsoft Windows Denial of Service Vulnerability (CNVD-2017-05724)

Microsoft Windows is the popular computer operating system. Microsoft Windows does not properly handle memory objects and is implemented with a denial-of-service vulnerability that can be exploited by an attacker to cause the target system to stop responding...

Schneider Electric Modicon PLC Multiple Authentication Bypass Vulnerability

Modicon PLCs are programmable controller products used in industries such as dams, energy, food and agriculture, and more. A multiple authentication bypass vulnerability exists in the Schneider Electric Modicon PLC, where once a session key is obtained for plaintext transmission, an attacker can...

Stop Call Me - Call Blocker - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Stop Call Me - Call Blocker published at the 'play' market has multiple vulnerabilities...

Stop User Enumeration 1.3.5-1.3.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The Stop User Enumeration WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/?author=1...

"0x000000D1" Stop error with update rollups on Windows Server 2012 R2

"0x000000D1" Stop error with update rollups on Windows Server 2012 R2 Symptoms Device-specific modules DSM provided by a third-party storage manufacturer crash, and you receive a "0x000000D1" Stop error in the DSM if the September 2016 update rollup or any subsequent rollup except for security-on...

"STOP: 0x0000007E" error occurs when you write some data onto a CD or DVD in Windows Server 2008 R2 or in Windows 7

"STOP: 0x0000007E" error occurs when you write some data onto a CD or DVD in Windows Server 2008 R2 or in Windows 7 Not sure if this is the right fix? We've added this issue to our memory dump diagnostic which can confirm. Symptoms When you try to write some data onto a CD or DVD on a computer th...

Update Rollup 7 for System Center 2012 R2 Orchestrator

Update Rollup 7 for System Center 2012 R2 Orchestrator Introduction This article describes the issues that are fixed in Update Rollup 7 for Microsoft System Center 2012 R2 Orchestrator. It also contains the installation instructions for Update Rollup 7 for System Center 2012 R2 Orchestrator. Issu...

JVN#71538099: Olive Diary DX vulnerable to cross-site scripting

Olive Diary DX provided by Olive Design contains a cross-site scripting vulnerability CWE-79 due to a flaw in processing the page parameter. Impact An artbitrary script may be executed on the user's web browser. Solution Do not use Olive Diary DX Olive Diary DX is no longer being developed or...

CVE-2016-7910

Use-after-free vulnerability in the diskseqfstop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed...

Design/Logic Flaw

Use-after-free vulnerability in the diskseqfstop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed...