Monthly Archives: January 2016

NVD

CVE-2015-6863

HPE ArcSight Logger before 6.1P1 allows remote attackers to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.

NVD

CVE-2015-6864

HPE ArcSight Logger before 6.1P1 allows remote authenticated users to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.

NVD

CVE-2016-1133

CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI.

NVD

CVE-2016-1293

Multiple cross-site scripting (XSS) vulnerabilities in the Management Center in Cisco FireSIGHT System Software 6.0.0 and 6.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCux40414.

NVD

CVE-2016-1294

Cross-site scripting (XSS) vulnerability in the Management Center in Cisco FireSIGHT System Software 6.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted cookie, aka Bug ID CSCuw89094.

NVD

CVE-2016-1295

Cisco Adaptive Security Appliance (ASA) Software 8.4 allows remote attackers to obtain sensitive information via an AnyConnect authentication attempt, aka Bug ID CSCuo65775.

Full Disclosure

Re: Combining DLL hijacking with USB keyboard emulation

Posted by Rodrigo Menezes on Jan 15

While I agree that there is a lot you can do if you can plug a
malicious USB device into a computer and that you might not need
to take advantage of the DLL problem in order to successfully
complete the attack, my point is that it could help.

Consider that the attack could be carried out either by
convincing the user to plug in the USB device or by sneakly
plugging it into their computer while they’re away. Therefore,
reducing the time it…