Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
All posts by 007admin
CVE-2017-6059
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
backintime-1.1.20-1.fc24
– update to 1.1.20
– fixes CVE-2017-7572
backintime-1.1.20-1.fc25
– update to 1.1.20
– fixes CVE-2017-7572
backintime-1.1.20-1.fc26
– update to 1.1.20
– fixes CVE-2017-7572
XiongMai uc-http 1.0.0 Local File Inclusion / Directory Traversal
uc-httpd is an HTTP daemon used by a wide array of IoT devices and is vulnerable to local file inclusion and directory traversal bugs.
Phone Hack Uses Sensors To Steal PINs
University researchers created a browser-based JavaScript that leverages a phone’s smart device sensor data to steal PINs.
CVE-2016-8716
An exploitable Cleartext Transmission of Password vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. The Change Password functionality of the Web Application transmits the password in cleartext. An attacker capable of intercepting this traffic is able to obtain valid credentials.
CVE-2016-8718
An exploitable Cross-Site Request Forgery vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted form can trick a client into making an unintentional request to the web server which will be treated as an authentic request.
CVE-2016-8719
An exploitable reflected Cross-Site Scripting vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Specially crafted input, in multiple parameters, can cause a malicious scripts to be executed by a victim.