3651 matches found
polkit security and bug fix update
0.112-22.0.1 - Increase timeout to avoid defunct processes Orabug: 26930744 0.112-22 - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled - Resolves: rhbz1325512 0.112-21 - Mitigation of regression caused by fix of CVE-2018-19788 - Resolves: rhbz1656377 0.112-20 - Fix of...
Oracle Linux 7 : curl (ELSA-2019-1880)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1880 advisory. - CVE-2016-8615 cookie injection for other servers https://curl.haxx.se/docs/CVE-2016-8615.html - CVE-2016-8616 case insensitive password comparison...
SilverSHielD 6.x - Local Privilege Escalation
SilverSHielD 6.x - Local Privilege Escalation This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exploit Title: extenua SilverSHielD 6.x local priviledge escalation Google Dork: na Date: 31 Jul 2019 Exploit Author: Ian...
nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass
It was found that the original fix for Slowloris, CVE-2018-12122, was insufficient. It is possible to bypass the server's headersTimeout by sending two specially crafted HTTP requests in the same connection. An attacker could use this flaw to bypass Slowloris protection, resulting in a denial of...
CVE-2017-8227
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are detected using the Web and HTTP API interface provided by the device. However, if the same brute force attempt is performed using the ONVIF specification which...
Qualys Cloud Platform (VM, PC) 8.20 New Features
This new release of the Qualys Cloud Platform VM, PC, version 8.20, includes several new features in Qualys Cloud Platform and additional support for multiple technologies in Qualys Policy Compliance. Feature Highlights Qualys Cloud Platform Configure Password Expiration Notification – Now users...
Denial Of Service (DoS)
tomcat-coyote/tomcat-embed-core is vulnerable to denial of service. The vulnerability exists due to an incomplete fix of CVE-2019-0199 which is due to the lack of timeout idling streams and keeping the idle streams open without any read/write and request/response data...
tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not...
Pydio Core <= 8.2.2 Information Disclosure Vulnerability - Active Check
Pydio Core is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:pydio:pydio";...
CVE-2019-10046
An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license information...
Information disclosure
An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license information...
CVE-2019-10046
An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license information...
CVE-2019-10046
CVE-2019-10046 affects Pydio 8.2.2 and is an information-disclosure vulnerability where an unauthenticated attacker can obtain details about the application configuration (e.g., session timeout, libraries, license information). Public sources (NVD, RH Red Hat advisory, OpenVAS entry) describe it ...
Password Cracker: Databases
This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from the mssqlhashdump, mysqlhashdump, postgreshashdump, or oraclehashdump modules. Passwords that have been successfully cracked are then saved as proper credentials. Due to the complexity of some of t...
CVE-2019-5626 BlueCats Reveal Android App Insecure Storage
The Android mobile application BlueCats Reveal before 3.0.19 stores the username and password in a clear text file. This file persists until the user logs out or the session times out from non-usage 30 days of no user activity. This can allow an attacker to compromise the affected BlueCats networ...
MiniUPnP MiniUPnPd code issue vulnerability (CNVD-2019-14713)
MiniSSDPd is a daemon for managing SSDPs on Posix systems. MiniUPnP A code issue vulnerability exists in the GetOutboundPinholeTimeout of the upnpsoap.c file used for remport in MiniUPnP MiniUPnPd 2.1 and earlier versions. The vulnerability stems from an improperly designed or implemented code...
Denial Of Service (DoS)
Apache HTTPD is vulnerable to denial of serviceDoS attacks. A remote user could send specially crafted and continuous SETTINGS data for an ongoing HTTP/2 connection to cause the target service to fail to timeout...
UBUNTU-CVE-2019-12109
A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for remport...