CVE-2017-12881

The CVE-2017-12881 entry concerns Spring Batch Admin prior to version 1.3.0 that is vulnerable to Cross-Site Request Forgery (CSRF) on its file-upload functionality. The vulnerability would allow an attacker to hijack a victim’s authenticated session and submit arbitrary requests, including explo...

CVE-2017-12882

CVE-2017-12882 : Stored XSS in Spring Batch Admin pre-1.3.0 via the file upload feature. Root cause: unescaped input leading to execution of arbitrary JavaScript/HTML in authenticated user sessions. Affected: Spring Batch Admin versions before 1.3.0. Remediation: upgrade to 1.3.0 or later (patch/...

CVE-2017-12882: Improper Neutralization of Input During Web Page Generation

Stored Cross-site scripting XSS vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality...

CVE-2017-12881: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability...

QNAPQsyncClientWindows 4.2.1.0602 Privilege Escalation

Hi @ll, the executable installer QNAPQsyncClientWindows-4.2.1.0602.exe, available from , has like almost all executable installers multiple vulnerabilities: 1: arbitrary remote code execution WITH escalation of privilege On a fully patched Windows 7 SP1 it loads and executes the following Windows...

PT-2017-12750

Name of the Vulnerable Software and Affected Versions Spring Batch Admin versions prior to 1.3.0 Description The issue allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality, which can lead to stored cross-site scripting XSS attacks...

PT-2017-12749

Name of the Vulnerable Software and Affected Versions Spring Batch Admin versions prior to 1.3.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of victims and submit arbitrary requests. This can be used to exploit other vulnerabilities, su...

USN-3312-2 linux-lts-xenial vulnerabilities

USN-3312-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that the netfilter netlink implementation in the Linux kernel did no...

PT-2017-18836

Name of the Vulnerable Software and Affected Versions Tiki Wiki CMS Groupware version 16.2 Description The issue allows remote attackers to bypass the XSS filter in Tiki Wiki CMS Groupware. This can be achieved by using padded zero characters. An example of an attack vector is tiki-batch send...

DEBIAN-CVE-2015-5211

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download RFD attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being...

CVE-2015-5211

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download RFD attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being...

CVE-2015-5211

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download RFD attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being...

CVE-2015-5211: Files or Directories Accessible to External Parties

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download RFD attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being...

Share“the eternal blue MS17-010）”batch remote detection tools-vulnerability warning-the black bar safety net

In view of the distinguished manufacturers are relatively self-sustaining, refused to publish easy-to-use batch scanning tool, here on behalf of. You hard to force the network, you find in their own territory and sweep. In particular despise itonly to pay for the user issuing the batch testing...

x86: 64bit PV guest breakout via pagetable use-after-mode-change

ISSUE DESCRIPTION 64-bit PV guests typically use separate root page tables for their kernel and user modes. Hypercalls are accessible to guest kernel context only, which certain hypercall handlers make assumptions on. The IRET hypercall replacing the identically name CPU instruction is used by...

PT-2017-16377

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2015.8.13 SaltStack Salt versions 2016.3.x prior to 2016.3.5 SaltStack Salt versions 2016.11.x prior to 2016.11.2 Description The issue arises when using the local batch client from salt-api in SaltStack Salt,...

New Clues Surface on Shamoon 2's Destructive Behavior

Researchers on Monday reported progress in piecing together some of the missing pieces of the Shamoon 2 puzzle that have been eluding them when it comes to lateral network movement and execution of the Disttrack malware component used in past campaigns. Shamoon 2 uses a combination of legitimate...

Dr0p1t-Framework 1.2 - A Framework That Creates An Advanced FUD Dropper With Some Tricks

Have you ever heard about trojan droppers ? In short dropper is type of trojans that downloads other malwares and Dr0p1t gives you the chance to create a dropper that bypass most AVs and have some tricks ; Features Framework works with Windows and Linux Download executable on target system and...

CVE-2016-9051

An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attacker can...

CVE-2016-9051

An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attacker can...