what you don't know can hurt you
Showing 1 - 15 of 15 RSS Feed

Files Date: 2017-07-06

Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak
Posted Jul 6, 2017
Authored by Matthew Bergin, Joshua Hardin | Site korelogic.com

The Barracuda WAF management application transmits the current user and session identifier over HTTP GET. Firmware version 8.0.1.014 is affected.

tags | exploit, web
SHA-256 | 7086b580e0510a02f02451754011dfa92817d22fce4942667a0c2c95727a7c68
Barracuda WAF V360 Firmware 8.0.1.014 Grub Password Complexity
Posted Jul 6, 2017
Authored by Matthew Bergin, Joshua Hardin | Site korelogic.com

The grub password for all Barracuda WAF V360 virtual appliances is four characters in length and, as a result, may be trivially easy to crack. Firmware version 8.0.1.014 is affected.

tags | exploit
SHA-256 | c30a6c337f827c7f205331146c21efde524fe526807aea264c31e3482104d705
Barracuda WAF V360 Firmware 8.0.1.014 Credential Disclosure
Posted Jul 6, 2017
Authored by Matthew Bergin, Joshua Hardin | Site korelogic.com

Firmware reversing of the Barracuda Web Application Firewall uncovered development artifacts that should have been removed on the production images. Once the encryption scheme was broken, many QA and development tools were discovered on the affected partitions. Some of these contained sensitive information such as authentication credentials used by internal developers. Firmware version 8.0.1.014 is affected.

tags | exploit, web
SHA-256 | 41af7991ec90055d2e9576142c80137283f105fdc993d700215ae487f134beef
Barracuda WAF V360 Firmware 8.0.1.014 Early Boot Root Shell
Posted Jul 6, 2017
Authored by Matthew Bergin, Joshua Hardin | Site korelogic.com

Firmware reversing of the Barracuda Web Application Firewall uncovered debug features that should have been removed on the production images. Appending a debugging statement onto a grub configuration line leads to an early boot root shell. Firmware version 8.0.1.014 is affected.

tags | exploit, web, shell, root
SHA-256 | e7f34bb9440ee19f081d01c8da99a0e8de3728fcc56a3f073d87f5c8a3cf2ad7
Red Hat Security Advisory 2017-1712-01
Posted Jul 6, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1712-01 - Red Hat 3scale API Management Platform 2.0 is a platform for the management of access and traffic for web-based APIs across a variety of deployment options. Security Fix: It was found that RH-3scale AMP would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. The underlying container image was also rebuilt to resolve other security issues.

tags | advisory, web
systems | linux, redhat
advisories | CVE-2017-1000364, CVE-2017-1000366, CVE-2017-7502, CVE-2017-7512
SHA-256 | a7af4bd1f8c09fdc97fe5d258dbe002aa51401e2d6557029d5dfcf6178099e7a
Red Hat Security Advisory 2017-1685-01
Posted Jul 6, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1685-01 - Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. The following packages have been upgraded to a later upstream version: ansible. Multiple security issues have been addressed.

tags | advisory, remote
systems | linux, redhat
advisories | CVE-2016-8647, CVE-2016-9587, CVE-2017-7466
SHA-256 | 1d9e33be70d21f0ca2aef0ecaa513a40b1302ce3bec5dcda5aa26532682d9fdc
Debian Security Advisory 3903-1
Posted Jul 6, 2017
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3903-1 - Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.

tags | advisory, denial of service, arbitrary, vulnerability
systems | linux, debian
advisories | CVE-2016-10095, CVE-2017-10688, CVE-2017-9147, CVE-2017-9403, CVE-2017-9404, CVE-2017-9936
SHA-256 | 100d44d721275586da4641e875f00e2a6d827015fb9acd1ab296421620396897
Ubuntu Security Notice USN-3321-1
Posted Jul 6, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3321-1 - Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information or execute arbitrary code. Multiple security issues were discovered in the Graphite 2 library used by Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, or execute arbitrary code. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2017-5470, CVE-2017-5472, CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754, CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7764, CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778
SHA-256 | 57e348bea760c2cb4327bbd86d89e9a4d71e13691e4cb0cb59f1f2020a33eef1
Debian Security Advisory 3902-1
Posted Jul 6, 2017
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3902-1 - It was discovered that jabberd2, a Jabber instant messenger server, allowed anonymous SASL connections, even if disabled in the configuration.

tags | advisory
systems | linux, debian
advisories | CVE-2017-10807
SHA-256 | f3fca465334cf0139b71bc1b370e9127b510b164075fbc9d2e4066f51dbff26f
Ubuntu Security Notice USN-3349-1
Posted Jul 6, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3349-1 - Yihan Lian discovered that NTP incorrectly handled certain large request data values. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. Miroslav Lichvar discovered that NTP incorrectly handled certain spoofed addresses when performing rate limiting. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. Various other issues were also addressed.

tags | advisory, remote, denial of service, spoof
systems | linux, ubuntu
advisories | CVE-2016-2519, CVE-2016-7426, CVE-2016-7427, CVE-2016-7428, CVE-2016-7429, CVE-2016-7431, CVE-2016-7433, CVE-2016-7434, CVE-2016-9042, CVE-2016-9310, CVE-2016-9311, CVE-2017-6458, CVE-2017-6460, CVE-2017-6462, CVE-2017-6463, CVE-2017-6464
SHA-256 | 359f86f0252b15d6299bffee359feeea850698a32c5afa2a570d94db465a75ab
Ubuntu Security Notice USN-3348-1
Posted Jul 6, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3348-1 - It was discovered that Samba incorrectly handled dangling symlinks. A remote attacker could possibly use this issue to cause Samba to hang, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. In addition, this update fixes a regression introduced by USN-3267-1 that caused Samba to incorrectly handle non-wide symlinks to directories.

tags | advisory, remote, denial of service
systems | linux, ubuntu
advisories | CVE-2017-9461
SHA-256 | 17cf083be8a7db836a16947d05cebefa9dbf6406ef22b45553fe1b9760462e74
LibTIFF 4.0.7 _TIFFVGetField (tiffsplit) Out-Of-Bounds Read
Posted Jul 6, 2017
Authored by zhangtan

LibTIFF version 4.0.7 suffers from a _TIFFVGetField (tiffsplit) out-of-bounds read vulnerability.

tags | exploit
advisories | CVE-2017-9147
SHA-256 | 5d4e42b44d706946d69bc7503e51abb36b8953e7b1033ff9d0d190155d246500
LibTIFF 4.0.8 tif_jbig.c Denial Of Service
Posted Jul 6, 2017
Authored by Team OWL337

LibTIFF versions 4.0.8 and below suffer from a denial of service vulnerability in tif_jbig.c.

tags | exploit, denial of service
advisories | CVE-2017-9936
SHA-256 | 821d97ab87400616baf2918bd9a12d941c6698d05acf61a7f5c8b28c7e2055df
HP Security Bulletin HPSBMU02933 3
Posted Jul 6, 2017
Authored by HP | Site hp.com

HP Security Bulletin HPSBMU02933 3 - A potential security vulnerability has been identified with HPE SiteScope's loadFileContents SOAP features. The vulnerabilities could be exploited to allow remote code execution, arbitrary file download and Denial of Service (DoS). Revision 3 of this advisory.

tags | advisory, remote, denial of service, arbitrary, vulnerability, code execution
advisories | CVE-2013-4835, CVE-2013-6207
SHA-256 | 9de6c472c0bfacf8870bd1a3961b3220a492329eec58711c15faba3945248411
LibTIFF tif_dirwrite.c Denial Of Service
Posted Jul 6, 2017
Authored by Team OWL337

LibTIFF suffers from a denial of service vulnerability in tif_dirwrite.c.

tags | exploit, denial of service
advisories | CVE-2017-10688
SHA-256 | 29c9e2e68d97d7d8cc323b4447051ef6b08f87bf62ce9dd080f3ebc096633f10
Page 1 of 1
Back1Next

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    17 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    6 Files
  • 24
    May 24th
    19 Files
  • 25
    May 25th
    5 Files
  • 26
    May 26th
    12 Files
  • 27
    May 27th
    12 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close