SAP Netweaver CVE-2016-1910 Information Disclosure Vulnerability
Monthly Archives: September 2016
Vuln: WordPress WassUp Plugin 'main.php' Cross Site Scripting Vulnerability
WordPress WassUp Plugin ‘main.php’ Cross Site Scripting Vulnerability
CVE-2016-4264
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2016-6298
The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).
RHSA-2016:1797-1: Moderate: ipa security update
Red Hat Enterprise Linux: An update for ipa is now available for Red Hat Enterprise Linux 6 and Red Hat
Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.
CVE-2016-5404
RHBA-2016:1796-1: rh-nodejs4 bug fix update
Red Hat Enterprise Linux: Updated rh-nodejs4 packages that fix one bug are now available for Red Hat
Software Collections.
FortiClient SSL-VPN 5.4 Clear Text Password Extraction
FortiClient SSL-VPN versions 5.4 and below suffer from a clear text password memory extraction vulnerability.
Red Hat Security Advisory 2016-1797-01
Red Hat Security Advisory 2016-1797-01 – Red Hat Identity Management is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix: An insufficient permission check issue was found in the way IPA server treats certificate revocation requests. An attacker logged in with the ‘retrieve certificate’ permission enabled could use this flaw to revoke certificates, possibly triggering a denial of service attack.
Malvertising Campaign Pushing Neutrino Exploit Kit Shut Down
Researchers uncovered a global malvertising campaign exposing potentially millions of users to the risk of being hit with CrypMIC ransomware delivered via the Neutrino Exploit Kit.
Insecure Redis Instances at Core of Attacks Against Linux Servers
Attackers are targeting insecure Redis instances, exposed to the internet, to access Linux servers and delete web files and folders in exchange for ransom.