Cisco IOS and IOS XE Software ZBFW Feature Security Bypass Vulnerability

Cisco IOS and IOS XE Software are operating systems developed by Cisco for its network devices.Zone-Based Firewall ZBFW is one of the policy firewall components. A security bypass vulnerability exists in the ZBFW feature in Cisco IOS and IOS XE Software, which stems from the program failing to...

Cross site scripting

The Zone-Based Firewall ZBFW functionality in Cisco IOS, possibly 15.4 and earlier, and IOS XE, possibly 3.13 and earlier, mishandles zone checking for existing sessions, which allows remote attackers to bypass intended resource-access restrictions via spoofed traffic that matches one of these...

CVE-2014-2146

Cisco IOS and IOS XE Zone-Based Firewall (ZBFW) features (likely IOS 15.4 and earlier; IOS XE 3.13 and earlier) are affected by a vulnerability in zone checking for existing sessions. This mishandling allows unauthenticated, remote attackers to bypass resource-access restrictions by injecting spo...

CVE-2014-2146

The Zone-Based Firewall ZBFW functionality in Cisco IOS, possibly 15.4 and earlier, and IOS XE, possibly 3.13 and earlier, mishandles zone checking for existing sessions, which allows remote attackers to bypass intended resource-access restrictions via spoofed traffic that matches one of these...

PT-2016-3487

Name of the Vulnerable Software and Affected Versions Cisco IOS versions prior to 15.4 Cisco IOS XE versions prior to 3.13 Description The issue concerns the Zone-Based Firewall functionality, which improperly handles zone checking for existing sessions. This allows remote attackers to bypass...

CVE-2014-2146: Improper Input Validation

The Zone-Based Firewall ZBFW functionality in Cisco IOS, possibly 15.4 and earlier, and IOS XE, possibly 3.13 and earlier, mishandles zone checking for existing sessions, which allows remote attackers to bypass intended resource-access restrictions via spoofed traffic that matches one of these...

Skyliner: DNSSEC misconfiguration

First of all I will start with some theory. DNS is a system to translate a domain name to an ip address. Normally a computer automatically trust a DNS server and connects to the IP provided by the DNS server. This is prone to security issues because a malicious wifi network, an attacker on your...

CVE-2016-3353

Microsoft Internet Explorer 9 through 11 mishandles .url files from the Internet zone, which allows remote attackers to bypass intended access restrictions via a crafted file, aka "Internet Explorer Security Feature Bypass."...

CVE-2016-3292

Microsoft Internet Explorer 10 and 11 mishandles integrity settings and zone settings, which allows remote attackers to bypass a sandbox protection mechanism via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."...

CVE-2016-3353: Undefined Security Weakness

Microsoft Internet Explorer 9 through 11 mishandles .url files from the Internet zone, which allows remote attackers to bypass intended access restrictions via a crafted file, aka "Internet Explorer Security Feature Bypass."...

Internet Explorer Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Internet Explorer fails a check, allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system. This vulnerability by itself does not allow arbitrary co...

PT-2016-2744 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 9 through 11 Description: The issue is related to how Internet Explorer handles files with the .url extension from the Internet zone, allowing a remote attacker to bypass access restrictions using a specially crafte...

Joyent SmartOS dtrace Zone Escape Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Joyent SmartOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the dtrace...

FreeBSD : BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers (7d08e608-5e95-11e6-b334-002590263bf5)

ISC reports : DNS protocols were designed with the assumption that a certain amount of trust could be presumed between the operators of primary and secondary servers for a given zone. However, in current practice some organizations have scenarios which require them to accept zone data from source...

Joyent Smart Data Center Docker API Zone Escape Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within a Docker...

Joyent SmartOS dtrace Zone Escape Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Joyent SmartOS. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists within the dtrace implementation in SmartOS. A meth...

Instacart: Cross-Site Request Forgery (CSRF)

Hello, i found Cross-Site Request Forgery CSRF that can change any user ZONE POC: put Zone you want send the request to any user and you will change his Zone Please Watch My POC I Attached For More Details Thanks...

Microsoft Windows Time Zone Information

Nessus was able to collect time zone information from the remote Windows host and generate a report as a CSV attachment. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid92369; scriptversion"1.10"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/06/06...

DNS Analysis Tool: Bluto

The target domain is queried for MX and NS records. Sub-domains are passively gathered via NetCraft. The target domain NS records are each queried for potential Zone Transfers. If none of them gives up their spinach, Bluto will attempt to identify if SubDomain Wild Cards are being used. If they a...

KLA10845 Obsolete Adobe Flash Player for Windows

Microsoft released update to address vulnerabilities in Flash Player for Internet explorer. For details look at KLA10839. Technical details To mitigate this vulnerability you can implement some of workarounds listed in original Microsoft advisory: disable Adobe Flash Player, prevent Adobe FP from...